dcrat | 5250a7d14874c55bebe18f783f9534fae7a79174fdd93efa5a96e079dcaefe83

Analysis

max time kernel
145s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31/03/2023, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0a6e25c9983c73293aa7c9aabb893d5.exe
Size 3.3MB
Sample230331-lycabshc29
SHA256 5250a7d14874c55bebe18f783f9534fae7a79174fdd93efa5a96e079dcaefe83
MD5 a0a6e25c9983c73293aa7c9aabb893d5
SHA1 ccc867837aeafdf57c3d122664a756adb9a324a3
SHA512 8ebee2ab924e3171f19ca3a91a330f1826d0f4128512b3131edef9e68aeedd5cd95e831902e5b0a736380b96e12acae37eff1559fde2c83c0eb05a36e1c5db4a
SSDEEP 98304:GEho/Wo7jzmfOMb1XTOsiVD5xu2tfLuxN3KutYI:vo1PypbdgtPu2hk3n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	364	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	524	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	340	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	1484	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	1484	schtasks.exe	28

UAC bypass 3 TTPs 9 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	schtasks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	schtasks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	schtasks.exe

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1264-54-0x0000000000EE0000-0x00000000014C6000-memory.dmp	dcrat
behavioral1/memory/2064-102-0x0000000000EE0000-0x00000000014C6000-memory.dmp	dcrat
behavioral1/memory/1264-106-0x0000000000EE0000-0x00000000014C6000-memory.dmp	dcrat
behavioral1/memory/2064-152-0x0000000008370000-0x0000000008956000-memory.dmp	dcrat
behavioral1/memory/2064-154-0x0000000000EE0000-0x00000000014C6000-memory.dmp	dcrat
behavioral1/memory/1716-157-0x00000000002D0000-0x00000000008B6000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
1716	schtasks.exe

Loads dropped DLL 2 IoCs

pid	Process
2064	a0a6e25c9983c73293aa7c9aabb893d5.exe
2064	a0a6e25c9983c73293aa7c9aabb893d5.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	schtasks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	schtasks.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
1264	a0a6e25c9983c73293aa7c9aabb893d5.exe
2064	a0a6e25c9983c73293aa7c9aabb893d5.exe
2064	a0a6e25c9983c73293aa7c9aabb893d5.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe

Drops file in Program Files directory 33 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\Microsoft\spoolsv.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Common Files\wininit.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\explorer.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\taskhost.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\3a6fe29a7ceee6	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\schtasks.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\b75386f1303e64	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\schtasks.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\7a0fd90576e088	a0a6e25c9983c73293aa7c9aabb893d5.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\schtasks.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files\VideoLAN\VLC\3a6fe29a7ceee6	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\dwm.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\dwm.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\smss.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\csrss.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\6cb0b6c459d5d3	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files\Java\jre7\taskhost.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files\Java\jre7\b75386f1303e64	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Google\a0a6e25c9983c73293aa7c9aabb893d5.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\f3b6ecef712a24	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\886983d96e3d3e	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files\MSBuild\Microsoft\3a6fe29a7ceee6	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Common Files\56085415360792	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\csrss.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\6cb0b6c459d5d3	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Google\fea5c3420db563	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files\MSBuild\Microsoft\schtasks.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files\VideoLAN\VLC\schtasks.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\3a6fe29a7ceee6	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\69ddcba757bf72	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\886983d96e3d3e	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\schtasks.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\3a6fe29a7ceee6	a0a6e25c9983c73293aa7c9aabb893d5.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\L2Schemas\24dbde2999530e	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Windows\Downloaded Program Files\winlogon.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Windows\Downloaded Program Files\cc11b995f2a76d	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Windows\de-DE\csrss.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Windows\de-DE\886983d96e3d3e	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Windows\Logs\schtasks.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Windows\Logs\3a6fe29a7ceee6	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Windows\L2Schemas\WmiPrvSE.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2940	schtasks.exe
1060	schtasks.exe
1904	schtasks.exe
1476	schtasks.exe
2028	schtasks.exe
1324	schtasks.exe
2260	schtasks.exe
3036	schtasks.exe
2232	schtasks.exe
1668	schtasks.exe
1352	schtasks.exe
2516	schtasks.exe
1408	schtasks.exe
1712	schtasks.exe
2176	schtasks.exe
984	schtasks.exe
1896	schtasks.exe
904	schtasks.exe
2280	schtasks.exe
984	schtasks.exe
2864	schtasks.exe
1976	schtasks.exe
1672	schtasks.exe
1968	schtasks.exe
2416	schtasks.exe
2648	schtasks.exe
1588	schtasks.exe
2208	schtasks.exe
340	schtasks.exe
2488	schtasks.exe
1520	schtasks.exe
860	schtasks.exe
2904	schtasks.exe
1660	schtasks.exe
584	schtasks.exe
2468	schtasks.exe
2132	schtasks.exe
2288	schtasks.exe
2828	schtasks.exe
3064	schtasks.exe
2336	schtasks.exe
904	schtasks.exe
1784	schtasks.exe
2396	schtasks.exe
536	schtasks.exe
1820	schtasks.exe
1232	schtasks.exe
980	schtasks.exe
1944	schtasks.exe
1544	schtasks.exe
1324	schtasks.exe
1584	schtasks.exe
1928	schtasks.exe
624	schtasks.exe
1056	schtasks.exe
1352	schtasks.exe
2328	schtasks.exe
1832	schtasks.exe
2192	schtasks.exe
2592	schtasks.exe
2784	schtasks.exe
756	schtasks.exe
364	schtasks.exe
2624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1264	a0a6e25c9983c73293aa7c9aabb893d5.exe
1264	a0a6e25c9983c73293aa7c9aabb893d5.exe
1264	a0a6e25c9983c73293aa7c9aabb893d5.exe
2064	a0a6e25c9983c73293aa7c9aabb893d5.exe
2064	a0a6e25c9983c73293aa7c9aabb893d5.exe
2064	a0a6e25c9983c73293aa7c9aabb893d5.exe
2064	a0a6e25c9983c73293aa7c9aabb893d5.exe
2064	a0a6e25c9983c73293aa7c9aabb893d5.exe
2064	a0a6e25c9983c73293aa7c9aabb893d5.exe
2064	a0a6e25c9983c73293aa7c9aabb893d5.exe
2064	a0a6e25c9983c73293aa7c9aabb893d5.exe
2064	a0a6e25c9983c73293aa7c9aabb893d5.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe
1716	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1264	a0a6e25c9983c73293aa7c9aabb893d5.exe
Token: SeDebugPrivilege	2064	a0a6e25c9983c73293aa7c9aabb893d5.exe
Token: SeDebugPrivilege	1716	schtasks.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1264	a0a6e25c9983c73293aa7c9aabb893d5.exe
2064	a0a6e25c9983c73293aa7c9aabb893d5.exe
1716	schtasks.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 2064	1264	a0a6e25c9983c73293aa7c9aabb893d5.exe	86
PID 1264 wrote to memory of 2064	1264	a0a6e25c9983c73293aa7c9aabb893d5.exe	86
PID 1264 wrote to memory of 2064	1264	a0a6e25c9983c73293aa7c9aabb893d5.exe	86
PID 1264 wrote to memory of 2064	1264	a0a6e25c9983c73293aa7c9aabb893d5.exe	86
PID 2064 wrote to memory of 1716	2064	a0a6e25c9983c73293aa7c9aabb893d5.exe	135
PID 2064 wrote to memory of 1716	2064	a0a6e25c9983c73293aa7c9aabb893d5.exe	135
PID 2064 wrote to memory of 1716	2064	a0a6e25c9983c73293aa7c9aabb893d5.exe	135
PID 2064 wrote to memory of 1716	2064	a0a6e25c9983c73293aa7c9aabb893d5.exe	135

System policy modification 1 TTPs 9 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	schtasks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	schtasks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a0a6e25c9983c73293aa7c9aabb893d5.exe
"C:\Users\Admin\AppData\Local\Temp\a0a6e25c9983c73293aa7c9aabb893d5.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1264
- C:\Users\Admin\AppData\Local\Temp\a0a6e25c9983c73293aa7c9aabb893d5.exe
  "C:\Users\Admin\AppData\Local\Temp\a0a6e25c9983c73293aa7c9aabb893d5.exe"
  2⤵
  - UAC bypass
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2064
- - C:\Windows\Logs\schtasks.exe
    "C:\Windows\Logs\schtasks.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\System.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Windows\Downloaded Program Files\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Windows\Downloaded Program Files\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jre7\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jre7\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 8 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 7 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a0a6e25c9983c73293aa7c9aabb893d5a" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\a0a6e25c9983c73293aa7c9aabb893d5.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a0a6e25c9983c73293aa7c9aabb893d5" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\a0a6e25c9983c73293aa7c9aabb893d5.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a0a6e25c9983c73293aa7c9aabb893d5a" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\a0a6e25c9983c73293aa7c9aabb893d5.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\de-DE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\Microsoft\schtasks.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\VLC\schtasks.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\VLC\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Downloads\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default\Downloads\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Downloads\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\taskhost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\taskhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\taskhost.exe'" /rl HIGHEST /f
1⤵
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\csrss.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\csrss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\csrss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f
1⤵
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\schtasks.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\schtasks.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\schtasks.exe'" /rl HIGHEST /f
1⤵
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\schtasks.exe'" /f
1⤵
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\schtasks.exe'" /rl HIGHEST /f
1⤵
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\schtasks.exe'" /rl HIGHEST /f
1⤵
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 11 /tr "'C:\Windows\Logs\schtasks.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Windows\Logs\schtasks.exe'" /rl HIGHEST /f
1⤵
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 9 /tr "'C:\Windows\Logs\schtasks.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\schtasks.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\schtasks.exe'" /rl HIGHEST /f
1⤵
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\schtasks.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\wininit.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\wininit.exe'" /rl HIGHEST /f
1⤵
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\wininit.exe'" /rl HIGHEST /f
1⤵
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 8 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\schtasks.exe'" /f
1⤵
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\schtasks.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 9 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\schtasks.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\schtasks.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\schtasks.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\schtasks.exe'" /rl HIGHEST /f
1⤵
PID:1344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\csrss.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\csrss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\csrss.exe'" /rl HIGHEST /f
1⤵
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Windows\L2Schemas\WmiPrvSE.exe'" /f
1⤵
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\L2Schemas\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Windows\L2Schemas\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 11 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\schtasks.exe'" /f
1⤵
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\schtasks.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 14 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\schtasks.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dwm.exe

Path C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\dwm.exe
Size 3.3MB
SHA256 5250a7d14874c55bebe18f783f9534fae7a79174fdd93efa5a96e079dcaefe83
MD5 a0a6e25c9983c73293aa7c9aabb893d5
SHA1 ccc867837aeafdf57c3d122664a756adb9a324a3
SHA512 8ebee2ab924e3171f19ca3a91a330f1826d0f4128512b3131edef9e68aeedd5cd95e831902e5b0a736380b96e12acae37eff1559fde2c83c0eb05a36e1c5db4a
SSDEEP 98304:GEho/Wo7jzmfOMb1XTOsiVD5xu2tfLuxN3KutYI:vo1PypbdgtPu2hk3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

schtasks.exe

Path C:\Windows\Logs\schtasks.exe
Size 3.3MB
SHA256 5250a7d14874c55bebe18f783f9534fae7a79174fdd93efa5a96e079dcaefe83
MD5 a0a6e25c9983c73293aa7c9aabb893d5
SHA1 ccc867837aeafdf57c3d122664a756adb9a324a3
SHA512 8ebee2ab924e3171f19ca3a91a330f1826d0f4128512b3131edef9e68aeedd5cd95e831902e5b0a736380b96e12acae37eff1559fde2c83c0eb05a36e1c5db4a
SSDEEP 98304:GEho/Wo7jzmfOMb1XTOsiVD5xu2tfLuxN3KutYI:vo1PypbdgtPu2hk3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

schtasks.exe

Path \??\c:\windows\logs\schtasks.exe
Size 3.3MB
SHA256 5250a7d14874c55bebe18f783f9534fae7a79174fdd93efa5a96e079dcaefe83
MD5 a0a6e25c9983c73293aa7c9aabb893d5
SHA1 ccc867837aeafdf57c3d122664a756adb9a324a3
SHA512 8ebee2ab924e3171f19ca3a91a330f1826d0f4128512b3131edef9e68aeedd5cd95e831902e5b0a736380b96e12acae37eff1559fde2c83c0eb05a36e1c5db4a
SSDEEP 98304:GEho/Wo7jzmfOMb1XTOsiVD5xu2tfLuxN3KutYI:vo1PypbdgtPu2hk3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

schtasks.exe

Path \Windows\Logs\schtasks.exe
Size 3.3MB
SHA256 5250a7d14874c55bebe18f783f9534fae7a79174fdd93efa5a96e079dcaefe83
MD5 a0a6e25c9983c73293aa7c9aabb893d5
SHA1 ccc867837aeafdf57c3d122664a756adb9a324a3
SHA512 8ebee2ab924e3171f19ca3a91a330f1826d0f4128512b3131edef9e68aeedd5cd95e831902e5b0a736380b96e12acae37eff1559fde2c83c0eb05a36e1c5db4a
SSDEEP 98304:GEho/Wo7jzmfOMb1XTOsiVD5xu2tfLuxN3KutYI:vo1PypbdgtPu2hk3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

schtasks.exe

Path \Windows\Logs\schtasks.exe
Size 3.3MB
SHA256 5250a7d14874c55bebe18f783f9534fae7a79174fdd93efa5a96e079dcaefe83
MD5 a0a6e25c9983c73293aa7c9aabb893d5
SHA1 ccc867837aeafdf57c3d122664a756adb9a324a3
SHA512 8ebee2ab924e3171f19ca3a91a330f1826d0f4128512b3131edef9e68aeedd5cd95e831902e5b0a736380b96e12acae37eff1559fde2c83c0eb05a36e1c5db4a
SSDEEP 98304:GEho/Wo7jzmfOMb1XTOsiVD5xu2tfLuxN3KutYI:vo1PypbdgtPu2hk3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1264-103-0x0000000009490000-0x0000000009A76000-memory.dmp

Download

memory/1264-106-0x0000000000EE0000-0x00000000014C6000-memory.dmp

Download

memory/1264-61-0x0000000000DE0000-0x0000000000DF2000-memory.dmp

Download

memory/1264-62-0x0000000000E90000-0x0000000000E9E000-memory.dmp

Download

memory/1264-65-0x00000000056B0000-0x00000000056F0000-memory.dmp

Download

memory/1264-59-0x0000000000DC0000-0x0000000000DCA000-memory.dmp

Download

memory/1264-55-0x0000000000B50000-0x0000000000B6C000-memory.dmp

Download

memory/1264-58-0x0000000000D80000-0x0000000000D92000-memory.dmp

Download

memory/1264-56-0x0000000000420000-0x0000000000430000-memory.dmp

Download

memory/1264-60-0x0000000002AA0000-0x0000000002AF6000-memory.dmp

Download

memory/1264-57-0x0000000000BD0000-0x0000000000BE6000-memory.dmp

Download

memory/1264-54-0x0000000000EE0000-0x00000000014C6000-memory.dmp

Download

memory/1716-159-0x0000000002870000-0x0000000002882000-memory.dmp

Download

memory/1716-158-0x0000000002480000-0x0000000002492000-memory.dmp

Download

memory/1716-160-0x0000000002D80000-0x0000000002DC0000-memory.dmp

Download

memory/1716-162-0x00000000002D0000-0x00000000008B6000-memory.dmp

Download

memory/1716-164-0x0000000002D80000-0x0000000002DC0000-memory.dmp

Download

memory/1716-157-0x00000000002D0000-0x00000000008B6000-memory.dmp

Download

memory/1716-156-0x00000000002D0000-0x00000000008B6000-memory.dmp

Download

memory/2064-108-0x00000000051A0000-0x00000000051E0000-memory.dmp

Download

memory/2064-154-0x0000000000EE0000-0x00000000014C6000-memory.dmp

Download

memory/2064-153-0x0000000008370000-0x0000000008956000-memory.dmp

Download

memory/2064-152-0x0000000008370000-0x0000000008956000-memory.dmp

Download

memory/2064-110-0x0000000000DC0000-0x0000000000DD2000-memory.dmp

Download

memory/2064-109-0x0000000000E10000-0x0000000000E66000-memory.dmp

Download

memory/2064-107-0x0000000000B30000-0x0000000000B42000-memory.dmp

Download

memory/2064-104-0x0000000000EE0000-0x00000000014C6000-memory.dmp

Download

memory/2064-102-0x0000000000EE0000-0x00000000014C6000-memory.dmp

Download