dcrat | 7849b02c1912451ca4703361443e161953750e9783ee237985db9cafaff76c04

Windows Service

T1543.003

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	d6b8c1db03cd0f282e1718daf0dc35cf.exe

Process spawned unexpected child process 7 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	3852	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3124	3852	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	3852	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	3852	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	3852	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	3852	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	3852	schtasks.exe	100

Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Windows security bypass 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Recovery\WindowsRE\csrss.exe = "0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf.exe = "0"	d6b8c1db03cd0f282e1718daf0dc35cf.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4884-25-0x0000000000400000-0x00000000004AC000-memory.dmp	dcrat

Nirsoft 1 IoCs

resource	yara_rule
behavioral2/files/0x00090000000231e8-15.dat	Nirsoft

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	AdvancedRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	csrss.exe

Executes dropped EXE 5 IoCs

pid	Process
4876	AdvancedRun.exe
3448	AdvancedRun.exe
1664	csrss.exe
376	AdvancedRun.exe
768	csrss.exe

Windows security modification 2 TTPs 11 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf.exe = "0"	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Recovery\WindowsRE\csrss.exe = "0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	d6b8c1db03cd0f282e1718daf0dc35cf.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Documents and Settings\\sppsvc.exe\""	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\PerfLogs\\dwm.exe\""	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\System32\\wbem\\PS_MMAgent\\unsecapp.exe\""	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\PerfLogs\\RuntimeBroker.exe\""	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\WmiPerfClass\\WmiPrvSE.exe\""	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\ProgramData\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\sppsvc.exe\""	d6b8c1db03cd0f282e1718daf0dc35cf.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wbem\WmiPerfClass\WmiPrvSE.exe	d6b8c1db03cd0f282e1718daf0dc35cf.exe
File opened for modification	C:\Windows\SysWOW64\wbem\WmiPerfClass\WmiPrvSE.exe	d6b8c1db03cd0f282e1718daf0dc35cf.exe
File created	C:\Windows\SysWOW64\wbem\WmiPerfClass\24dbde2999530ef5fd907494bc374d663924116c	d6b8c1db03cd0f282e1718daf0dc35cf.exe
File created	C:\Windows\SysWOW64\wbem\PS_MMAgent\unsecapp.exe	d6b8c1db03cd0f282e1718daf0dc35cf.exe
File created	C:\Windows\SysWOW64\wbem\PS_MMAgent\29c1c3cc0f76855c7e7456076a4ffc27e4947119	d6b8c1db03cd0f282e1718daf0dc35cf.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3116 set thread context of 4884	3116	d6b8c1db03cd0f282e1718daf0dc35cf.exe	104
PID 1664 set thread context of 768	1664	csrss.exe	144

Launches sc.exe 22 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2852	sc.exe
1568	sc.exe
4516	sc.exe
1828	sc.exe
4512	sc.exe
3192	sc.exe
964	sc.exe
4456	sc.exe
4208	sc.exe
2576	sc.exe
4396	sc.exe
772	sc.exe
4500	sc.exe
1692	sc.exe
2220	sc.exe
4960	sc.exe
1780	sc.exe
2596	sc.exe
3664	sc.exe
5008	sc.exe
1444	sc.exe
2272	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
1932	schtasks.exe
4544	schtasks.exe
4536	schtasks.exe
4700	schtasks.exe
1444	schtasks.exe
2176	schtasks.exe
3124	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4876	AdvancedRun.exe
4876	AdvancedRun.exe
4876	AdvancedRun.exe
4876	AdvancedRun.exe
3448	AdvancedRun.exe
3448	AdvancedRun.exe
3448	AdvancedRun.exe
3448	AdvancedRun.exe
2424	powershell.exe
2424	powershell.exe
4884	d6b8c1db03cd0f282e1718daf0dc35cf.exe
4884	d6b8c1db03cd0f282e1718daf0dc35cf.exe
2424	powershell.exe
376	AdvancedRun.exe
376	AdvancedRun.exe
376	AdvancedRun.exe
376	AdvancedRun.exe
2084	powershell.exe
2084	powershell.exe
2084	powershell.exe
768	csrss.exe
768	csrss.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4876	AdvancedRun.exe
Token: SeImpersonatePrivilege	4876	AdvancedRun.exe
Token: SeDebugPrivilege	3448	AdvancedRun.exe
Token: SeImpersonatePrivilege	3448	AdvancedRun.exe
Token: SeDebugPrivilege	3116	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	4884	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Token: SeDebugPrivilege	376	AdvancedRun.exe
Token: SeImpersonatePrivilege	376	AdvancedRun.exe
Token: SeDebugPrivilege	1664	csrss.exe
Token: SeDebugPrivilege	768	csrss.exe
Token: SeDebugPrivilege	2084	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 4876	3116	d6b8c1db03cd0f282e1718daf0dc35cf.exe	95
PID 3116 wrote to memory of 4876	3116	d6b8c1db03cd0f282e1718daf0dc35cf.exe	95
PID 3116 wrote to memory of 4876	3116	d6b8c1db03cd0f282e1718daf0dc35cf.exe	95
PID 4876 wrote to memory of 3448	4876	AdvancedRun.exe	97
PID 4876 wrote to memory of 3448	4876	AdvancedRun.exe	97
PID 4876 wrote to memory of 3448	4876	AdvancedRun.exe	97
PID 3116 wrote to memory of 2424	3116	d6b8c1db03cd0f282e1718daf0dc35cf.exe	102
PID 3116 wrote to memory of 2424	3116	d6b8c1db03cd0f282e1718daf0dc35cf.exe	102
PID 3116 wrote to memory of 2424	3116	d6b8c1db03cd0f282e1718daf0dc35cf.exe	102
PID 3116 wrote to memory of 4884	3116	d6b8c1db03cd0f282e1718daf0dc35cf.exe	104
PID 3116 wrote to memory of 4884	3116	d6b8c1db03cd0f282e1718daf0dc35cf.exe	104
PID 3116 wrote to memory of 4884	3116	d6b8c1db03cd0f282e1718daf0dc35cf.exe	104
PID 3116 wrote to memory of 4884	3116	d6b8c1db03cd0f282e1718daf0dc35cf.exe	104
PID 3116 wrote to memory of 4884	3116	d6b8c1db03cd0f282e1718daf0dc35cf.exe	104
PID 3116 wrote to memory of 4884	3116	d6b8c1db03cd0f282e1718daf0dc35cf.exe	104
PID 3116 wrote to memory of 4884	3116	d6b8c1db03cd0f282e1718daf0dc35cf.exe	104
PID 3116 wrote to memory of 4884	3116	d6b8c1db03cd0f282e1718daf0dc35cf.exe	104
PID 4884 wrote to memory of 1664	4884	d6b8c1db03cd0f282e1718daf0dc35cf.exe	115
PID 4884 wrote to memory of 1664	4884	d6b8c1db03cd0f282e1718daf0dc35cf.exe	115
PID 4884 wrote to memory of 1664	4884	d6b8c1db03cd0f282e1718daf0dc35cf.exe	115
PID 1664 wrote to memory of 376	1664	csrss.exe	116
PID 1664 wrote to memory of 376	1664	csrss.exe	116
PID 1664 wrote to memory of 376	1664	csrss.exe	116
PID 3116 wrote to memory of 2576	3116	cmd.exe	120
PID 3116 wrote to memory of 2576	3116	cmd.exe	120
PID 3116 wrote to memory of 4396	3116	cmd.exe	121
PID 3116 wrote to memory of 4396	3116	cmd.exe	121
PID 3116 wrote to memory of 772	3116	cmd.exe	122
PID 3116 wrote to memory of 772	3116	cmd.exe	122
PID 3116 wrote to memory of 1828	3116	cmd.exe	123
PID 3116 wrote to memory of 1828	3116	cmd.exe	123
PID 3116 wrote to memory of 4960	3116	cmd.exe	124
PID 3116 wrote to memory of 4960	3116	cmd.exe	124
PID 3116 wrote to memory of 4512	3116	cmd.exe	125
PID 3116 wrote to memory of 4512	3116	cmd.exe	125
PID 3116 wrote to memory of 1780	3116	cmd.exe	126
PID 3116 wrote to memory of 1780	3116	cmd.exe	126
PID 3116 wrote to memory of 2596	3116	cmd.exe	127
PID 3116 wrote to memory of 2596	3116	cmd.exe	127
PID 3116 wrote to memory of 5008	3116	cmd.exe	128
PID 3116 wrote to memory of 5008	3116	cmd.exe	128
PID 3116 wrote to memory of 964	3116	cmd.exe	129
PID 3116 wrote to memory of 964	3116	cmd.exe	129
PID 3116 wrote to memory of 3192	3116	cmd.exe	130
PID 3116 wrote to memory of 3192	3116	cmd.exe	130
PID 3116 wrote to memory of 4456	3116	cmd.exe	131
PID 3116 wrote to memory of 4456	3116	cmd.exe	131
PID 3116 wrote to memory of 2852	3116	cmd.exe	132
PID 3116 wrote to memory of 2852	3116	cmd.exe	132
PID 3116 wrote to memory of 4500	3116	cmd.exe	133
PID 3116 wrote to memory of 4500	3116	cmd.exe	133
PID 3116 wrote to memory of 1568	3116	cmd.exe	134
PID 3116 wrote to memory of 1568	3116	cmd.exe	134
PID 3116 wrote to memory of 1444	3116	cmd.exe	135
PID 3116 wrote to memory of 1444	3116	cmd.exe	135
PID 3116 wrote to memory of 4516	3116	cmd.exe	136
PID 3116 wrote to memory of 4516	3116	cmd.exe	136
PID 3116 wrote to memory of 1692	3116	cmd.exe	137
PID 3116 wrote to memory of 1692	3116	cmd.exe	137
PID 3116 wrote to memory of 4208	3116	cmd.exe	138
PID 3116 wrote to memory of 4208	3116	cmd.exe	138
PID 3116 wrote to memory of 2272	3116	cmd.exe	139
PID 3116 wrote to memory of 2272	3116	cmd.exe	139
PID 3116 wrote to memory of 2220	3116	cmd.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf.exe
"C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf.exe"
1⤵
- DcRat
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Users\Admin\AppData\Local\Temp\b50e3949-8607-4de2-aa32-39f37bbeb8e9\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\b50e3949-8607-4de2-aa32-39f37bbeb8e9\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\b50e3949-8607-4de2-aa32-39f37bbeb8e9\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Users\Admin\AppData\Local\Temp\b50e3949-8607-4de2-aa32-39f37bbeb8e9\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\b50e3949-8607-4de2-aa32-39f37bbeb8e9\AdvancedRun.exe" /SpecialRun 4101d8 4876
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3448
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf.exe
  "C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Recovery\WindowsRE\csrss.exe
    "C:\Recovery\WindowsRE\csrss.exe"
    3⤵
    - Windows security bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\7a0de871-a6d2-43c6-95fa-ae0f5b7f73ba\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\7a0de871-a6d2-43c6-95fa-ae0f5b7f73ba\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\7a0de871-a6d2-43c6-95fa-ae0f5b7f73ba\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:376
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7a0de871-a6d2-43c6-95fa-ae0f5b7f73ba\test.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3116
      - C:\Windows\system32\sc.exe
        
        sc stop windefend
        6⤵
        Launches sc.exe
        
        PID:2576
      - C:\Windows\system32\sc.exe
        
        sc config windefend start= disabled
        6⤵
        Launches sc.exe
        
        PID:4396
      - C:\Windows\system32\sc.exe
        
        sc stop Sense
        6⤵
        Launches sc.exe
        
        PID:772
      - C:\Windows\system32\sc.exe
        
        sc config Sense start= disabled
        6⤵
        Launches sc.exe
        
        PID:1828
      - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:4960
      - C:\Windows\system32\sc.exe
        
        sc config wuauserv start= disabled
        6⤵
        Launches sc.exe
        
        PID:4512
      - C:\Windows\system32\sc.exe
        
        sc stop usosvc
        6⤵
        Launches sc.exe
        
        PID:1780
      - C:\Windows\system32\sc.exe
        
        sc config usosvc start= disabled
        6⤵
        Launches sc.exe
        
        PID:2596
      - C:\Windows\system32\sc.exe
        
        sc stop WaasMedicSvc
        6⤵
        Launches sc.exe
        
        PID:5008
      - C:\Windows\system32\sc.exe
        
        sc config WaasMedicSvc start= disabled
        6⤵
        Launches sc.exe
        
        PID:964
      - C:\Windows\system32\sc.exe
        
        sc stop SecurityHealthService
        6⤵
        Launches sc.exe
        
        PID:3192
      - C:\Windows\system32\sc.exe
        
        sc config SecurityHealthService start= disabled
        6⤵
        Launches sc.exe
        
        PID:4456
      - C:\Windows\system32\sc.exe
        
        sc stop SDRSVC
        6⤵
        Launches sc.exe
        
        PID:2852
      - C:\Windows\system32\sc.exe
        
        sc config SDRSVC start= disabled
        6⤵
        Launches sc.exe
        
        PID:4500
      - C:\Windows\system32\sc.exe
        
        sc stop wscsvc
        6⤵
        Launches sc.exe
        
        PID:1568
      - C:\Windows\system32\sc.exe
        
        sc config wscsvc start= disabled
        6⤵
        Launches sc.exe
        
        PID:1444
      - C:\Windows\system32\sc.exe
        
        sc stop WdiServiceHost
        6⤵
        Launches sc.exe
        
        PID:4516
      - C:\Windows\system32\sc.exe
        
        sc config WdiServiceHost start= disabled
        6⤵
        Launches sc.exe
        
        PID:1692
      - C:\Windows\system32\sc.exe
        
        sc stop WdiSystemHost
        6⤵
        Launches sc.exe
        
        PID:4208
      - C:\Windows\system32\sc.exe
        
        sc config WdiSystemHost start= disabled
        6⤵
        Launches sc.exe
        
        PID:2272
      - C:\Windows\system32\sc.exe
        
        sc stop InstallService
        6⤵
        Launches sc.exe
        
        PID:2220
      - C:\Windows\system32\sc.exe
        
        sc config InstallService Start= disabled
        6⤵
        Launches sc.exe
        
        PID:3664
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Recovery\WindowsRE\csrss.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2084
  - - C:\Recovery\WindowsRE\csrss.exe
      "C:\Recovery\WindowsRE\csrss.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\WmiPerfClass\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Documents and Settings\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\PerfLogs\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\System32\wbem\PS_MMAgent\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\PerfLogs\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry