dcrat | f19bfa53dd35f17d71e2c3771b2160a2799216c8e7b6a5b5bc1253c4d12a37e7

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2022, 04:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

613c8540d116ee2b43a99067e04fa79a.exe
Size

2.9MB
MD5

613c8540d116ee2b43a99067e04fa79a
SHA1

9cb122624c4e81615e1e7c7b1210a2d6d0dc6840
SHA256

f19bfa53dd35f17d71e2c3771b2160a2799216c8e7b6a5b5bc1253c4d12a37e7
SHA512

0a53ef3bbeccdea1382dc461307da17905861977ab7d6faa6b7339d64464b4fccb36c1d418f52d7453c84d4fcf98aab7e85d3eeea4b0dd00a4ec153d7da3a3c1
SSDEEP

49152:MQ00xeGLcCrbIF1T1TcRPKlQp4z8mlraJafgtHOpaAl+mx0flF640Sya:MQ0FCrbG9VcRilQpkFrpxaAl+m4Asy

Score

10^/10

dcrat evasion infostealer persistence rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 16 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\", \"C:\\Windows\\InputMethod\\SHARED\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Windows\\Offline Web Pages\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\", \"C:\\Windows\\InputMethod\\SHARED\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Windows\\Offline Web Pages\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Windows\\GameBarPresenceWriter\\SppExtComObj.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\", \"C:\\Windows\\InputMethod\\SHARED\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Windows\\Offline Web Pages\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Windows\\GameBarPresenceWriter\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\613c8540d116ee2b43a99067e04fa79a.exe\", \"C:\\Users\\Admin\\SearchApp.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Users\\Public\\Music\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\odt\\WaaSMedicAgent.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\", \"C:\\Windows\\InputMethod\\SHARED\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Windows\\Offline Web Pages\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Windows\\GameBarPresenceWriter\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\613c8540d116ee2b43a99067e04fa79a.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\", \"C:\\Windows\\InputMethod\\SHARED\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Windows\\Offline Web Pages\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Windows\\GameBarPresenceWriter\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\613c8540d116ee2b43a99067e04fa79a.exe\", \"C:\\Users\\Admin\\SearchApp.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Users\\Public\\Music\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\", \"C:\\Windows\\InputMethod\\SHARED\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Windows\\Offline Web Pages\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Windows\\GameBarPresenceWriter\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\613c8540d116ee2b43a99067e04fa79a.exe\", \"C:\\Users\\Admin\\SearchApp.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Users\\Public\\Music\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\odt\\WaaSMedicAgent.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\", \"C:\\Windows\\InputMethod\\SHARED\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Windows\\Offline Web Pages\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Windows\\GameBarPresenceWriter\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\613c8540d116ee2b43a99067e04fa79a.exe\", \"C:\\Users\\Admin\\SearchApp.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Users\\Public\\Music\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\odt\\WaaSMedicAgent.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\", \"C:\\Windows\\InputMethod\\SHARED\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\SppExtComObj.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\", \"C:\\Windows\\InputMethod\\SHARED\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\", \"C:\\Windows\\InputMethod\\SHARED\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Windows\\Offline Web Pages\\fontdrvhost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\", \"C:\\Windows\\InputMethod\\SHARED\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Windows\\Offline Web Pages\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Windows\\GameBarPresenceWriter\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\613c8540d116ee2b43a99067e04fa79a.exe\", \"C:\\Users\\Admin\\SearchApp.exe\", \"C:\\odt\\csrss.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\", \"C:\\Windows\\InputMethod\\SHARED\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Windows\\Offline Web Pages\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Windows\\GameBarPresenceWriter\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\613c8540d116ee2b43a99067e04fa79a.exe\", \"C:\\Users\\Admin\\SearchApp.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Users\\Public\\Music\\RuntimeBroker.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\", \"C:\\Windows\\InputMethod\\SHARED\\backgroundTaskHost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\", \"C:\\Windows\\InputMethod\\SHARED\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\dllhost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\", \"C:\\Windows\\InputMethod\\SHARED\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Windows\\Offline Web Pages\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Windows\\GameBarPresenceWriter\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\613c8540d116ee2b43a99067e04fa79a.exe\", \"C:\\Users\\Admin\\SearchApp.exe\""	613c8540d116ee2b43a99067e04fa79a.exe

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3284	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3280	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	488	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	716	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3764	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3812	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3800	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3196	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3192	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3140	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	3748	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	3748	schtasks.exe	53

UAC bypass 3 TTPs 9 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WaaSMedicAgent.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3052-132-0x00000000000B0000-0x00000000003A0000-memory.dmp	dcrat
behavioral2/files/0x0006000000022e2a-189.dat	dcrat
behavioral2/files/0x0006000000022e5f-246.dat	dcrat
behavioral2/files/0x0006000000022e5f-245.dat	dcrat

Executes dropped EXE 2 IoCs

pid	Process
3836	613c8540d116ee2b43a99067e04fa79a.exe
4656	WaaSMedicAgent.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	613c8540d116ee2b43a99067e04fa79a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	613c8540d116ee2b43a99067e04fa79a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WaaSMedicAgent.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\InputMethod\\SHARED\\backgroundTaskHost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\dllhost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\GameBarPresenceWriter\\SppExtComObj.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\613c8540d116ee2b43a99067e04fa79a = "\"C:\\Recovery\\WindowsRE\\613c8540d116ee2b43a99067e04fa79a.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\odt\\csrss.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Public\\Music\\RuntimeBroker.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\Offline Web Pages\\fontdrvhost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\Offline Web Pages\\fontdrvhost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\Admin\\SearchApp.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\odt\\Registry.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\odt\\WaaSMedicAgent.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\GameBarPresenceWriter\\SppExtComObj.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\613c8540d116ee2b43a99067e04fa79a = "\"C:\\Recovery\\WindowsRE\\613c8540d116ee2b43a99067e04fa79a.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Public\\Music\\RuntimeBroker.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\odt\\WaaSMedicAgent.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Reference Assemblies\\SppExtComObj.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\SppExtComObj.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\odt\\Registry.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\Admin\\SearchApp.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\InputMethod\\SHARED\\backgroundTaskHost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\SppExtComObj.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\dllhost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\odt\\csrss.exe\""	613c8540d116ee2b43a99067e04fa79a.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WaaSMedicAgent.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	ipinfo.io
34	ipinfo.io

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\e1ef82546f0b02	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\SppExtComObj.exe	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Program Files\Reference Assemblies\SppExtComObj.exe	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files\Reference Assemblies\RCX9716.tmp	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files\Reference Assemblies\RCX97B4.tmp	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\SppExtComObj.exe	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\e1ef82546f0b02	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\5940a34987c991	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files\Reference Assemblies\SppExtComObj.exe	613c8540d116ee2b43a99067e04fa79a.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InputMethod\SHARED\backgroundTaskHost.exe	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Windows\Offline Web Pages\fontdrvhost.exe	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Windows\Offline Web Pages\5b884080fd4f94	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Windows\servicing\en-US\fontdrvhost.exe	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Windows\Offline Web Pages\fontdrvhost.exe	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Windows\InputMethod\SHARED\eddb19405b7ce1	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Windows\InputMethod\SHARED\RCX9A45.tmp	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Windows\GameBarPresenceWriter\SppExtComObj.exe	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Windows\GameBarPresenceWriter\e1ef82546f0b02	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Windows\GameBarPresenceWriter\SppExtComObj.exe	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Windows\InputMethod\SHARED\backgroundTaskHost.exe	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Windows\InputMethod\SHARED\RCX9AD3.tmp	613c8540d116ee2b43a99067e04fa79a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1856	schtasks.exe
812	schtasks.exe
3192	schtasks.exe
2004	schtasks.exe
820	schtasks.exe
2708	schtasks.exe
3812	schtasks.exe
972	schtasks.exe
2172	schtasks.exe
3140	schtasks.exe
2232	schtasks.exe
4824	schtasks.exe
4400	schtasks.exe
4628	schtasks.exe
3440	schtasks.exe
3120	schtasks.exe
3328	schtasks.exe
4768	schtasks.exe
4980	schtasks.exe
1624	schtasks.exe
716	schtasks.exe
4952	schtasks.exe
3196	schtasks.exe
4712	schtasks.exe
2080	schtasks.exe
1884	schtasks.exe
4756	schtasks.exe
1964	schtasks.exe
2424	schtasks.exe
3800	schtasks.exe
2388	schtasks.exe
488	schtasks.exe
3764	schtasks.exe
1992	schtasks.exe
2460	schtasks.exe
376	schtasks.exe
5012	schtasks.exe
3280	schtasks.exe
4332	schtasks.exe
1740	schtasks.exe
2216	schtasks.exe
224	schtasks.exe
536	schtasks.exe
3144	schtasks.exe
4840	schtasks.exe
3284	schtasks.exe
3376	schtasks.exe
3808	schtasks.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	613c8540d116ee2b43a99067e04fa79a.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	613c8540d116ee2b43a99067e04fa79a.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3052	613c8540d116ee2b43a99067e04fa79a.exe
428	powershell.exe
4292	powershell.exe
4292	powershell.exe
1860	powershell.exe
1860	powershell.exe
4932	powershell.exe
4932	powershell.exe
1544	powershell.exe
1544	powershell.exe
2604	powershell.exe
2604	powershell.exe
3804	Process not Found
3804	Process not Found
5116	powershell.exe
5116	powershell.exe
4400	schtasks.exe
4400	schtasks.exe
5036	powershell.exe
5036	powershell.exe
4188	powershell.exe
4188	powershell.exe
228	powershell.exe
228	powershell.exe
1860	powershell.exe
428	powershell.exe
428	powershell.exe
1544	powershell.exe
4292	powershell.exe
4932	powershell.exe
5036	powershell.exe
2604	powershell.exe
5116	powershell.exe
4188	powershell.exe
3804	Process not Found
228	powershell.exe
4400	schtasks.exe
3836	613c8540d116ee2b43a99067e04fa79a.exe
1148	powershell.exe
1148	powershell.exe
4512	powershell.exe
4512	powershell.exe
5116	powershell.exe
5116	powershell.exe
5008	powershell.exe
5008	powershell.exe
4812	powershell.exe
4812	powershell.exe
2092	powershell.exe
2092	powershell.exe
4740	powershell.exe
4740	powershell.exe
2732	powershell.exe
2732	powershell.exe
5096	powershell.exe
5096	powershell.exe
408	powershell.exe
408	powershell.exe
344	powershell.exe
344	powershell.exe
4732	powershell.exe
4732	powershell.exe
1148	powershell.exe
1148	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4656	WaaSMedicAgent.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	3052	613c8540d116ee2b43a99067e04fa79a.exe
Token: SeDebugPrivilege	428	powershell.exe
Token: SeDebugPrivilege	4292	powershell.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	3804	Process not Found
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	4400	schtasks.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeDebugPrivilege	228	powershell.exe
Token: SeDebugPrivilege	3836	613c8540d116ee2b43a99067e04fa79a.exe
Token: SeDebugPrivilege	1148	powershell.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeDebugPrivilege	4812	powershell.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeDebugPrivilege	344	powershell.exe
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeDebugPrivilege	4656	WaaSMedicAgent.exe
Token: SeBackupPrivilege	1176	vssvc.exe
Token: SeRestorePrivilege	1176	vssvc.exe
Token: SeAuditPrivilege	1176	vssvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4656	WaaSMedicAgent.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 4292	3052	613c8540d116ee2b43a99067e04fa79a.exe	88
PID 3052 wrote to memory of 4292	3052	613c8540d116ee2b43a99067e04fa79a.exe	88
PID 3052 wrote to memory of 428	3052	613c8540d116ee2b43a99067e04fa79a.exe	91
PID 3052 wrote to memory of 428	3052	613c8540d116ee2b43a99067e04fa79a.exe	91
PID 3052 wrote to memory of 4932	3052	613c8540d116ee2b43a99067e04fa79a.exe	89
PID 3052 wrote to memory of 4932	3052	613c8540d116ee2b43a99067e04fa79a.exe	89
PID 3052 wrote to memory of 1544	3052	613c8540d116ee2b43a99067e04fa79a.exe	92
PID 3052 wrote to memory of 1544	3052	613c8540d116ee2b43a99067e04fa79a.exe	92
PID 3052 wrote to memory of 1860	3052	613c8540d116ee2b43a99067e04fa79a.exe	111
PID 3052 wrote to memory of 1860	3052	613c8540d116ee2b43a99067e04fa79a.exe	111
PID 3052 wrote to memory of 2604	3052	613c8540d116ee2b43a99067e04fa79a.exe	109
PID 3052 wrote to memory of 2604	3052	613c8540d116ee2b43a99067e04fa79a.exe	109
PID 3052 wrote to memory of 5116	3052	613c8540d116ee2b43a99067e04fa79a.exe	96
PID 3052 wrote to memory of 5116	3052	613c8540d116ee2b43a99067e04fa79a.exe	96
PID 3052 wrote to memory of 4188	3052	613c8540d116ee2b43a99067e04fa79a.exe	97
PID 3052 wrote to memory of 4188	3052	613c8540d116ee2b43a99067e04fa79a.exe	97
PID 3052 wrote to memory of 228	3052	613c8540d116ee2b43a99067e04fa79a.exe	98
PID 3052 wrote to memory of 228	3052	613c8540d116ee2b43a99067e04fa79a.exe	98
PID 3052 wrote to memory of 5036	3052	613c8540d116ee2b43a99067e04fa79a.exe	99
PID 3052 wrote to memory of 5036	3052	613c8540d116ee2b43a99067e04fa79a.exe	99
PID 3052 wrote to memory of 3804	3052	613c8540d116ee2b43a99067e04fa79a.exe	100
PID 3052 wrote to memory of 3804	3052	613c8540d116ee2b43a99067e04fa79a.exe	100
PID 3052 wrote to memory of 4400	3052	613c8540d116ee2b43a99067e04fa79a.exe	133
PID 3052 wrote to memory of 4400	3052	613c8540d116ee2b43a99067e04fa79a.exe	133
PID 3052 wrote to memory of 2472	3052	613c8540d116ee2b43a99067e04fa79a.exe	112
PID 3052 wrote to memory of 2472	3052	613c8540d116ee2b43a99067e04fa79a.exe	112
PID 2472 wrote to memory of 2072	2472	cmd.exe	114
PID 2472 wrote to memory of 2072	2472	cmd.exe	114
PID 2472 wrote to memory of 3836	2472	cmd.exe	118
PID 2472 wrote to memory of 3836	2472	cmd.exe	118
PID 3836 wrote to memory of 1148	3836	613c8540d116ee2b43a99067e04fa79a.exe	190
PID 3836 wrote to memory of 1148	3836	613c8540d116ee2b43a99067e04fa79a.exe	190
PID 3836 wrote to memory of 4512	3836	613c8540d116ee2b43a99067e04fa79a.exe	189
PID 3836 wrote to memory of 4512	3836	613c8540d116ee2b43a99067e04fa79a.exe	189
PID 3836 wrote to memory of 5008	3836	613c8540d116ee2b43a99067e04fa79a.exe	164
PID 3836 wrote to memory of 5008	3836	613c8540d116ee2b43a99067e04fa79a.exe	164
PID 3836 wrote to memory of 4812	3836	613c8540d116ee2b43a99067e04fa79a.exe	165
PID 3836 wrote to memory of 4812	3836	613c8540d116ee2b43a99067e04fa79a.exe	165
PID 3836 wrote to memory of 5116	3836	613c8540d116ee2b43a99067e04fa79a.exe	185
PID 3836 wrote to memory of 5116	3836	613c8540d116ee2b43a99067e04fa79a.exe	185
PID 3836 wrote to memory of 4740	3836	613c8540d116ee2b43a99067e04fa79a.exe	183
PID 3836 wrote to memory of 4740	3836	613c8540d116ee2b43a99067e04fa79a.exe	183
PID 3836 wrote to memory of 5096	3836	613c8540d116ee2b43a99067e04fa79a.exe	166
PID 3836 wrote to memory of 5096	3836	613c8540d116ee2b43a99067e04fa79a.exe	166
PID 3836 wrote to memory of 2732	3836	613c8540d116ee2b43a99067e04fa79a.exe	179
PID 3836 wrote to memory of 2732	3836	613c8540d116ee2b43a99067e04fa79a.exe	179
PID 3836 wrote to memory of 2092	3836	613c8540d116ee2b43a99067e04fa79a.exe	177
PID 3836 wrote to memory of 2092	3836	613c8540d116ee2b43a99067e04fa79a.exe	177
PID 3836 wrote to memory of 408	3836	613c8540d116ee2b43a99067e04fa79a.exe	176
PID 3836 wrote to memory of 408	3836	613c8540d116ee2b43a99067e04fa79a.exe	176
PID 3836 wrote to memory of 4732	3836	613c8540d116ee2b43a99067e04fa79a.exe	172
PID 3836 wrote to memory of 4732	3836	613c8540d116ee2b43a99067e04fa79a.exe	172
PID 3836 wrote to memory of 344	3836	613c8540d116ee2b43a99067e04fa79a.exe	170
PID 3836 wrote to memory of 344	3836	613c8540d116ee2b43a99067e04fa79a.exe	170
PID 3836 wrote to memory of 2376	3836	613c8540d116ee2b43a99067e04fa79a.exe	173
PID 3836 wrote to memory of 2376	3836	613c8540d116ee2b43a99067e04fa79a.exe	173
PID 2376 wrote to memory of 1452	2376	cmd.exe	182
PID 2376 wrote to memory of 1452	2376	cmd.exe	182
PID 2376 wrote to memory of 4656	2376	cmd.exe	192
PID 2376 wrote to memory of 4656	2376	cmd.exe	192
PID 4656 wrote to memory of 880	4656	WaaSMedicAgent.exe	193
PID 4656 wrote to memory of 880	4656	WaaSMedicAgent.exe	193
PID 4656 wrote to memory of 4956	4656	WaaSMedicAgent.exe	194
PID 4656 wrote to memory of 4956	4656	WaaSMedicAgent.exe	194

System policy modification 1 TTPs 9 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WaaSMedicAgent.exe

C:\Users\Admin\AppData\Local\Temp\613c8540d116ee2b43a99067e04fa79a.exe
"C:\Users\Admin\AppData\Local\Temp\613c8540d116ee2b43a99067e04fa79a.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  PID:5116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  PID:3804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  PID:4400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tdnSJsnH3X.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2072
- - C:\Users\Admin\AppData\Local\Temp\613c8540d116ee2b43a99067e04fa79a.exe
    "C:\Users\Admin\AppData\Local\Temp\613c8540d116ee2b43a99067e04fa79a.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Executes dropped EXE
    - Checks computer location settings
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4732
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VSWSOgwmSy.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2376
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:1452
    - - C:\odt\WaaSMedicAgent.exe
        
        "C:\odt\WaaSMedicAgent.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks computer location settings
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4656
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6fc13434-ba3a-4f69-8a9e-ae36522da078.vbs"
        6⤵
        
        PID:880
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2963ab68-5ee6-420d-9619-7d6abd7e4ede.vbs"
        6⤵
        
        PID:4956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Windows\InputMethod\SHARED\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\InputMethod\SHARED\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Windows\InputMethod\SHARED\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Windows\Offline Web Pages\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\Offline Web Pages\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "613c8540d116ee2b43a99067e04fa79a6" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\613c8540d116ee2b43a99067e04fa79a.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "613c8540d116ee2b43a99067e04fa79a" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\613c8540d116ee2b43a99067e04fa79a.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 9 /tr "'C:\odt\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 14 /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\odt\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Music\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Music\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Music\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Admin\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "613c8540d116ee2b43a99067e04fa79a6" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\613c8540d116ee2b43a99067e04fa79a.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Windows\GameBarPresenceWriter\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Windows\GameBarPresenceWriter\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1176

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\613c8540d116ee2b43a99067e04fa79a.exe.log

Filesize
1KB

MD5
bbb951a34b516b66451218a3ec3b0ae1

SHA1
7393835a2476ae655916e0a9687eeaba3ee876e9

SHA256
eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a

SHA512
63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
7f57a48d8f9606c22b93babb970240fa

SHA1
b3fe892dbd71f04703919d8d76c44d6b30aa1a3f

SHA256
86966d668029698d60e6ae6aa76e4f694b17b1b039e466d77058c21c2db9aa38

SHA512
d56b0b180942ff051a95d6d478b21f9725184ea63e5d14cdf86af96c1279945179c857bea71a6a27fd794429dcf19c9c497720b728eaebded321ef80e7e80f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
08526e4d8fed0a382c243c9aa8b1fe45

SHA1
f3da4b97529aaa38230db8bfa34a345bbc211622

SHA256
b5044625d66b7835745c7c4efa14d21aaf4ee42bf971f8bbc44f04416b91441f

SHA512
cbeb569db60eabd89c13b073f1bdf7ba991b6206e75f548396a150b08a0ffed1962d88d664e069c64ac740afbb69941df2f43e81a3f138e2185934967898941d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
08526e4d8fed0a382c243c9aa8b1fe45

SHA1
f3da4b97529aaa38230db8bfa34a345bbc211622

SHA256
b5044625d66b7835745c7c4efa14d21aaf4ee42bf971f8bbc44f04416b91441f

SHA512
cbeb569db60eabd89c13b073f1bdf7ba991b6206e75f548396a150b08a0ffed1962d88d664e069c64ac740afbb69941df2f43e81a3f138e2185934967898941d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
fe9b96bc4e29457b2d225a5412322a52

SHA1
551e29903e926b5d6c52a8f57cf10475ba790bd0

SHA256
e81b9bfd38a5199813d703d5caf75baa6f62847b2b9632302b5d6f10dd6cf997

SHA512
ff912526647f6266f37749dfdc3ed5fd37c35042ba481331434168704c827d128c22093ba73d7ad0cecde10365f0978fcd3f3e2af1a1c280cd2e592a62d5fa80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
7f57a48d8f9606c22b93babb970240fa

SHA1
b3fe892dbd71f04703919d8d76c44d6b30aa1a3f

SHA256
86966d668029698d60e6ae6aa76e4f694b17b1b039e466d77058c21c2db9aa38

SHA512
d56b0b180942ff051a95d6d478b21f9725184ea63e5d14cdf86af96c1279945179c857bea71a6a27fd794429dcf19c9c497720b728eaebded321ef80e7e80f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
fe9b96bc4e29457b2d225a5412322a52

SHA1
551e29903e926b5d6c52a8f57cf10475ba790bd0

SHA256
e81b9bfd38a5199813d703d5caf75baa6f62847b2b9632302b5d6f10dd6cf997

SHA512
ff912526647f6266f37749dfdc3ed5fd37c35042ba481331434168704c827d128c22093ba73d7ad0cecde10365f0978fcd3f3e2af1a1c280cd2e592a62d5fa80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
7f57a48d8f9606c22b93babb970240fa

SHA1
b3fe892dbd71f04703919d8d76c44d6b30aa1a3f

SHA256
86966d668029698d60e6ae6aa76e4f694b17b1b039e466d77058c21c2db9aa38

SHA512
d56b0b180942ff051a95d6d478b21f9725184ea63e5d14cdf86af96c1279945179c857bea71a6a27fd794429dcf19c9c497720b728eaebded321ef80e7e80f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
7f57a48d8f9606c22b93babb970240fa

SHA1
b3fe892dbd71f04703919d8d76c44d6b30aa1a3f

SHA256
86966d668029698d60e6ae6aa76e4f694b17b1b039e466d77058c21c2db9aa38

SHA512
d56b0b180942ff051a95d6d478b21f9725184ea63e5d14cdf86af96c1279945179c857bea71a6a27fd794429dcf19c9c497720b728eaebded321ef80e7e80f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0f6a77860cd9c5289dd6e45bbc36a982

SHA1
750d55b0d394bc5716fc3e3204975b029d3dc43b

SHA256
a8388051b43fdc7a50ee51047ef4076c4b6502a6e53befe8131efcb71aa700a4

SHA512
e4e4473383243a71d7bebffb8bf4bf449201e1aee752426044e81bdc12c3aaf284ce003a859b0ac96d5fd75063376485dc5b5ac0caad189577bf394f104cdd06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0f6a77860cd9c5289dd6e45bbc36a982

SHA1
750d55b0d394bc5716fc3e3204975b029d3dc43b

SHA256
a8388051b43fdc7a50ee51047ef4076c4b6502a6e53befe8131efcb71aa700a4

SHA512
e4e4473383243a71d7bebffb8bf4bf449201e1aee752426044e81bdc12c3aaf284ce003a859b0ac96d5fd75063376485dc5b5ac0caad189577bf394f104cdd06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0f6a77860cd9c5289dd6e45bbc36a982

SHA1
750d55b0d394bc5716fc3e3204975b029d3dc43b

SHA256
a8388051b43fdc7a50ee51047ef4076c4b6502a6e53befe8131efcb71aa700a4

SHA512
e4e4473383243a71d7bebffb8bf4bf449201e1aee752426044e81bdc12c3aaf284ce003a859b0ac96d5fd75063376485dc5b5ac0caad189577bf394f104cdd06

Download Submit
C:\Users\Admin\AppData\Local\Temp\2963ab68-5ee6-420d-9619-7d6abd7e4ede.vbs

Filesize
477B

MD5
2ae51242879606e46a3f0e5d7c2a0b2f

SHA1
a6f5354bf7fb661ae142e2e6abca79a7a23331e0

SHA256
b266b4bb309e4fdd474aaafb8039f5b4c053ede0adb5cf318a5f7549498e92f7

SHA512
0e7ed2a245e26ade6fce5bae5d426e1a1e0a2bea91ba2d5aaaf1ecf2df302b493c7d1072f1a8819081a7fdb279c9e12eafdba5c2780e604f53d5bc8048c4c1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\613c8540d116ee2b43a99067e04fa79a.exe

Filesize
2.9MB

MD5
613c8540d116ee2b43a99067e04fa79a

SHA1
9cb122624c4e81615e1e7c7b1210a2d6d0dc6840

SHA256
f19bfa53dd35f17d71e2c3771b2160a2799216c8e7b6a5b5bc1253c4d12a37e7

SHA512
0a53ef3bbeccdea1382dc461307da17905861977ab7d6faa6b7339d64464b4fccb36c1d418f52d7453c84d4fcf98aab7e85d3eeea4b0dd00a4ec153d7da3a3c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\6fc13434-ba3a-4f69-8a9e-ae36522da078.vbs

Filesize
701B

MD5
6766691177bce8856409bc364a57dc53

SHA1
a12ec73c146630ca4fa81de20b8e4d2b716fc285

SHA256
8865c2bbc08ab2484ef060ecc1e9e14a4d782bc91197a88de01ae4787ec8dee9

SHA512
783305aa5e38bd7b531a08f59f427d49d265e3519a9a048edb027b44b72aef208f156ea4d3c96a3e04bf5462fb54dbfe9472ab0c81836c56fc975b80ebb1ccfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\VSWSOgwmSy.bat

Filesize
190B

MD5
7b0620bdc6f80abeef196feb0debc0e9

SHA1
f0dc5f6b3c7d492a332fe712992e8bfe71d76f95

SHA256
f708b5ea3037c690bd3f07bbfef1eb9c88fc9502f04cb7395e0c5c26c508decc

SHA512
ea48bfe39e021a26697132ebb1f1dae863e0827e37a516859b80aa601f233e23c59138448635566666750d5637a2a33587ff99764c63d1f955b7a707a7522929

Download Submit
C:\Users\Admin\AppData\Local\Temp\tdnSJsnH3X.bat

Filesize
235B

MD5
f7ddb7862d6039b96ac93fb6f67fc34e

SHA1
f9d26240cba9ec697ceedde19ea38435d4d13775

SHA256
1910b20d4a66b3d34eb3df4c1bfc5040f94622a3684cb3e703c244c18c937376

SHA512
fc6b905c406d842c13b1732870edb2100cb24eba9515d208f75ae766f71b5e8048d4962ec8fe35770e72bd62e4039fb046da1e5d1d3e8cb0939f9f144410945e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp01599.tmp

Filesize
1KB

MD5
096a9dac3403ce803a77689e4e379d9e

SHA1
64ebfdb7e0574b4e08028dc3e889c745c0f806be

SHA256
f794addbc4b220e21c29aef5168ab159d03284637b66903f09308b4a6b90be2d

SHA512
0dd18868ebabb5e486e0c063d429dd01fa3a2c1cd24e39bd4c0fc8128954b3aaa365a310ae2cec7d98103eefa8e43de18620adb537580d2570b88bac0106e105

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp01599.tmp

Filesize
1KB

MD5
096a9dac3403ce803a77689e4e379d9e

SHA1
64ebfdb7e0574b4e08028dc3e889c745c0f806be

SHA256
f794addbc4b220e21c29aef5168ab159d03284637b66903f09308b4a6b90be2d

SHA512
0dd18868ebabb5e486e0c063d429dd01fa3a2c1cd24e39bd4c0fc8128954b3aaa365a310ae2cec7d98103eefa8e43de18620adb537580d2570b88bac0106e105

Download Submit
C:\odt\WaaSMedicAgent.exe

Filesize
2.9MB

MD5
613c8540d116ee2b43a99067e04fa79a

SHA1
9cb122624c4e81615e1e7c7b1210a2d6d0dc6840

SHA256
f19bfa53dd35f17d71e2c3771b2160a2799216c8e7b6a5b5bc1253c4d12a37e7

SHA512
0a53ef3bbeccdea1382dc461307da17905861977ab7d6faa6b7339d64464b4fccb36c1d418f52d7453c84d4fcf98aab7e85d3eeea4b0dd00a4ec153d7da3a3c1

Download Submit
C:\odt\WaaSMedicAgent.exe

Filesize
2.9MB

MD5
613c8540d116ee2b43a99067e04fa79a

SHA1
9cb122624c4e81615e1e7c7b1210a2d6d0dc6840

SHA256
f19bfa53dd35f17d71e2c3771b2160a2799216c8e7b6a5b5bc1253c4d12a37e7

SHA512
0a53ef3bbeccdea1382dc461307da17905861977ab7d6faa6b7339d64464b4fccb36c1d418f52d7453c84d4fcf98aab7e85d3eeea4b0dd00a4ec153d7da3a3c1

Download Submit
memory/228-161-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/228-180-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/344-214-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/344-235-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/408-221-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/408-237-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/428-168-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/428-152-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/428-148-0x00000292F8AC0000-0x00000292F8AE2000-memory.dmp

Filesize
136KB

Download
memory/1148-220-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/1148-205-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/1544-167-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/1544-156-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/1860-155-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/1860-169-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/2092-213-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/2092-243-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/2604-183-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/2604-158-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/2732-233-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/2732-210-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/3052-133-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/3052-151-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/3052-132-0x00000000000B0000-0x00000000003A0000-memory.dmp

Filesize
2.9MB

Download
memory/3052-135-0x000000001C980000-0x000000001CEA8000-memory.dmp

Filesize
5.2MB

Download
memory/3052-134-0x000000001AFC0000-0x000000001B010000-memory.dmp

Filesize
320KB

Download
memory/3804-186-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/3804-166-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/3836-212-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/3836-191-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/4188-160-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/4188-185-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/4292-176-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/4292-150-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/4400-173-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/4512-239-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/4512-206-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/4656-253-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/4656-247-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/4656-255-0x000000001F0F0000-0x000000001F2B2000-memory.dmp

Filesize
1.8MB

Download
memory/4732-231-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/4732-248-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/4740-241-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/4740-209-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/4812-236-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/4812-207-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/4932-178-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/4932-153-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/5008-240-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/5008-218-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/5036-187-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/5036-162-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/5096-211-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/5096-242-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/5116-234-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download
memory/5116-159-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/5116-179-0x00007FFC9FA40000-0x00007FFCA0501000-memory.dmp

Filesize
10.8MB

Download
memory/5116-219-0x00007FFC9F3C0000-0x00007FFC9FE81000-memory.dmp

Filesize
10.8MB

Download