Malware Analysis Report

2025-08-11 06:15

Sample ID 231118-b64dnsgg75
Target NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe
SHA256 978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165
Tags
dcrat evasion infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165

Threat Level: Known bad

The file NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe was found to be: Known bad.

Malicious Activity Summary

dcrat evasion infostealer rat trojan

UAC bypass

DCRat payload

Dcrat family

Process spawned unexpected child process

DcRat

DCRat payload

Checks computer location settings

Executes dropped EXE

Checks whether UAC is enabled

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System policy modification

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-11-18 01:46

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-11-18 01:46

Reported

2023-11-18 01:49

Platform

win10v2004-20231020-en

Max time kernel

151s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\csrss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\csrss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\csrss.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Recovery\WindowsRE\csrss.exe N/A
N/A N/A C:\Recovery\WindowsRE\csrss.exe N/A
N/A N/A C:\Recovery\WindowsRE\csrss.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\csrss.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Offline Web Pages\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
File created C:\Windows\Offline Web Pages\72a879c1bef246 C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
File opened for modification C:\Windows\Offline Web Pages\RCX99A5.tmp C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
File opened for modification C:\Windows\Help\Help\RCX9C37.tmp C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
File created C:\Windows\Help\Help\7a0fd90576e088 C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
File created C:\Windows\SchCache\886983d96e3d3e C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
File opened for modification C:\Windows\Offline Web Pages\RCX9994.tmp C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
File opened for modification C:\Windows\Help\Help\explorer.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
File created C:\Windows\Help\Help\explorer.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
File created C:\Windows\SchCache\csrss.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
File opened for modification C:\Windows\Offline Web Pages\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
File opened for modification C:\Windows\Help\Help\RCX9C36.tmp C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
File opened for modification C:\Windows\SchCache\RCXA631.tmp C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
File opened for modification C:\Windows\SchCache\RCXA632.tmp C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
File opened for modification C:\Windows\SchCache\csrss.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings C:\Recovery\WindowsRE\csrss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings C:\Recovery\WindowsRE\csrss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings C:\Recovery\WindowsRE\csrss.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2036 wrote to memory of 4276 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 4276 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 3612 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 3612 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 5972 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Recovery\WindowsRE\csrss.exe
PID 2036 wrote to memory of 5972 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Recovery\WindowsRE\csrss.exe
PID 5972 wrote to memory of 5420 N/A C:\Recovery\WindowsRE\csrss.exe C:\Windows\System32\WScript.exe
PID 5972 wrote to memory of 5420 N/A C:\Recovery\WindowsRE\csrss.exe C:\Windows\System32\WScript.exe
PID 5972 wrote to memory of 5484 N/A C:\Recovery\WindowsRE\csrss.exe C:\Windows\System32\WScript.exe
PID 5972 wrote to memory of 5484 N/A C:\Recovery\WindowsRE\csrss.exe C:\Windows\System32\WScript.exe
PID 5420 wrote to memory of 2808 N/A C:\Windows\System32\WScript.exe C:\Recovery\WindowsRE\csrss.exe
PID 5420 wrote to memory of 2808 N/A C:\Windows\System32\WScript.exe C:\Recovery\WindowsRE\csrss.exe
PID 2808 wrote to memory of 3064 N/A C:\Recovery\WindowsRE\csrss.exe C:\Windows\System32\WScript.exe
PID 2808 wrote to memory of 3064 N/A C:\Recovery\WindowsRE\csrss.exe C:\Windows\System32\WScript.exe
PID 2808 wrote to memory of 1688 N/A C:\Recovery\WindowsRE\csrss.exe C:\Windows\System32\WScript.exe
PID 2808 wrote to memory of 1688 N/A C:\Recovery\WindowsRE\csrss.exe C:\Windows\System32\WScript.exe
PID 3064 wrote to memory of 1872 N/A C:\Windows\System32\WScript.exe C:\Recovery\WindowsRE\csrss.exe
PID 3064 wrote to memory of 1872 N/A C:\Windows\System32\WScript.exe C:\Recovery\WindowsRE\csrss.exe
PID 1872 wrote to memory of 5472 N/A C:\Recovery\WindowsRE\csrss.exe C:\Windows\System32\WScript.exe
PID 1872 wrote to memory of 5472 N/A C:\Recovery\WindowsRE\csrss.exe C:\Windows\System32\WScript.exe
PID 1872 wrote to memory of 3948 N/A C:\Recovery\WindowsRE\csrss.exe C:\Windows\System32\WScript.exe
PID 1872 wrote to memory of 3948 N/A C:\Recovery\WindowsRE\csrss.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\csrss.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe

"C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "NEAS.3d10e6755ac9695dca6850bb1ad727d0N" /sc MINUTE /mo 6 /tr "'C:\Windows\Offline Web Pages\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "NEAS.3d10e6755ac9695dca6850bb1ad727d0" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "NEAS.3d10e6755ac9695dca6850bb1ad727d0N" /sc MINUTE /mo 9 /tr "'C:\Windows\Offline Web Pages\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Windows\Help\Help\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Windows\Help\Help\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\SchCache\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\SchCache\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\SchCache\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Help\Help\explorer.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Recovery\WindowsRE\csrss.exe

"C:\Recovery\WindowsRE\csrss.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c2eaf25-0bc9-4248-9ca6-b0ee9c4936e7.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\69f20187-8c32-43f4-b854-733e243d714a.vbs"

C:\Recovery\WindowsRE\csrss.exe

C:\Recovery\WindowsRE\csrss.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05433070-5d83-45e0-abee-c89c7676a081.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a731c2be-acd1-4a38-831f-4cecdaeec0c2.vbs"

C:\Recovery\WindowsRE\csrss.exe

C:\Recovery\WindowsRE\csrss.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64f974b8-5488-49d1-9862-3176978aeb7c.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0f96041-cc76-4e26-8870-e6a2b4b9afc8.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
UA 77.123.31.10:8080 tcp
US 8.8.8.8:53 192.240.110.104.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
UA 77.123.31.10:8080 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
UA 77.123.31.10:8080 tcp
UA 77.123.31.10:8080 tcp
US 8.8.8.8:53 91.65.42.20.in-addr.arpa udp
UA 77.123.31.10:8080 tcp

Files

memory/2036-0-0x0000000000E20000-0x0000000000F8C000-memory.dmp

memory/2036-2-0x000000001BEC0000-0x000000001BED0000-memory.dmp

memory/2036-1-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

memory/2036-3-0x0000000001850000-0x000000000185E000-memory.dmp

memory/2036-5-0x0000000001910000-0x000000000192C000-memory.dmp

memory/2036-4-0x0000000001900000-0x0000000001908000-memory.dmp

memory/2036-8-0x00000000031F0000-0x0000000003200000-memory.dmp

memory/2036-10-0x0000000003220000-0x0000000003230000-memory.dmp

memory/2036-11-0x0000000003230000-0x000000000323A000-memory.dmp

memory/2036-9-0x0000000003200000-0x0000000003216000-memory.dmp

memory/2036-12-0x00000000018C0000-0x00000000018CC000-memory.dmp

memory/2036-15-0x00000000018F0000-0x00000000018FC000-memory.dmp

memory/2036-16-0x0000000003240000-0x0000000003248000-memory.dmp

memory/2036-18-0x000000001BEC0000-0x000000001BED0000-memory.dmp

memory/2036-22-0x000000001BE00000-0x000000001BE0E000-memory.dmp

memory/2036-21-0x000000001BDF0000-0x000000001BDF8000-memory.dmp

memory/2036-23-0x000000001BE10000-0x000000001BE1C000-memory.dmp

memory/2036-25-0x000000001BE30000-0x000000001BE3A000-memory.dmp

memory/2036-26-0x000000001BE40000-0x000000001BE4C000-memory.dmp

memory/2036-24-0x000000001BE20000-0x000000001BE28000-memory.dmp

memory/2036-20-0x000000001BEC0000-0x000000001BED0000-memory.dmp

memory/2036-19-0x000000001BCD0000-0x000000001BCDE000-memory.dmp

memory/2036-29-0x000000001BEC0000-0x000000001BED0000-memory.dmp

memory/2036-17-0x000000001BCC0000-0x000000001BCCA000-memory.dmp

memory/2036-14-0x00000000018E0000-0x00000000018E8000-memory.dmp

memory/2036-13-0x00000000018D0000-0x00000000018DC000-memory.dmp

memory/2036-7-0x00000000031E0000-0x00000000031E8000-memory.dmp

memory/2036-6-0x000000001BC30000-0x000000001BC80000-memory.dmp

memory/2036-32-0x000000001BEC0000-0x000000001BED0000-memory.dmp

C:\Recovery\WindowsRE\StartMenuExperienceHost.exe

MD5 3d10e6755ac9695dca6850bb1ad727d0
SHA1 b42d5db6a985f610548776ea62316c94940b183d
SHA256 978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165
SHA512 f9c81db74335f953a1780d8eb1522908b709557093ca6d7aa8e8746d401a8ff8f847a13b6c5eca7f728d55f4f005b136bce835ff5877a39bcf0249ccd8b6c538

C:\Users\Public\Pictures\RuntimeBroker.exe

MD5 a60f46fdd0f9b48ccd75fbd6c72ee702
SHA1 829a537487418e2e9f2475fc4b7146205ed5d1c5
SHA256 c91b3f56b731d67b626209d8f55bdad37c1b4cc0caa178b4aca794dc1b3b1bb3
SHA512 b78fd5053e8e599f4ba17df6b6bb24b2975690e0989d392ead5c20cdd66cfc0ce14aef8409395e8a26c51b1c07ba59155df255ae43c37154f55c773661201de8

memory/2036-106-0x000000001CBB0000-0x000000001CCB0000-memory.dmp

memory/2036-131-0x000000001CBB0000-0x000000001CCB0000-memory.dmp

memory/2036-132-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

memory/3612-134-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

memory/3612-136-0x000002611EF00000-0x000002611EF10000-memory.dmp

memory/1788-137-0x00000228E7D80000-0x00000228E7D90000-memory.dmp

memory/1788-138-0x00000228E7D80000-0x00000228E7D90000-memory.dmp

memory/3612-135-0x000002611EF00000-0x000002611EF10000-memory.dmp

memory/3784-148-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

memory/3784-150-0x000001A8F2090000-0x000001A8F20A0000-memory.dmp

memory/3784-151-0x000001A8F2090000-0x000001A8F20A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ejusapk.opm.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1548-152-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

memory/1548-154-0x0000020C708D0000-0x0000020C708E0000-memory.dmp

memory/1548-153-0x0000020C708D0000-0x0000020C708E0000-memory.dmp

memory/3776-155-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

memory/1664-157-0x000001A74E650000-0x000001A74E660000-memory.dmp

memory/1664-156-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

memory/1664-159-0x000001A74E650000-0x000001A74E660000-memory.dmp

memory/3524-158-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

memory/4480-160-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

memory/4276-162-0x0000026F9C860000-0x0000026F9C870000-memory.dmp

memory/4480-161-0x0000017DC4E90000-0x0000017DC4EA0000-memory.dmp

memory/4348-163-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

memory/2036-164-0x000000001BEC0000-0x000000001BED0000-memory.dmp

memory/1788-165-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

memory/2284-166-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

memory/1872-172-0x0000026EBD870000-0x0000026EBD892000-memory.dmp

memory/1872-309-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

memory/4276-314-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

memory/2036-316-0x000000001BEC0000-0x000000001BED0000-memory.dmp

memory/1788-317-0x00000228E7D80000-0x00000228E7D90000-memory.dmp

memory/1664-318-0x000001A74E650000-0x000001A74E660000-memory.dmp

memory/4348-319-0x0000015BEF120000-0x0000015BEF130000-memory.dmp

memory/2036-320-0x000000001BEC0000-0x000000001BED0000-memory.dmp

memory/2036-315-0x000000001BEC0000-0x000000001BED0000-memory.dmp

C:\Recovery\WindowsRE\csrss.exe

MD5 3d10e6755ac9695dca6850bb1ad727d0
SHA1 b42d5db6a985f610548776ea62316c94940b183d
SHA256 978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165
SHA512 f9c81db74335f953a1780d8eb1522908b709557093ca6d7aa8e8746d401a8ff8f847a13b6c5eca7f728d55f4f005b136bce835ff5877a39bcf0249ccd8b6c538

C:\Recovery\WindowsRE\csrss.exe

MD5 3d10e6755ac9695dca6850bb1ad727d0
SHA1 b42d5db6a985f610548776ea62316c94940b183d
SHA256 978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165
SHA512 f9c81db74335f953a1780d8eb1522908b709557093ca6d7aa8e8746d401a8ff8f847a13b6c5eca7f728d55f4f005b136bce835ff5877a39bcf0249ccd8b6c538

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e448fe0d240184c6597a31d3be2ced58
SHA1 372b8d8c19246d3e38cd3ba123cc0f56070f03cd
SHA256 c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391
SHA512 0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e448fe0d240184c6597a31d3be2ced58
SHA1 372b8d8c19246d3e38cd3ba123cc0f56070f03cd
SHA256 c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391
SHA512 0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3a6bad9528f8e23fb5c77fbd81fa28e8
SHA1 f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512 846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3a6bad9528f8e23fb5c77fbd81fa28e8
SHA1 f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512 846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3a6bad9528f8e23fb5c77fbd81fa28e8
SHA1 f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512 846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a8e8360d573a4ff072dcc6f09d992c88
SHA1 3446774433ceaf0b400073914facab11b98b6807
SHA256 bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
SHA512 4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a8e8360d573a4ff072dcc6f09d992c88
SHA1 3446774433ceaf0b400073914facab11b98b6807
SHA256 bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
SHA512 4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

C:\Users\Admin\AppData\Local\Temp\0c2eaf25-0bc9-4248-9ca6-b0ee9c4936e7.vbs

MD5 418413f400d679125f09990b4909c55d
SHA1 aab28d834aaf9fd0bd2f00335f18304f1108ff69
SHA256 d3ff178ffd07d5ba8e8db60f6f7fe0b4126531649ea6dd0955f2461cef7d8555
SHA512 492f7ba13aa14dbe61be5135e7e7c486df4bf735158c81a99b60e2c806d992c5ec807ffd8f2dc0e3f238b5cdae6ff110101c1c29def1e89f59458d1e6abe9118

C:\Users\Admin\AppData\Local\Temp\69f20187-8c32-43f4-b854-733e243d714a.vbs

MD5 6ac6a025aafc0f846408e903f236b24c
SHA1 f10d686107400cf695c33cc38e0c0a4116251211
SHA256 1e5e20638bcf089dadc293e3982f7151bc67d4f63cfeab5edc7ed248fd354e46
SHA512 741dc7e8c6061332f230e6ba73b2f4250d78c5e10c71217efd419b27ad18a097bd662d67834acebf845759a1f38923a8a03f291b263a1af49b03086fd4a8e838

C:\Recovery\WindowsRE\csrss.exe

MD5 3d10e6755ac9695dca6850bb1ad727d0
SHA1 b42d5db6a985f610548776ea62316c94940b183d
SHA256 978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165
SHA512 f9c81db74335f953a1780d8eb1522908b709557093ca6d7aa8e8746d401a8ff8f847a13b6c5eca7f728d55f4f005b136bce835ff5877a39bcf0249ccd8b6c538

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

MD5 9b0256da3bf9a5303141361b3da59823
SHA1 d73f34951777136c444eb2c98394f62912ebcdac
SHA256 96cbc3f4e49d7ae13cd46e36ebb4819b6db1eabe5db910902638c1a24947208e
SHA512 9f014fef4b1bb71dbdd1d0bad11bd20437a9801eaa830ab386f901f6b5be374a26f68161d7638ea03483028e9a56bf97023cc24b45356a9c76cb755a53d9c164

C:\Users\Admin\AppData\Local\Temp\838c2240ceaf51f4e1ea10f1e48c3a2d1612e317.exe

MD5 3d10e6755ac9695dca6850bb1ad727d0
SHA1 b42d5db6a985f610548776ea62316c94940b183d
SHA256 978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165
SHA512 f9c81db74335f953a1780d8eb1522908b709557093ca6d7aa8e8746d401a8ff8f847a13b6c5eca7f728d55f4f005b136bce835ff5877a39bcf0249ccd8b6c538

C:\Users\Admin\AppData\Local\Temp\a731c2be-acd1-4a38-831f-4cecdaeec0c2.vbs

MD5 6ac6a025aafc0f846408e903f236b24c
SHA1 f10d686107400cf695c33cc38e0c0a4116251211
SHA256 1e5e20638bcf089dadc293e3982f7151bc67d4f63cfeab5edc7ed248fd354e46
SHA512 741dc7e8c6061332f230e6ba73b2f4250d78c5e10c71217efd419b27ad18a097bd662d67834acebf845759a1f38923a8a03f291b263a1af49b03086fd4a8e838

C:\Users\Admin\AppData\Local\Temp\05433070-5d83-45e0-abee-c89c7676a081.vbs

MD5 b650bcf3e17f7b3f3c7f6b9ad6fe7936
SHA1 56bc3388afb081b99b1c33137f15bcaf1accc753
SHA256 829aa0268be15ab62e700a2938a172bcde24a8db6247d0d94bb750bcce5945bf
SHA512 eee9de7dbb746e540522740aad0b6a3534638de78783d4f0b7cb0a76d641f1e852695b6c095c42696c35be1294cb5853805778a747d507cce0ae8b8862050b4c

C:\Users\Admin\AppData\Local\Temp\a731c2be-acd1-4a38-831f-4cecdaeec0c2.vbs

MD5 6ac6a025aafc0f846408e903f236b24c
SHA1 f10d686107400cf695c33cc38e0c0a4116251211
SHA256 1e5e20638bcf089dadc293e3982f7151bc67d4f63cfeab5edc7ed248fd354e46
SHA512 741dc7e8c6061332f230e6ba73b2f4250d78c5e10c71217efd419b27ad18a097bd662d67834acebf845759a1f38923a8a03f291b263a1af49b03086fd4a8e838

C:\Recovery\WindowsRE\csrss.exe

MD5 3d10e6755ac9695dca6850bb1ad727d0
SHA1 b42d5db6a985f610548776ea62316c94940b183d
SHA256 978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165
SHA512 f9c81db74335f953a1780d8eb1522908b709557093ca6d7aa8e8746d401a8ff8f847a13b6c5eca7f728d55f4f005b136bce835ff5877a39bcf0249ccd8b6c538

C:\Users\Admin\AppData\Local\Temp\838c2240ceaf51f4e1ea10f1e48c3a2d1612e317.exe

MD5 3d10e6755ac9695dca6850bb1ad727d0
SHA1 b42d5db6a985f610548776ea62316c94940b183d
SHA256 978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165
SHA512 f9c81db74335f953a1780d8eb1522908b709557093ca6d7aa8e8746d401a8ff8f847a13b6c5eca7f728d55f4f005b136bce835ff5877a39bcf0249ccd8b6c538

C:\Users\Admin\AppData\Local\Temp\64f974b8-5488-49d1-9862-3176978aeb7c.vbs

MD5 0ed393d2139c0010ec82eb9fdb64e304
SHA1 19da0e326427b08091d60aa8432b2ebe9c480dff
SHA256 8216defbf93426eb3cbaf2da47a0915f9cd7364e9723b61871db71da200f34be
SHA512 0ec86f4d23df4d512597c4f9bfe2f3896088cf6fa86d17d52a73acfe60477192a3ab7dfbdfc7f05f6767a11fc19c9acb9dc6c99e4de430d82cb1aeba23241dd2

C:\Users\Admin\AppData\Local\Temp\c0f96041-cc76-4e26-8870-e6a2b4b9afc8.vbs

MD5 6ac6a025aafc0f846408e903f236b24c
SHA1 f10d686107400cf695c33cc38e0c0a4116251211
SHA256 1e5e20638bcf089dadc293e3982f7151bc67d4f63cfeab5edc7ed248fd354e46
SHA512 741dc7e8c6061332f230e6ba73b2f4250d78c5e10c71217efd419b27ad18a097bd662d67834acebf845759a1f38923a8a03f291b263a1af49b03086fd4a8e838

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-18 01:46

Reported

2023-11-18 01:49

Platform

win7-20231020-en

Max time kernel

151s

Max time network

174s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
N/A N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
N/A N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
N/A N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
N/A N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
N/A N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
N/A N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
N/A N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
N/A N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
N/A N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
N/A N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
N/A N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
N/A N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
N/A N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
N/A N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2512 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe
PID 2512 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe
PID 2512 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe
PID 2812 wrote to memory of 3068 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe
PID 2812 wrote to memory of 3068 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe
PID 2812 wrote to memory of 3068 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe
PID 2812 wrote to memory of 2164 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe
PID 2812 wrote to memory of 2164 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe
PID 2812 wrote to memory of 2164 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe
PID 3068 wrote to memory of 2344 N/A C:\Windows\System32\WScript.exe C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe
PID 3068 wrote to memory of 2344 N/A C:\Windows\System32\WScript.exe C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe
PID 3068 wrote to memory of 2344 N/A C:\Windows\System32\WScript.exe C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe
PID 2344 wrote to memory of 2792 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe
PID 2344 wrote to memory of 2792 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe
PID 2344 wrote to memory of 2792 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe
PID 2344 wrote to memory of 1100 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe
PID 2344 wrote to memory of 1100 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe
PID 2344 wrote to memory of 1100 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe
PID 2792 wrote to memory of 1712 N/A C:\Windows\System32\WScript.exe C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe
PID 2792 wrote to memory of 1712 N/A C:\Windows\System32\WScript.exe C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe
PID 2792 wrote to memory of 1712 N/A C:\Windows\System32\WScript.exe C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe
PID 1712 wrote to memory of 344 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe
PID 1712 wrote to memory of 344 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe
PID 1712 wrote to memory of 344 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe
PID 1712 wrote to memory of 2000 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe
PID 1712 wrote to memory of 2000 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe
PID 1712 wrote to memory of 2000 N/A C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe

"C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Pictures\Sample Pictures\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\Sample Pictures\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe

"C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2f903ddf-34cc-4d12-a827-2847f7ef9a2e.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\69466eb1-95a6-4a68-813d-dbb7b08b410c.vbs"

C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe

C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d3a14cf4-a342-4850-b71a-44f925ae1b2b.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\07093549-197a-4b58-a4d1-93efef89a493.vbs"

C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe

C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4d10282b-13c8-4b6b-8d6f-5ad838a593cc.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6fc1a8ea-80a4-44c3-9ec1-24250d685233.vbs"

Network

Country Destination Domain Proto
UA 77.123.31.10:8080 tcp
UA 77.123.31.10:8080 tcp
UA 77.123.31.10:8080 tcp
UA 77.123.31.10:8080 tcp
UA 77.123.31.10:8080 tcp

Files

memory/2512-0-0x0000000000E90000-0x0000000000FFC000-memory.dmp

memory/2512-1-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

memory/2512-2-0x000000001A9C0000-0x000000001AA40000-memory.dmp

memory/2512-3-0x00000000003C0000-0x00000000003CE000-memory.dmp

memory/2512-4-0x00000000003D0000-0x00000000003D8000-memory.dmp

memory/2512-5-0x00000000003E0000-0x00000000003FC000-memory.dmp

memory/2512-6-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2512-7-0x0000000000410000-0x0000000000420000-memory.dmp

memory/2512-8-0x0000000000640000-0x0000000000656000-memory.dmp

memory/2512-9-0x0000000000420000-0x0000000000430000-memory.dmp

memory/2512-10-0x00000000005B0000-0x00000000005BA000-memory.dmp

memory/2512-11-0x0000000000770000-0x000000000077C000-memory.dmp

memory/2512-12-0x0000000000780000-0x000000000078C000-memory.dmp

memory/2512-13-0x0000000000790000-0x0000000000798000-memory.dmp

memory/2512-14-0x00000000007A0000-0x00000000007AC000-memory.dmp

memory/2512-15-0x00000000007B0000-0x00000000007B8000-memory.dmp

memory/2512-16-0x0000000000B60000-0x0000000000B6A000-memory.dmp

memory/2512-17-0x0000000000B70000-0x0000000000B7E000-memory.dmp

memory/2512-19-0x0000000000B90000-0x0000000000B9E000-memory.dmp

memory/2512-18-0x0000000000B80000-0x0000000000B88000-memory.dmp

memory/2512-20-0x000000001A9C0000-0x000000001AA40000-memory.dmp

memory/2512-21-0x0000000000BA0000-0x0000000000BAC000-memory.dmp

memory/2512-22-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

memory/2512-23-0x0000000000BC0000-0x0000000000BCA000-memory.dmp

memory/2512-24-0x0000000000D60000-0x0000000000D6C000-memory.dmp

memory/2512-33-0x000000001A9C0000-0x000000001AA40000-memory.dmp

C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe

MD5 3d10e6755ac9695dca6850bb1ad727d0
SHA1 b42d5db6a985f610548776ea62316c94940b183d
SHA256 978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165
SHA512 f9c81db74335f953a1780d8eb1522908b709557093ca6d7aa8e8746d401a8ff8f847a13b6c5eca7f728d55f4f005b136bce835ff5877a39bcf0249ccd8b6c538

memory/2512-36-0x000000001A9C0000-0x000000001AA40000-memory.dmp

memory/2512-38-0x000000001A9C0000-0x000000001AA40000-memory.dmp

memory/2512-39-0x000000001A9C0000-0x000000001AA40000-memory.dmp

C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe

MD5 8cf5d53a6b4cba960d5caee895028a8e
SHA1 edac8b842ac28160e1e536c50de948b7a86c56f4
SHA256 9bb8a08885c093b3eafc349f341b3d5b4a934e0cd88f6b266993d1d5e91adc9d
SHA512 70cdc1963b033c4556f0c6bad5086cd2d53f57b69774bc829947e6e7901ae5ebdf55e6bb40113b156484f16e114e5427e8bbc71623a0f96236cdc1d4814da46f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 7f3866f4d73226336c9a8b7d69c27780
SHA1 c57ca183a042d951e24f1635dbd75fe0f5bcb8e0
SHA256 291c7a4da24f82d331f1099b695ee5ad6cdc2cbbaf059113a6c7eced5f244677
SHA512 f44fe86418cee92a2a9d721e3eb7100a9deedf55ee7990771534be469043796ff727886d9695f5ae777358b407fc47390402c697e889b453728896682b378a99

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 7f3866f4d73226336c9a8b7d69c27780
SHA1 c57ca183a042d951e24f1635dbd75fe0f5bcb8e0
SHA256 291c7a4da24f82d331f1099b695ee5ad6cdc2cbbaf059113a6c7eced5f244677
SHA512 f44fe86418cee92a2a9d721e3eb7100a9deedf55ee7990771534be469043796ff727886d9695f5ae777358b407fc47390402c697e889b453728896682b378a99

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 7f3866f4d73226336c9a8b7d69c27780
SHA1 c57ca183a042d951e24f1635dbd75fe0f5bcb8e0
SHA256 291c7a4da24f82d331f1099b695ee5ad6cdc2cbbaf059113a6c7eced5f244677
SHA512 f44fe86418cee92a2a9d721e3eb7100a9deedf55ee7990771534be469043796ff727886d9695f5ae777358b407fc47390402c697e889b453728896682b378a99

memory/1656-140-0x0000000002370000-0x0000000002378000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 7f3866f4d73226336c9a8b7d69c27780
SHA1 c57ca183a042d951e24f1635dbd75fe0f5bcb8e0
SHA256 291c7a4da24f82d331f1099b695ee5ad6cdc2cbbaf059113a6c7eced5f244677
SHA512 f44fe86418cee92a2a9d721e3eb7100a9deedf55ee7990771534be469043796ff727886d9695f5ae777358b407fc47390402c697e889b453728896682b378a99

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 7f3866f4d73226336c9a8b7d69c27780
SHA1 c57ca183a042d951e24f1635dbd75fe0f5bcb8e0
SHA256 291c7a4da24f82d331f1099b695ee5ad6cdc2cbbaf059113a6c7eced5f244677
SHA512 f44fe86418cee92a2a9d721e3eb7100a9deedf55ee7990771534be469043796ff727886d9695f5ae777358b407fc47390402c697e889b453728896682b378a99

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 7f3866f4d73226336c9a8b7d69c27780
SHA1 c57ca183a042d951e24f1635dbd75fe0f5bcb8e0
SHA256 291c7a4da24f82d331f1099b695ee5ad6cdc2cbbaf059113a6c7eced5f244677
SHA512 f44fe86418cee92a2a9d721e3eb7100a9deedf55ee7990771534be469043796ff727886d9695f5ae777358b407fc47390402c697e889b453728896682b378a99

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 7f3866f4d73226336c9a8b7d69c27780
SHA1 c57ca183a042d951e24f1635dbd75fe0f5bcb8e0
SHA256 291c7a4da24f82d331f1099b695ee5ad6cdc2cbbaf059113a6c7eced5f244677
SHA512 f44fe86418cee92a2a9d721e3eb7100a9deedf55ee7990771534be469043796ff727886d9695f5ae777358b407fc47390402c697e889b453728896682b378a99

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 7f3866f4d73226336c9a8b7d69c27780
SHA1 c57ca183a042d951e24f1635dbd75fe0f5bcb8e0
SHA256 291c7a4da24f82d331f1099b695ee5ad6cdc2cbbaf059113a6c7eced5f244677
SHA512 f44fe86418cee92a2a9d721e3eb7100a9deedf55ee7990771534be469043796ff727886d9695f5ae777358b407fc47390402c697e889b453728896682b378a99

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 7f3866f4d73226336c9a8b7d69c27780
SHA1 c57ca183a042d951e24f1635dbd75fe0f5bcb8e0
SHA256 291c7a4da24f82d331f1099b695ee5ad6cdc2cbbaf059113a6c7eced5f244677
SHA512 f44fe86418cee92a2a9d721e3eb7100a9deedf55ee7990771534be469043796ff727886d9695f5ae777358b407fc47390402c697e889b453728896682b378a99

memory/2068-129-0x000000001B210000-0x000000001B4F2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 7f3866f4d73226336c9a8b7d69c27780
SHA1 c57ca183a042d951e24f1635dbd75fe0f5bcb8e0
SHA256 291c7a4da24f82d331f1099b695ee5ad6cdc2cbbaf059113a6c7eced5f244677
SHA512 f44fe86418cee92a2a9d721e3eb7100a9deedf55ee7990771534be469043796ff727886d9695f5ae777358b407fc47390402c697e889b453728896682b378a99

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FCDL5PI9MXK2XAU071R0.temp

MD5 7f3866f4d73226336c9a8b7d69c27780
SHA1 c57ca183a042d951e24f1635dbd75fe0f5bcb8e0
SHA256 291c7a4da24f82d331f1099b695ee5ad6cdc2cbbaf059113a6c7eced5f244677
SHA512 f44fe86418cee92a2a9d721e3eb7100a9deedf55ee7990771534be469043796ff727886d9695f5ae777358b407fc47390402c697e889b453728896682b378a99

C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe

MD5 8cf5d53a6b4cba960d5caee895028a8e
SHA1 edac8b842ac28160e1e536c50de948b7a86c56f4
SHA256 9bb8a08885c093b3eafc349f341b3d5b4a934e0cd88f6b266993d1d5e91adc9d
SHA512 70cdc1963b033c4556f0c6bad5086cd2d53f57b69774bc829947e6e7901ae5ebdf55e6bb40113b156484f16e114e5427e8bbc71623a0f96236cdc1d4814da46f

memory/2068-170-0x0000000002420000-0x00000000024A0000-memory.dmp

memory/2068-168-0x000007FEEDC40000-0x000007FEEE5DD000-memory.dmp

memory/2068-172-0x0000000002420000-0x00000000024A0000-memory.dmp

memory/2068-171-0x000007FEEDC40000-0x000007FEEE5DD000-memory.dmp

memory/2512-173-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

memory/1720-174-0x000007FEEDC40000-0x000007FEEE5DD000-memory.dmp

memory/1720-175-0x0000000002900000-0x0000000002980000-memory.dmp

memory/1720-176-0x0000000002900000-0x0000000002980000-memory.dmp

memory/2812-179-0x0000000000F00000-0x000000000106C000-memory.dmp

memory/2940-180-0x0000000002200000-0x0000000002280000-memory.dmp

memory/2940-178-0x000007FEEDC40000-0x000007FEEE5DD000-memory.dmp

C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe

MD5 8cf5d53a6b4cba960d5caee895028a8e
SHA1 edac8b842ac28160e1e536c50de948b7a86c56f4
SHA256 9bb8a08885c093b3eafc349f341b3d5b4a934e0cd88f6b266993d1d5e91adc9d
SHA512 70cdc1963b033c4556f0c6bad5086cd2d53f57b69774bc829947e6e7901ae5ebdf55e6bb40113b156484f16e114e5427e8bbc71623a0f96236cdc1d4814da46f

memory/2940-181-0x000007FEEDC40000-0x000007FEEE5DD000-memory.dmp

memory/2940-182-0x0000000002200000-0x0000000002280000-memory.dmp

memory/2128-183-0x0000000002470000-0x00000000024F0000-memory.dmp

memory/2128-184-0x000007FEEDC40000-0x000007FEEE5DD000-memory.dmp

memory/2104-185-0x000007FEEDC40000-0x000007FEEE5DD000-memory.dmp

memory/2104-186-0x00000000028E0000-0x0000000002960000-memory.dmp

memory/2104-187-0x000007FEEDC40000-0x000007FEEE5DD000-memory.dmp

memory/2104-188-0x00000000028E0000-0x0000000002960000-memory.dmp

memory/2128-189-0x0000000002470000-0x00000000024F0000-memory.dmp

memory/2940-190-0x0000000002200000-0x0000000002280000-memory.dmp

memory/1656-191-0x000007FEEDC40000-0x000007FEEE5DD000-memory.dmp

memory/1656-192-0x0000000002650000-0x00000000026D0000-memory.dmp

memory/1656-193-0x0000000002650000-0x00000000026D0000-memory.dmp

memory/1656-194-0x0000000002650000-0x00000000026D0000-memory.dmp

memory/3044-195-0x000007FEEDC40000-0x000007FEEE5DD000-memory.dmp

memory/3044-196-0x0000000002A90000-0x0000000002B10000-memory.dmp

memory/3044-197-0x000007FEEDC40000-0x000007FEEE5DD000-memory.dmp

memory/3044-198-0x0000000002A90000-0x0000000002B10000-memory.dmp

memory/3044-199-0x0000000002A90000-0x0000000002B10000-memory.dmp

memory/2104-200-0x00000000028E0000-0x0000000002960000-memory.dmp

memory/2128-202-0x0000000002470000-0x00000000024F0000-memory.dmp

memory/2068-201-0x0000000002420000-0x00000000024A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\69466eb1-95a6-4a68-813d-dbb7b08b410c.vbs

MD5 624b9334f77e4daea95b16ee7ea4b053
SHA1 f312086ca5a518c4981c38f782b7749a835ce7b3
SHA256 ac183c4d51ed23788f7fb63481371506c7dcb7b6790ae30be37036f341c4bfcc
SHA512 6c7d70bd5f6ac612a88b0dd8fdc30673afd318774ed0eaa10893bd0305487ae5ac68eff2b8b48e5aee6f8a6b83c05bd2e372c39a56daea1f8a633814a24a7627

C:\Users\Admin\AppData\Local\Temp\2f903ddf-34cc-4d12-a827-2847f7ef9a2e.vbs

MD5 294687663fbc7461cbb92eb48601f97c
SHA1 be18edc19cb3ddc8b8a6bf5d43047a078d94cc87
SHA256 33d37f66f8d26ede81a636c844adab47e56a4129c2696add04f87ae3957c2283
SHA512 24c6233969ed6afb7b358a5f49df85cfd9b81497b1b082a1f2454b46f1b1fcdde7e7bd906970e67e1b0c470cf2d5f4ba552d8725b48d477f226e9a88219a4cd0

C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe

MD5 8cf5d53a6b4cba960d5caee895028a8e
SHA1 edac8b842ac28160e1e536c50de948b7a86c56f4
SHA256 9bb8a08885c093b3eafc349f341b3d5b4a934e0cd88f6b266993d1d5e91adc9d
SHA512 70cdc1963b033c4556f0c6bad5086cd2d53f57b69774bc829947e6e7901ae5ebdf55e6bb40113b156484f16e114e5427e8bbc71623a0f96236cdc1d4814da46f

C:\Users\Admin\AppData\Local\Temp\956915e603a7b94bec2b7d42c43de6fd24f14c4f.exe

MD5 8cf5d53a6b4cba960d5caee895028a8e
SHA1 edac8b842ac28160e1e536c50de948b7a86c56f4
SHA256 9bb8a08885c093b3eafc349f341b3d5b4a934e0cd88f6b266993d1d5e91adc9d
SHA512 70cdc1963b033c4556f0c6bad5086cd2d53f57b69774bc829947e6e7901ae5ebdf55e6bb40113b156484f16e114e5427e8bbc71623a0f96236cdc1d4814da46f

C:\Users\Admin\AppData\Local\Temp\07093549-197a-4b58-a4d1-93efef89a493.vbs

MD5 624b9334f77e4daea95b16ee7ea4b053
SHA1 f312086ca5a518c4981c38f782b7749a835ce7b3
SHA256 ac183c4d51ed23788f7fb63481371506c7dcb7b6790ae30be37036f341c4bfcc
SHA512 6c7d70bd5f6ac612a88b0dd8fdc30673afd318774ed0eaa10893bd0305487ae5ac68eff2b8b48e5aee6f8a6b83c05bd2e372c39a56daea1f8a633814a24a7627

C:\Users\Admin\AppData\Local\Temp\d3a14cf4-a342-4850-b71a-44f925ae1b2b.vbs

MD5 f424b738c5a4b2b1df667caeb3d8d8a2
SHA1 e160e817f5809031d656bda712cb36810e0608c0
SHA256 ac1bf0770c65cfd42529d8b8d3a403b8d1bc661a5eb08b6944e4c249d7f4a16b
SHA512 fe6e1104ccc8e3483f9a41676fe7f8c02407773b67e34791c64a378de415449fa7da2a144e5efa9d1ecfe100fad740244add7b612a860b7e2505c8051bb76cab

C:\Users\Admin\AppData\Local\Temp\07093549-197a-4b58-a4d1-93efef89a493.vbs

MD5 624b9334f77e4daea95b16ee7ea4b053
SHA1 f312086ca5a518c4981c38f782b7749a835ce7b3
SHA256 ac183c4d51ed23788f7fb63481371506c7dcb7b6790ae30be37036f341c4bfcc
SHA512 6c7d70bd5f6ac612a88b0dd8fdc30673afd318774ed0eaa10893bd0305487ae5ac68eff2b8b48e5aee6f8a6b83c05bd2e372c39a56daea1f8a633814a24a7627

C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\services.exe

MD5 8cf5d53a6b4cba960d5caee895028a8e
SHA1 edac8b842ac28160e1e536c50de948b7a86c56f4
SHA256 9bb8a08885c093b3eafc349f341b3d5b4a934e0cd88f6b266993d1d5e91adc9d
SHA512 70cdc1963b033c4556f0c6bad5086cd2d53f57b69774bc829947e6e7901ae5ebdf55e6bb40113b156484f16e114e5427e8bbc71623a0f96236cdc1d4814da46f

C:\Users\Admin\AppData\Local\Temp\956915e603a7b94bec2b7d42c43de6fd24f14c4f.exe

MD5 8cf5d53a6b4cba960d5caee895028a8e
SHA1 edac8b842ac28160e1e536c50de948b7a86c56f4
SHA256 9bb8a08885c093b3eafc349f341b3d5b4a934e0cd88f6b266993d1d5e91adc9d
SHA512 70cdc1963b033c4556f0c6bad5086cd2d53f57b69774bc829947e6e7901ae5ebdf55e6bb40113b156484f16e114e5427e8bbc71623a0f96236cdc1d4814da46f

C:\Users\Admin\AppData\Local\Temp\4d10282b-13c8-4b6b-8d6f-5ad838a593cc.vbs

MD5 3ed51a13f79d03086f50f28ee87ced5c
SHA1 533de0b183947a6f7c8b4b2df9a9c628ed136894
SHA256 c8d8212c102524e0f743ae9ee1ae8656f8df13d481d0aa65a19cd0ca8278366f
SHA512 9bf8e335dae1f5b5fb6bafe5198ba1dc2d0af7d76dd9c5fd439a9270a26d0efe7593afa147ccaddbafa021c1b0b57f9cef9df2e88353ca122c217dbd32eabc82

C:\Users\Admin\AppData\Local\Temp\6fc1a8ea-80a4-44c3-9ec1-24250d685233.vbs

MD5 624b9334f77e4daea95b16ee7ea4b053
SHA1 f312086ca5a518c4981c38f782b7749a835ce7b3
SHA256 ac183c4d51ed23788f7fb63481371506c7dcb7b6790ae30be37036f341c4bfcc
SHA512 6c7d70bd5f6ac612a88b0dd8fdc30673afd318774ed0eaa10893bd0305487ae5ac68eff2b8b48e5aee6f8a6b83c05bd2e372c39a56daea1f8a633814a24a7627