dcrat | fdaa21ae214d6212d81b966051fa320b9b6cea4181f8e8b64776f4bface87e4f

Analysis

max time kernel
145s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
16/12/2023, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4b6ae4a5718a076483089c71f90aaf9.exe
Size 1.5MB
Sample231216-c6e7hsbef4
SHA256 fdaa21ae214d6212d81b966051fa320b9b6cea4181f8e8b64776f4bface87e4f
MD5 a4b6ae4a5718a076483089c71f90aaf9
SHA1 68605bcaed4de8a26b2c45d4124b9db098cdc0cf
SHA512 219e7365a9c36c019a5d2345e483bb03bde686b0c13b501391ff44ca3bf361eacf21b15f20193db75917c27886eed750f7c52cd10c432ef4c94bf571ad986817
SSDEEP 24576:KZ8oMOMwiZhlVTfkG+3DFk83Hsv17ZEQmNHpFWjOCMGDahtjVV:KZ8oezAprsv1ZROCMGDah5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 63 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

pid	Process
2868	schtasks.exe
860	schtasks.exe
2340	schtasks.exe
1104	schtasks.exe
3068	schtasks.exe
1828	schtasks.exe
1588	schtasks.exe
1592	schtasks.exe
340	schtasks.exe
1260	schtasks.exe
1376	schtasks.exe
1608	schtasks.exe
2024	schtasks.exe
2700	schtasks.exe
932	schtasks.exe
588	schtasks.exe
1516	schtasks.exe
1996	schtasks.exe
2396	schtasks.exe
1488	schtasks.exe
620	schtasks.exe
1724	schtasks.exe
1908	schtasks.exe
1628	schtasks.exe
1816	schtasks.exe
2924	schtasks.exe
1240	schtasks.exe
1672	schtasks.exe
1544	schtasks.exe
2956	schtasks.exe
2544	schtasks.exe
2908	schtasks.exe
1580	schtasks.exe
920	schtasks.exe
2688	schtasks.exe
2612	schtasks.exe
2224	schtasks.exe
2240	schtasks.exe
2232	schtasks.exe
2620	schtasks.exe
2496	schtasks.exe
2860	schtasks.exe
3044	schtasks.exe
1984	schtasks.exe
2512	schtasks.exe
2896	schtasks.exe
1396	schtasks.exe
1952	schtasks.exe
2996	schtasks.exe
3056	schtasks.exe
2016	schtasks.exe
2524	schtasks.exe
2584	schtasks.exe
2852	schtasks.exe
2396	schtasks.exe
2088	schtasks.exe
2092	schtasks.exe
1752	schtasks.exe
344	schtasks.exe
2268	schtasks.exe
828	schtasks.exe
1144	schtasks.exe
2408	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 21 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Process spawned unexpected child process 63 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	340	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	932	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	344	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2764	schtasks.exe	28

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2140-0-0x0000000000ED0000-0x0000000001056000-memory.dmp	dcrat
behavioral1/files/0x00060000000170b7-26.dat	dcrat
behavioral1/files/0x00050000000195af-66.dat	dcrat
behavioral1/files/0x00050000000195af-67.dat	dcrat
behavioral1/memory/1956-68-0x0000000000950000-0x0000000000AD6000-memory.dmp	dcrat
behavioral1/memory/1956-70-0x00000000002D0000-0x0000000000350000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
1956	schtasks.exe

Adds Run key to start application 2 TTPs 42 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\Saved Games\\csrss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\schtasks = "\"C:\\Users\\All Users\\Start Menu\\schtasks.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\smss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a4b6ae4a5718a076483089c71f90aaf9 = "\"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\a4b6ae4a5718a076483089c71f90aaf9 = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\a4b6ae4a5718a076483089c71f90aaf9.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows Mail\\it-IT\\csrss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files\\Mozilla Firefox\\lsm.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows Mail\\it-IT\\csrss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\schtasks = "\"C:\\Users\\All Users\\Start Menu\\schtasks.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Help\\Windows\\sppsvc.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\a4b6ae4a5718a076483089c71f90aaf9 = "\"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\a4b6ae4a5718a076483089c71f90aaf9.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Default\\Local Settings\\smss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\a4b6ae4a5718a076483089c71f90aaf9 = "\"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Adobe\\dllhost.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Adobe\\dllhost.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\wininit.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\schtasks = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\schtasks = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\schtasks = "\"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\schtasks.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\smss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\WmiPrvSE.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Help\\Windows\\sppsvc.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Default\\Local Settings\\smss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a4b6ae4a5718a076483089c71f90aaf9 = "\"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\a4b6ae4a5718a076483089c71f90aaf9.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files\\Mozilla Firefox\\lsm.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\wininit.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\Setup\\State\\dllhost.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a4b6ae4a5718a076483089c71f90aaf9 = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\a4b6ae4a5718a076483089c71f90aaf9.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\Saved Games\\csrss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\schtasks = "\"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\schtasks.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\WmiPrvSE.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\Fonts\\csrss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\Fonts\\csrss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\Setup\\State\\dllhost.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\schtasks.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files\Windows Mail\it-IT\886983d96e3d3e	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files (x86)\Google\Temp\101b941d020240	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files (x86)\Windows Portable Devices\6cb0b6c459d5d3	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files\Mozilla Firefox\101b941d020240	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\3a6fe29a7ceee6	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\services.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files (x86)\Google\Temp\lsm.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\c5b4cb5e9653cc	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\b92fce248f0a51	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files (x86)\Windows Portable Devices\dwm.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\a4b6ae4a5718a076483089c71f90aaf9.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files\Windows Mail\it-IT\csrss.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files (x86)\Adobe\dllhost.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files (x86)\Adobe\5940a34987c991	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files\Mozilla Firefox\lsm.exe	a4b6ae4a5718a076483089c71f90aaf9.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Help\Windows\0a1fd5f707cd16	a4b6ae4a5718a076483089c71f90aaf9.exe
File opened for modification	C:\Windows\Fonts\csrss.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Windows\Fonts\886983d96e3d3e	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Windows\Setup\State\5940a34987c991	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\smss.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Windows\Help\Windows\sppsvc.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Windows\Fonts\csrss.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Windows\Setup\State\dllhost.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-o..iles-core.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8e75eefdb0e4c7c8\smss.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\69ddcba757bf72	a4b6ae4a5718a076483089c71f90aaf9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 63 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1588	schtasks.exe
588	schtasks.exe
2016	schtasks.exe
920	schtasks.exe
1628	schtasks.exe
1396	schtasks.exe
2612	schtasks.exe
1544	schtasks.exe
2240	schtasks.exe
2524	schtasks.exe
1240	schtasks.exe
1104	schtasks.exe
2340	schtasks.exe
1828	schtasks.exe
2868	schtasks.exe
1724	schtasks.exe
1260	schtasks.exe
828	schtasks.exe
2232	schtasks.exe
620	schtasks.exe
1580	schtasks.exe
2544	schtasks.exe
344	schtasks.exe
2620	schtasks.exe
1816	schtasks.exe
1672	schtasks.exe
1376	schtasks.exe
1996	schtasks.exe
3044	schtasks.exe
2700	schtasks.exe
2092	schtasks.exe
1488	schtasks.exe
2996	schtasks.exe
2268	schtasks.exe
1592	schtasks.exe
2688	schtasks.exe
1516	schtasks.exe
2408	schtasks.exe
2088	schtasks.exe
2512	schtasks.exe
2860	schtasks.exe
932	schtasks.exe
1908	schtasks.exe
2956	schtasks.exe
340	schtasks.exe
2852	schtasks.exe
2396	schtasks.exe
1752	schtasks.exe
860	schtasks.exe
2224	schtasks.exe
1984	schtasks.exe
2584	schtasks.exe
2908	schtasks.exe
1144	schtasks.exe
3056	schtasks.exe
2496	schtasks.exe
2896	schtasks.exe
1608	schtasks.exe
1952	schtasks.exe
2396	schtasks.exe
2924	schtasks.exe
3068	schtasks.exe
2024	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2140	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
2528	a4b6ae4a5718a076483089c71f90aaf9.exe
1956	schtasks.exe
1956	schtasks.exe
1956	schtasks.exe
1956	schtasks.exe
1956	schtasks.exe
1956	schtasks.exe
1956	schtasks.exe
1956	schtasks.exe
1956	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1956	schtasks.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	a4b6ae4a5718a076483089c71f90aaf9.exe
Token: SeDebugPrivilege	2528	a4b6ae4a5718a076483089c71f90aaf9.exe
Token: SeDebugPrivilege	1956	schtasks.exe
Token: SeBackupPrivilege	1748	vssvc.exe
Token: SeRestorePrivilege	1748	vssvc.exe
Token: SeAuditPrivilege	1748	vssvc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2528	2140	a4b6ae4a5718a076483089c71f90aaf9.exe	35
PID 2140 wrote to memory of 2528	2140	a4b6ae4a5718a076483089c71f90aaf9.exe	35
PID 2140 wrote to memory of 2528	2140	a4b6ae4a5718a076483089c71f90aaf9.exe	35
PID 2528 wrote to memory of 1896	2528	a4b6ae4a5718a076483089c71f90aaf9.exe	93
PID 2528 wrote to memory of 1896	2528	a4b6ae4a5718a076483089c71f90aaf9.exe	93
PID 2528 wrote to memory of 1896	2528	a4b6ae4a5718a076483089c71f90aaf9.exe	93
PID 1896 wrote to memory of 3004	1896	cmd.exe	95
PID 1896 wrote to memory of 3004	1896	cmd.exe	95
PID 1896 wrote to memory of 3004	1896	cmd.exe	95
PID 1896 wrote to memory of 1956	1896	cmd.exe	96
PID 1896 wrote to memory of 1956	1896	cmd.exe	96
PID 1896 wrote to memory of 1956	1896	cmd.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\a4b6ae4a5718a076483089c71f90aaf9.exe
"C:\Users\Admin\AppData\Local\Temp\a4b6ae4a5718a076483089c71f90aaf9.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Users\Admin\AppData\Local\Temp\a4b6ae4a5718a076483089c71f90aaf9.exe
  "C:\Users\Admin\AppData\Local\Temp\a4b6ae4a5718a076483089c71f90aaf9.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cue1ykuj1U.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:3004
  - - C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\schtasks.exe
      "C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\schtasks.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a4b6ae4a5718a076483089c71f90aaf9a" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\a4b6ae4a5718a076483089c71f90aaf9.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a4b6ae4a5718a076483089c71f90aaf9" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\a4b6ae4a5718a076483089c71f90aaf9.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a4b6ae4a5718a076483089c71f90aaf9a" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\a4b6ae4a5718a076483089c71f90aaf9.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\Help\Windows\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Help\Windows\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\Help\Windows\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\Fonts\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Fonts\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\Fonts\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\Setup\State\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Setup\State\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\Setup\State\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\schtasks.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\schtasks.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\schtasks.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a4b6ae4a5718a076483089c71f90aaf9a" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\a4b6ae4a5718a076483089c71f90aaf9.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a4b6ae4a5718a076483089c71f90aaf9" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\a4b6ae4a5718a076483089c71f90aaf9.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a4b6ae4a5718a076483089c71f90aaf9a" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\a4b6ae4a5718a076483089c71f90aaf9.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\it-IT\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\it-IT\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\it-IT\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\Temp\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\Temp\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Local Settings\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\Local Settings\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Local Settings\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a4b6ae4a5718a076483089c71f90aaf9a" /sc MINUTE /mo 12 /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\a4b6ae4a5718a076483089c71f90aaf9.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a4b6ae4a5718a076483089c71f90aaf9" /sc ONLOGON /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\a4b6ae4a5718a076483089c71f90aaf9.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a4b6ae4a5718a076483089c71f90aaf9a" /sc MINUTE /mo 8 /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\a4b6ae4a5718a076483089c71f90aaf9.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Saved Games\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Saved Games\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Start Menu\schtasks.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\schtasks.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Start Menu\schtasks.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 5 /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\schtasks.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\schtasks.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 11 /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\schtasks.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2512

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

schtasks.exe

Path C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\schtasks.exe
Size 1.5MB
SHA256 fdaa21ae214d6212d81b966051fa320b9b6cea4181f8e8b64776f4bface87e4f
MD5 a4b6ae4a5718a076483089c71f90aaf9
SHA1 68605bcaed4de8a26b2c45d4124b9db098cdc0cf
SHA512 219e7365a9c36c019a5d2345e483bb03bde686b0c13b501391ff44ca3bf361eacf21b15f20193db75917c27886eed750f7c52cd10c432ef4c94bf571ad986817
SSDEEP 24576:KZ8oMOMwiZhlVTfkG+3DFk83Hsv17ZEQmNHpFWjOCMGDahtjVV:KZ8oezAprsv1ZROCMGDah5
MD5 SHA1 SHA512 SSDEEP

Submit Download

schtasks.exe

Path C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\schtasks.exe
Size 128KB
SHA256 f782c9b476b818a9b963d831630b33e98b0d1a7dc7b15ff5ff53acfbeaf5dabb
MD5 9935e2bbb554f5f80043f202b53442f1
SHA1 96ee177d4262f64174988a5c1acc763ca97ab838
SHA512 76a046e0023a056c083e290dab98690be11aba11039586b51fe3f3cc1335e8d1391b22ebfc663d5cfeb85b2a4fd38881c796d4f87f1fa71ba3bb812ab57a5ef8
SSDEEP 1536:7Nch4rn/iXtB34CK/NWg445LlLkXe3VTxC6rSp8/m44ioKofiWvgPh:7Nchi+r/aN/f1lo+TsU5/Nu+
MD5 SHA1 SHA512 SSDEEP

Submit Download

schtasks.exe

Path C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\schtasks.exe
Size 1.2MB
SHA256 a037ad5e4cb377c068faa22b9acb5baa74dca41ffc831e102223827fb91e5654
MD5 961343dcea94786193240cd9393e4a65
SHA1 0b6f3913d741d53c983283aaff14cb188801d9bb
SHA512 7cbdb2801264a15ab685fbc636288fcc3ee09a31250535a651a3b3123d9a1abab702152d7bb888e03bc2f6ee5701e8e5f2421f3ced52ffab43578e4e1fbec828
SSDEEP 24576:KZ8oMOMwiZhlVTfkG+3DFk83Hsv17ZEQmNHpFj:KZ8oezAprsv1Zk
MD5 SHA1 SHA512 SSDEEP

Submit Download

cue1ykuj1U.bat

Path C:\Users\Admin\AppData\Local\Temp\cue1ykuj1U.bat
Size 226B
SHA256 098790ab7898fbfc74f75111383e203c70bf376d3f624beb593a2fa979d0c2eb
MD5 217c24f5b9faec7c8a2ca06cf75f8034
SHA1 ed0f33ab32f07bf7961e143fc8a547a8c58e36d4
SHA512 2ff43e4679a630c34ba2dcd3eef668ece6222dfb36f368b493602235b8b6b4751098659b2c2e5f234d7907404e6826421c48e08f9664eeaa394a23b3ccdc8b2f
MD5 SHA1 SHA512

Submit Download

memory/1956-73-0x00000000002D0000-0x0000000000350000-memory.dmp

Download

memory/1956-72-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

Download

memory/1956-71-0x0000000000740000-0x0000000000752000-memory.dmp

Download

memory/1956-70-0x00000000002D0000-0x0000000000350000-memory.dmp

Download

memory/1956-69-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

Download

memory/1956-68-0x0000000000950000-0x0000000000AD6000-memory.dmp

Download

memory/2140-7-0x00000000004A0000-0x00000000004AC000-memory.dmp

Download

memory/2140-6-0x0000000000480000-0x0000000000496000-memory.dmp

Download

memory/2140-12-0x0000000000690000-0x000000000069A000-memory.dmp

Download

memory/2140-13-0x00000000006A0000-0x00000000006AC000-memory.dmp

Download

memory/2140-18-0x000007FEF59B0000-0x000007FEF639C000-memory.dmp

Download

memory/2140-1-0x000007FEF59B0000-0x000007FEF639C000-memory.dmp

Download

memory/2140-2-0x000000001B3B0000-0x000000001B430000-memory.dmp

Download

memory/2140-3-0x0000000000430000-0x000000000043E000-memory.dmp

Download

memory/2140-10-0x00000000004F0000-0x00000000004F8000-memory.dmp

Download

memory/2140-9-0x00000000004E0000-0x00000000004EE000-memory.dmp

Download

memory/2140-4-0x0000000000440000-0x000000000045C000-memory.dmp

Download

memory/2140-8-0x00000000004B0000-0x00000000004C2000-memory.dmp

Download

memory/2140-0-0x0000000000ED0000-0x0000000001056000-memory.dmp

Download

memory/2140-11-0x0000000000500000-0x0000000000508000-memory.dmp

Download

memory/2140-5-0x0000000000460000-0x0000000000468000-memory.dmp

Download

memory/2528-65-0x000007FEF59B0000-0x000007FEF639C000-memory.dmp

Download

memory/2528-21-0x0000000000750000-0x0000000000762000-memory.dmp

Download

memory/2528-20-0x000000001B080000-0x000000001B100000-memory.dmp

Download

memory/2528-19-0x000007FEF59B0000-0x000007FEF639C000-memory.dmp

Download

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Program Files\\Windows Mail\\it-IT\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Program Files\\Windows Mail\\it-IT\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Program Files (x86)\\Adobe\\dllhost.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Program Files\\Windows Mail\\it-IT\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Program Files (x86)\\Adobe\\dllhost.exe\", \"C:\\Users\\Default\\Local Settings\\smss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Program Files\\Windows Mail\\it-IT\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Program Files (x86)\\Adobe\\dllhost.exe\", \"C:\\Users\\Default\\Local Settings\\smss.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Users\\Default\\Saved Games\\csrss.exe\", \"C:\\Users\\All Users\\Start Menu\\schtasks.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\schtasks.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Program Files\\Windows Mail\\it-IT\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Program Files (x86)\\Adobe\\dllhost.exe\", \"C:\\Users\\Default\\Local Settings\\smss.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Users\\Default\\Saved Games\\csrss.exe\", \"C:\\Users\\All Users\\Start Menu\\schtasks.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\schtasks.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\WmiPrvSE.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Program Files\\Windows Mail\\it-IT\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Program Files (x86)\\Adobe\\dllhost.exe\", \"C:\\Users\\Default\\Local Settings\\smss.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Users\\Default\\Saved Games\\csrss.exe\", \"C:\\Users\\All Users\\Start Menu\\schtasks.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\schtasks.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\WmiPrvSE.exe\", \"C:\\Program Files\\Mozilla Firefox\\lsm.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\wininit.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Program Files\\Windows Mail\\it-IT\\csrss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Program Files\\Windows Mail\\it-IT\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Program Files (x86)\\Adobe\\dllhost.exe\", \"C:\\Users\\Default\\Local Settings\\smss.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Users\\Default\\Saved Games\\csrss.exe\", \"C:\\Users\\All Users\\Start Menu\\schtasks.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\schtasks.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Program Files\\Windows Mail\\it-IT\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Program Files (x86)\\Adobe\\dllhost.exe\", \"C:\\Users\\Default\\Local Settings\\smss.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Users\\Default\\Saved Games\\csrss.exe\", \"C:\\Users\\All Users\\Start Menu\\schtasks.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\schtasks.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\WmiPrvSE.exe\", \"C:\\Program Files\\Mozilla Firefox\\lsm.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Program Files\\Windows Mail\\it-IT\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Program Files\\Windows Mail\\it-IT\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Program Files (x86)\\Adobe\\dllhost.exe\", \"C:\\Users\\Default\\Local Settings\\smss.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\a4b6ae4a5718a076483089c71f90aaf9.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Program Files\\Windows Mail\\it-IT\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Program Files (x86)\\Adobe\\dllhost.exe\", \"C:\\Users\\Default\\Local Settings\\smss.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Users\\Default\\Saved Games\\csrss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Program Files\\Windows Mail\\it-IT\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Program Files (x86)\\Adobe\\dllhost.exe\", \"C:\\Users\\Default\\Local Settings\\smss.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Users\\Default\\Saved Games\\csrss.exe\", \"C:\\Users\\All Users\\Start Menu\\schtasks.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\schtasks.exe\", \"C:\\Windows\\Installer\\{90140000-006E-0409-0000-0000000FF1CE}\\smss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Program Files\\Windows Mail\\it-IT\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Program Files (x86)\\Adobe\\dllhost.exe\", \"C:\\Users\\Default\\Local Settings\\smss.exe\", \"C:\\Recovery\\7156ad82-9b8d-11ee-a45c-bce704e297ea\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Users\\Default\\Saved Games\\csrss.exe\", \"C:\\Users\\All Users\\Start Menu\\schtasks.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\a4b6ae4a5718a076483089c71f90aaf9.exe\", \"C:\\Windows\\Help\\Windows\\sppsvc.exe\", \"C:\\Windows\\Fonts\\csrss.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\schtasks.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\a4b6ae4a5718a076483089c71f90aaf9.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe