dcrat | 82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

585d78b9ffc988d345e7a2a0ee119111.exe
Size

23.9MB
MD5

585d78b9ffc988d345e7a2a0ee119111
SHA1

65b5c6a6c72a845d5610d82ca2aa9a301a907e43
SHA256

82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661
SHA512

574c1f9ecaaeee0cc7afb989e3c3d309beedf3b114fbbb0aa491a285d94e27b4e87626a109805d06edcace458441189cc2dbcd17588c670ce8788c9e8e3a9772
SSDEEP

393216:849/fUrtpuKs+JINSpjQNjqsVsUzpX/Swl6YdecNbLX3IjD4BzB/RLG0jV7ZIfue:cBZs+JIgpjQosVRlKwlOq/X2EtF9IGe

Score

10^/10

dcrat zgrat discovery evasion execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/4608-48-0x0000000000400000-0x0000000001BE6000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x00080000000233f3-15.dat	dcrat
behavioral2/memory/4608-48-0x0000000000400000-0x0000000001BE6000-memory.dmp	dcrat
behavioral2/files/0x00080000000233f6-77.dat	dcrat
behavioral2/memory/4928-81-0x0000000000640000-0x00000000008FE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1604	powershell.exe
672	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	build.exe
File created	C:\Windows\system32\drivers\etc\hosts	WinUpdater.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x00080000000233f4-23.dat	net_reactor
behavioral2/memory/1684-38-0x0000000000270000-0x00000000002E8000-memory.dmp	net_reactor
behavioral2/memory/4608-48-0x0000000000400000-0x0000000001BE6000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	585d78b9ffc988d345e7a2a0ee119111.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	MVPInstaller.exe

Executes dropped EXE 8 IoCs

pid	Process
4856	build.exe
2892	DCRatBuild.exe
1684	323.exe
3300	MVPInstaller.exe
4460	MVPInstaller.exe
4928	WindowsUpdate.exe
3192	MVPInstaller.exe
1808	WinUpdater.exe

Loads dropped DLL 8 IoCs

pid	Process
3300	MVPInstaller.exe
3300	MVPInstaller.exe
3300	MVPInstaller.exe
3192	MVPInstaller.exe
3192	MVPInstaller.exe
3192	MVPInstaller.exe
3192	MVPInstaller.exe
3192	MVPInstaller.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	svchost.exe
File opened for modification	C:\Windows\system32\MRT.exe	build.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\system32\MRT.exe	WinUpdater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4856 set thread context of 4980	4856	build.exe	104
PID 1808 set thread context of 5896	1808	WinUpdater.exe	122
PID 1808 set thread context of 5924	1808	WinUpdater.exe	123
PID 1808 set thread context of 5992	1808	WinUpdater.exe	125

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4888	sc.exe
2328	sc.exe
916	sc.exe
1416	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	wmiprvse.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 62 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dialer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1715427467"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe

Modifies registry class 31 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a9fff7fe-a6fc-4669	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2f54a29b-c8a9-4ace	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\CurrentWorkingDirectory	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2f54a29b-c8a9-4ace = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2f54a29b-c8a9-4ace = "\\\\?\\Volume{8CCC3C3F-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\fd38823f3e602e0e5bcf38e1ce8ed239fbe14051a904705600876d41cdb35e20"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\ManagedByApp	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\MostRecentlyUsed	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	DCRatBuild.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7fd29bde-63eb-490a	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7fd29bde-63eb-490a = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000da127a7697a3da01da127a7697a3da01da127a7697a3da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000ab588f5c2000666433383832336633653630326530653562636633386531636538656432333966626531343035316139303437303536303038373664343163646233356532300000b20009000400efbeab588f5cab588f5c2e0000000000000000000000000000000000000000000000000026e0f400660064003300380038003200330066003300650036003000320065003000650035006200630066003300380065003100630065003800650064003200330039006600620065003100340030003500310061003900300034003700300035003600300030003800370036006400340031006300640062003300350065003200300000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000e1523fa01000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c66643338383233663365363032653065356263663338653163653865643233396662653134303531613930343730353630303837366434316364623335653230000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f626a6979756965000000000000000096f7560095bce14897a93e3da1d528bc8fc98c553c0def119519eabd73f69b3396f7560095bce14897a93e3da1d528bc8fc98c553c0def119519eabd73f69b33d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0034003100320034003900300030003500350031002d0034003000360038003400370036003000360037002d0033003400390031003200310032003500330033002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003f3ccc8c000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cdc9c7c3-f169-4af2	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2f54a29b-c8a9-4ace = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7fd29bde-63eb-490a = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7fd29bde-63eb-490a = "8324"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7fd29bde-63eb-490a = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2f54a29b-c8a9-4ace = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7fd29bde-63eb-490a = "\\\\?\\Volume{8CCC3C3F-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\fd38823f3e602e0e5bcf38e1ce8ed239fbe14051a904705600876d41cdb35e20"	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\12330ff2-d825-4568	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d6ab0859-6088-4224	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2f54a29b-c8a9-4ace	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2f54a29b-c8a9-4ace = d20e067897a3da01	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2f54a29b-c8a9-4ace	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7fd29bde-63eb-490a	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7fd29bde-63eb-490a = 66e9d37697a3da01	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4a6f960b-74ee-4ca1	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0d19fed9-5d3f-419e	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2f54a29b-c8a9-4ace = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000002a640e7797a3da01fce1bb7797a3da01fce1bb7797a3da019c0400000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000ab588f5c2000666433383832336633653630326530653562636633386531636538656432333966626531343035316139303437303536303038373664343163646233356532300000b20009000400efbeab588f5cab588f5c2e0000000000000000000000000000000000000000000000000026e0f400660064003300380038003200330066003300650036003000320065003000650035006200630066003300380065003100630065003800650064003200330039006600620065003100340030003500310061003900300034003700300035003600300030003800370036006400340031006300640062003300350065003200300000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000e1523fa01000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c66643338383233663365363032653065356263663338653163653865643233396662653134303531613930343730353630303837366434316364623335653230000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f626a6979756965000000000000000096f7560095bce14897a93e3da1d528bc94c98c553c0def119519eabd73f69b3396f7560095bce14897a93e3da1d528bc94c98c553c0def119519eabd73f69b33d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0034003100320034003900300030003500350031002d0034003000360038003400370036003000360037002d0033003400390031003200310032003500330033002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003f3ccc8c000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7fd29bde-63eb-490a	RuntimeBroker.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
628	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3300	MVPInstaller.exe
3300	MVPInstaller.exe
3300	MVPInstaller.exe
3300	MVPInstaller.exe
4856	build.exe
1604	powershell.exe
1604	powershell.exe
4856	build.exe
4856	build.exe
4856	build.exe
4980	dialer.exe
4980	dialer.exe
4856	build.exe
1684	323.exe
4856	build.exe
4856	build.exe
4856	build.exe
1808	WinUpdater.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
4980	dialer.exe
4980	dialer.exe
672	powershell.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
672	powershell.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
672	powershell.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
672	powershell.exe
4980	dialer.exe
4980	dialer.exe
3080	wmiprvse.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
672	powershell.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe
4980	dialer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	323.exe
Token: SeDebugPrivilege	3300	MVPInstaller.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	4928	WindowsUpdate.exe
Token: SeDebugPrivilege	4856	build.exe
Token: SeDebugPrivilege	4980	dialer.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeShutdownPrivilege	3404	Explorer.EXE
Token: SeCreatePagefilePrivilege	3404	Explorer.EXE
Token: SeShutdownPrivilege	3404	Explorer.EXE
Token: SeCreatePagefilePrivilege	3404	Explorer.EXE
Token: SeAuditPrivilege	2780	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2096	svchost.exe
Token: SeIncreaseQuotaPrivilege	2096	svchost.exe
Token: SeSecurityPrivilege	2096	svchost.exe
Token: SeTakeOwnershipPrivilege	2096	svchost.exe
Token: SeLoadDriverPrivilege	2096	svchost.exe
Token: SeSystemtimePrivilege	2096	svchost.exe
Token: SeBackupPrivilege	2096	svchost.exe
Token: SeRestorePrivilege	2096	svchost.exe
Token: SeShutdownPrivilege	2096	svchost.exe
Token: SeSystemEnvironmentPrivilege	2096	svchost.exe
Token: SeUndockPrivilege	2096	svchost.exe
Token: SeManageVolumePrivilege	2096	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2096	svchost.exe
Token: SeIncreaseQuotaPrivilege	2096	svchost.exe
Token: SeSecurityPrivilege	2096	svchost.exe
Token: SeTakeOwnershipPrivilege	2096	svchost.exe
Token: SeLoadDriverPrivilege	2096	svchost.exe
Token: SeSystemtimePrivilege	2096	svchost.exe
Token: SeBackupPrivilege	2096	svchost.exe
Token: SeRestorePrivilege	2096	svchost.exe
Token: SeShutdownPrivilege	2096	svchost.exe
Token: SeSystemEnvironmentPrivilege	2096	svchost.exe
Token: SeUndockPrivilege	2096	svchost.exe
Token: SeManageVolumePrivilege	2096	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2096	svchost.exe
Token: SeIncreaseQuotaPrivilege	2096	svchost.exe
Token: SeSecurityPrivilege	2096	svchost.exe
Token: SeTakeOwnershipPrivilege	2096	svchost.exe
Token: SeLoadDriverPrivilege	2096	svchost.exe
Token: SeSystemtimePrivilege	2096	svchost.exe
Token: SeBackupPrivilege	2096	svchost.exe
Token: SeRestorePrivilege	2096	svchost.exe
Token: SeShutdownPrivilege	2096	svchost.exe
Token: SeSystemEnvironmentPrivilege	2096	svchost.exe
Token: SeUndockPrivilege	2096	svchost.exe
Token: SeManageVolumePrivilege	2096	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2096	svchost.exe
Token: SeIncreaseQuotaPrivilege	2096	svchost.exe
Token: SeSecurityPrivilege	2096	svchost.exe
Token: SeTakeOwnershipPrivilege	2096	svchost.exe
Token: SeLoadDriverPrivilege	2096	svchost.exe
Token: SeSystemtimePrivilege	2096	svchost.exe
Token: SeBackupPrivilege	2096	svchost.exe
Token: SeRestorePrivilege	2096	svchost.exe
Token: SeShutdownPrivilege	2096	svchost.exe
Token: SeSystemEnvironmentPrivilege	2096	svchost.exe
Token: SeUndockPrivilege	2096	svchost.exe
Token: SeManageVolumePrivilege	2096	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2096	svchost.exe
Token: SeIncreaseQuotaPrivilege	2096	svchost.exe
Token: SeSecurityPrivilege	2096	svchost.exe
Token: SeTakeOwnershipPrivilege	2096	svchost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3192	MVPInstaller.exe
3192	MVPInstaller.exe
3192	MVPInstaller.exe
3192	MVPInstaller.exe
3192	MVPInstaller.exe
3192	MVPInstaller.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3924	RuntimeBroker.exe
3404	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 4856	4608	585d78b9ffc988d345e7a2a0ee119111.exe	85
PID 4608 wrote to memory of 4856	4608	585d78b9ffc988d345e7a2a0ee119111.exe	85
PID 4608 wrote to memory of 2892	4608	585d78b9ffc988d345e7a2a0ee119111.exe	86
PID 4608 wrote to memory of 2892	4608	585d78b9ffc988d345e7a2a0ee119111.exe	86
PID 4608 wrote to memory of 2892	4608	585d78b9ffc988d345e7a2a0ee119111.exe	86
PID 4608 wrote to memory of 1684	4608	585d78b9ffc988d345e7a2a0ee119111.exe	87
PID 4608 wrote to memory of 1684	4608	585d78b9ffc988d345e7a2a0ee119111.exe	87
PID 4608 wrote to memory of 1684	4608	585d78b9ffc988d345e7a2a0ee119111.exe	87
PID 2892 wrote to memory of 1832	2892	DCRatBuild.exe	88
PID 2892 wrote to memory of 1832	2892	DCRatBuild.exe	88
PID 2892 wrote to memory of 1832	2892	DCRatBuild.exe	88
PID 4608 wrote to memory of 3300	4608	585d78b9ffc988d345e7a2a0ee119111.exe	89
PID 4608 wrote to memory of 3300	4608	585d78b9ffc988d345e7a2a0ee119111.exe	89
PID 4608 wrote to memory of 3300	4608	585d78b9ffc988d345e7a2a0ee119111.exe	89
PID 1832 wrote to memory of 2564	1832	WScript.exe	90
PID 1832 wrote to memory of 2564	1832	WScript.exe	90
PID 1832 wrote to memory of 2564	1832	WScript.exe	90
PID 3300 wrote to memory of 4460	3300	MVPInstaller.exe	93
PID 3300 wrote to memory of 4460	3300	MVPInstaller.exe	93
PID 3300 wrote to memory of 2980	3300	MVPInstaller.exe	95
PID 3300 wrote to memory of 2980	3300	MVPInstaller.exe	95
PID 3300 wrote to memory of 2980	3300	MVPInstaller.exe	95
PID 2564 wrote to memory of 4928	2564	cmd.exe	98
PID 2564 wrote to memory of 4928	2564	cmd.exe	98
PID 2980 wrote to memory of 628	2980	cmd.exe	99
PID 2980 wrote to memory of 628	2980	cmd.exe	99
PID 2980 wrote to memory of 628	2980	cmd.exe	99
PID 4460 wrote to memory of 3192	4460	MVPInstaller.exe	100
PID 4460 wrote to memory of 3192	4460	MVPInstaller.exe	100
PID 4856 wrote to memory of 4980	4856	build.exe	104
PID 4856 wrote to memory of 4980	4856	build.exe	104
PID 4856 wrote to memory of 4980	4856	build.exe	104
PID 4856 wrote to memory of 4980	4856	build.exe	104
PID 4856 wrote to memory of 4980	4856	build.exe	104
PID 4856 wrote to memory of 4980	4856	build.exe	104
PID 4856 wrote to memory of 4980	4856	build.exe	104
PID 1452 wrote to memory of 4908	1452	cmd.exe	109
PID 1452 wrote to memory of 4908	1452	cmd.exe	109
PID 4980 wrote to memory of 608	4980	dialer.exe	5
PID 4980 wrote to memory of 676	4980	dialer.exe	7
PID 4980 wrote to memory of 956	4980	dialer.exe	12
PID 4980 wrote to memory of 60	4980	dialer.exe	13
PID 4980 wrote to memory of 696	4980	dialer.exe	14
PID 5100 wrote to memory of 3356	5100	cmd.exe	118
PID 5100 wrote to memory of 3356	5100	cmd.exe	118
PID 676 wrote to memory of 2760	676	lsass.exe	47
PID 676 wrote to memory of 2760	676	lsass.exe	47
PID 4980 wrote to memory of 1048	4980	dialer.exe	16
PID 4980 wrote to memory of 1084	4980	dialer.exe	17
PID 4980 wrote to memory of 1096	4980	dialer.exe	18
PID 4980 wrote to memory of 1184	4980	dialer.exe	19
PID 4980 wrote to memory of 1248	4980	dialer.exe	20
PID 4980 wrote to memory of 1288	4980	dialer.exe	21
PID 4980 wrote to memory of 1324	4980	dialer.exe	22
PID 4980 wrote to memory of 1356	4980	dialer.exe	23
PID 4980 wrote to memory of 1476	4980	dialer.exe	24
PID 4980 wrote to memory of 1512	4980	dialer.exe	25
PID 4980 wrote to memory of 1560	4980	dialer.exe	26
PID 4980 wrote to memory of 1576	4980	dialer.exe	27
PID 4980 wrote to memory of 1704	4980	dialer.exe	28
PID 4980 wrote to memory of 1716	4980	dialer.exe	29
PID 4980 wrote to memory of 1760	4980	dialer.exe	30
PID 4980 wrote to memory of 1792	4980	dialer.exe	31
PID 4980 wrote to memory of 1872	4980	dialer.exe	32

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:60

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1184
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1476
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2228

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2748

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2808

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3396

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3404
- C:\Users\Admin\AppData\Local\Temp\585d78b9ffc988d345e7a2a0ee119111.exe
  "C:\Users\Admin\AppData\Local\Temp\585d78b9ffc988d345e7a2a0ee119111.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1452
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:4908
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4980
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "WinUpdater"
      4⤵
      Launches sc.exe
      PID:2328
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "WinUpdater" binpath= "C:\ProgramData\WindowsUpdate\WinUpdater.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:916
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:4888
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "WinUpdater"
      4⤵
      Launches sc.exe
      PID:1416
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\build.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5100
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4544
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:3356
- - C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
    "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\WindowsUpdate\TEUXpnVW2Rogcdt2Uv.vbe"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:1832
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\WindowsUpdate\2UpMr4oh.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2564
      - C:\WindowsUpdate\WindowsUpdate.exe
        
        "C:\WindowsUpdate\WindowsUpdate.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4928
- - C:\Users\Admin\AppData\Local\Temp\323.exe
    "C:\Users\Admin\AppData\Local\Temp\323.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1684
- - C:\Users\Admin\AppData\Local\Temp\MVPInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\MVPInstaller.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Users\Admin\AppData\Roaming\MVPInstaller\MVPInstaller.exe
      "C:\Users\Admin\AppData\Roaming\MVPInstaller\MVPInstaller.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\MVPInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\MVPInstaller.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:3192
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c deldll.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2980
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 -w 1000 127.0.0.1
        5⤵
        Runs ping.exe
        
        PID:628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3552

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3748

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of UnmapMainImage
PID:3924

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3808

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2912

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:1848

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:5040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:396

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1880

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2068

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:3368

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:2156

C:\ProgramData\WindowsUpdate\WinUpdater.exe
C:\ProgramData\WindowsUpdate\WinUpdater.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1808
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:672
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:5884
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5956
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2820
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:5896
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:5924
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  - Modifies data under HKEY_USERS
  PID:5992

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:5752

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\323.exe

Filesize
457KB

MD5
53c1d38049f4318e577c3ab1bcc6e38f

SHA1
0bd051e27c86ef4858c94f2398d64958e130c448

SHA256
ad6baed534549a8eb75f44c05807581e0eb5fde56a8b3a64a741853bcb19a863

SHA512
938bcdfefc9a28bc9d6918db1df487d78c218e2f15e86cbab69f773eb366b1e822d65c2e82c05ff623f3a69981735badc182d67062cd2f7506ccc017ab7fc42d

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe

Filesize
3.0MB

MD5
caddb11f9014c4b6bd7f79306211899f

SHA1
1cef789bb00aa2bf87ce0b1dc612b577e05f6e7a

SHA256
5be33a975fb052c1a4338ed8deca2641f5a9fa52f2cf3c6fd71b420fff462440

SHA512
fa5c582eb75c6d8dd03f455f328b9ceb5b509f9d0fd659cd7521771940105e9e108c900edbaf685c0b5090825df46cc8c98fd383ce2f08bf74edcdc3546110ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\MVPInstaller.exe

Filesize
15.1MB

MD5
85059372ceca7eff4ac1642bd631b93e

SHA1
f59d24530e896d688792fa022fda50417722ebd8

SHA256
6e4c820de03c72d71c43d24885b7e1f2462bcced03114b31eac8bccc9ec924c9

SHA512
bfd54c1c39658f97a10b8baf75a83a658e7d7e66afeaf291df6eb77fc0f4b4173850b336d6af1f4992f6918049acf5f747383deecc63b914562bf83cb9f11e5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\MVPInstaller.exe

Filesize
340KB

MD5
3fb5bd0f25e277240fbad5b91a73c71b

SHA1
28614ac9c8c81e6c86895c834897d9401a7bb14d

SHA256
7dee5d5355599fd25903306b4868e5ad9f0c825e4d9589bc3ebf16020ee140f4

SHA512
94e1cbd82be09ea4316e5a4eaf7b3c439b811e1b8748dfc93a4165915d6b46fd076d15e641b19f27b6ca2f8fbe9257eec889b202ad367fe21b3086fc4e613031

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VCRUNTIME140.dll

Filesize
94KB

MD5
11d9ac94e8cb17bd23dea89f8e757f18

SHA1
d4fb80a512486821ad320c4fd67abcae63005158

SHA256
e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

SHA512
aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\app.so

Filesize
4.4MB

MD5
14d0a013e4ba7e748c77d14771f01120

SHA1
fbda934ba5e9864bd6625786b124df624972676b

SHA256
327c7235ddad44cb53f3387948a21a8ada6c776060e512f0d48a704920b1004c

SHA512
7e99c55e0210bd855db91883c74329f78c0bb20c55c80b088a03167670ae56258caf24d5373c896d2ca7120a1b8c174da36436b4aef0df14d8e57ca893bf867d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\AssetManifest.bin

Filesize
751B

MD5
f0ab28955a65dda7ec0745733b8d5704

SHA1
f1323494b94cea4017b553a78c045c19ffd6606f

SHA256
07c3ef8bcee38f84a1e57005a864a4404111fc96195aba4d630c8be969772310

SHA512
82b1be0370788065534d642dc43c01a248fa2cfaa97b4a7db60dda9cdf94d8f3c38f614fb54eef0bcbc332714c05ad4002baed903a826f529c2add1847d70a2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\FontManifest.json

Filesize
499B

MD5
b2f01a90f24be87c4f4ae98e79090bf5

SHA1
ae7107f7e0d5fae6288e8a82cb1c0f67efbc0b3d

SHA256
eb4549732cd13d6c3874351c182ea15850fbf71f219fe1efe9a1cac19b6c9087

SHA512
422af00f1d8835598586687bec6162c52f6eb0234222f855301bceba8dd71a2bc0e720fa4148c360e77a44be97efc587dd3e2bef5c3cdece1a925f7cf93046ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\assets\fonts\Montserrat-Bold.ttf

Filesize
255KB

MD5
88932dadc42e1bba93b21a76de60ef7a

SHA1
3320ff5514b32565b0396de4f2064ce17ec9eea4

SHA256
c4c8cb572a5a2c43d78b3701f4b2349684e6ca4d1557e469af6065b1e099c26c

SHA512
298e1e171dbbe386e1abe153446b883c40910819099f64f54dc9faa95d739be56839537342bbe8dd8408545cb1f8c98878a3524d91af1f11a112d1bfc202657a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\assets\fonts\gothampro_black.ttf

Filesize
39KB

MD5
efb0c02a5dbe65a7115b477e74c7a661

SHA1
e30324f4074bcc522a393cecaa62aa4b0e9205cc

SHA256
270d30776b7e5ccf0560b08e0db009f4b1d9753d43689d1e20bb1065e2a3c157

SHA512
0095fb9b0cd508c996cfdc11374a040ef064a22f188d7fbeb21f23c5f7f06aa2bce75e9ae22ec1c0e0f1b8e23003f67c8e8b5962c224c1295fb311e63a9b91f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\assets\skeleton.gif

Filesize
776KB

MD5
a1f94e106f73bd7ff5d3d36d2eef917d

SHA1
549aa1d500f3754026c2cfd336351802126907ea

SHA256
d400caf56eec5bf44bdbfa754bb7bcb84651293497a59b45b1796df202ab9bfe

SHA512
f65e38fdf3a6215b6de29dd284a1dfb19fc1a6a9e5d8f7c7b47deeafe3d1c3d4e83dce6c9cecf0f004d78e04829d46d1451c857adaa47a983c99ec22f55314be

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\fonts\MaterialIcons-Regular.otf

Filesize
1.6MB

MD5
e7069dfd19b331be16bed984668fe080

SHA1
fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4

SHA256
d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453

SHA512
27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\icudtl.dat

Filesize
798KB

MD5
cf772cf9f6ca67f592fe47da2a15adb1

SHA1
9cc4d99249bdba8a030daf00d98252c8aef7a0ff

SHA256
ac44ccc3f61bf630bb20fb8043d86cfe4c8995d06b460084400db45d70497b30

SHA512
0bec0d3a34a4ac1cc2ed81dba3bc52981c5dd391a68fe21132dfadb70e42ffbe8f3ba798185733d64a900fd2bb2403f9a8558e6666f2c1e2c0e818d8e3f154fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\flutter_windows.dll

Filesize
17.0MB

MD5
2eb35e2372de5fc7fde925c96de61d48

SHA1
a9eedd7cf44a6eab4e08df9ab0b33fd95ceb48fd

SHA256
80efad451cd0b674b9974ef286d29ef72f219999dd8f993585f9168d97895e6f

SHA512
18a03d297770707709fcada8dd0741bd39057d54b49125119ba8b7d21aa67284dece89947dc14721fe3084e69f03e816a2ed9ad79e82ffe279d7fd0a318ff029

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\msvcp140.dll

Filesize
558KB

MD5
bf78c15068d6671693dfcdfa5770d705

SHA1
4418c03c3161706a4349dfe3f97278e7a5d8962a

SHA256
a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb

SHA512
5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\vcruntime140_1.dll

Filesize
36KB

MD5
7667b0883de4667ec87c3b75bed84d84

SHA1
e6f6df83e813ed8252614a46a5892c4856df1f58

SHA256
04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d

SHA512
968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sfybgpog.gfq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe

Filesize
5.3MB

MD5
b069f6439d9d415ed13122529479bfca

SHA1
0ed5485647d52ce4160737244d15d1beade0fa87

SHA256
c207aec56d9b2369dbf6d6d6d585ac6006937002b4d9791d675a04bb7b4b5af4

SHA512
d75bfd3d873f2af8cb80f97a3b9583a7750515a11f31ce6ae477e8a526aa6c9db191ae08a100c16b6c1ab8d01661275c62732df13eb65c4dc5b1700a5110572a

Download Submit
C:\Users\Admin\AppData\Local\Temp\deldll.bat

Filesize
200B

MD5
ea190ef9b139757a890cd48bdd44b0ee

SHA1
95c684e41bf7919408816aafab881621fface202

SHA256
9131de0fcaaf968896af9d58b6f37b4aa443455bb97c97bc142f295cee577bc4

SHA512
22802ffc1965c8e27f799ee88e3fa46debb316c27507a570b0812bc5de0d59a9c2a2105b8cc204851b3c29984ef1dfb7842131819952b185b7e4325a032fb6ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\gentee35\guig.dll

Filesize
20KB

MD5
d3f8c0334c19198a109e44d074dac5fd

SHA1
167716989a62b25e9fcf8e20d78e390a52e12077

SHA256
005c251c21d6a5ba1c3281e7b9f3b4f684d007e0c3486b34a545bb370d8420aa

SHA512
9c890e0af5b20ce9db4284e726ec0b05b2a9f18b909fb8e595edf3348a8f0d07d5238d85446a09e72e4faa2e2875beb52742d312e5163f48df4072b982801b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\genteert.dll

Filesize
60KB

MD5
6ce814fd1ad7ae07a9e462c26b3a0f69

SHA1
15f440c2a8498a4efe2d9ba0c6268fab4fb8e0a7

SHA256
54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831

SHA512
e5cff6bcb063635e5193209b94a9b2f5465f1c82394f23f50bd30bf0a2b117b209f5fca5aa10a7912a94ad88711dcd490aa528a7202f09490acd96cd640a3556

Download Submit
C:\Users\Admin\AppData\Roaming\MVPInstaller\MVPInstaller.exe

Filesize
15.3MB

MD5
91a99c76150f66c4d582ce98f3e3b2c3

SHA1
983fed8f09fe95fb3ca67e884f2f824f0e3a72be

SHA256
61217d7e2be6784784aa6b3b3a23a2777a6eee79be4e6f8d6e3f6b0f10032920

SHA512
2562b594ff224d36d6f7c147326cc929e9790bf75632c4f7e3589dbb58498159a4978f5e48751d13ae5d62f354d541a3156d4f901e6f1983fb9b1f3e3638cf8b

Download Submit
C:\WindowsUpdate\2UpMr4oh.bat

Filesize
36B

MD5
ececcb4dab2899a896f6727230ddb26a

SHA1
7f629cd32f92dc6a8da7142f7de397b08ced0974

SHA256
f7f7150ae59104004cc4bdd36110807333ef0a27c0ce0a08fd0ae2646159f73c

SHA512
10f74f3b64ace8002270e27a450cc26a25502d9c98f8dd23cfa22886368be1d7d7c46cd153fbac88b07bcf0ea401549a5927a8583b612a0e5e2b5aa9162ee592

Download Submit
C:\WindowsUpdate\TEUXpnVW2Rogcdt2Uv.vbe

Filesize
198B

MD5
ea0cabd5fc14e86870ef589016ad6400

SHA1
ebbb0646d34c4973021d08ad37276f54036d1658

SHA256
3f5a8ef3d4412432127feab5637a18b59cb06ec47faefae6f54dfcde27a5cbf7

SHA512
200623fc8cdcbb6acbefcb04334f84453162188cc00d846046ea54db3168a470d8263bce12524809864bdad1d1438890783afac6440670931ea59d1a97fc6a57

Download Submit
C:\WindowsUpdate\WindowsUpdate.exe

Filesize
2.7MB

MD5
0b87d00f10456b51ada70c1b7807338a

SHA1
f55e241151a8c6c2efc69f4e7632b6c5fadc0029

SHA256
4e4816037287d21798d7b3d11a3c32bc6b32db6c07ca9af6d3f603b6e77111fa

SHA512
288bb96b3ebfa562cb5907eabb2c3200804286b8b8055a36cfab2f08403e4655125a593455f2d8c13ee486c4ef035ce49b3df8e6c42d52ee98d072a27266c8d8

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
3KB

MD5
2d29fd3ae57f422e2b2121141dc82253

SHA1
c2464c857779c0ab4f5e766f5028fcc651a6c6b7

SHA256
80a60d7ec533d820de20bcedeb41319e7b1def548b6ea73ddbd69455bac4e7a4

SHA512
077a5c554663be7b71f181d961f5c98c732bc296dc015ffee30768a648bee3aad62c39c352cf2947432be19519906aeac7dfaf2557d309bb460732abb7fdbc68

Download Submit
memory/60-205-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

Filesize
64KB

Download
memory/60-204-0x000001BAA7370000-0x000001BAA739B000-memory.dmp

Filesize
172KB

Download
memory/608-195-0x000002A677F80000-0x000002A677FAB000-memory.dmp

Filesize
172KB

Download
memory/608-194-0x000002A677BB0000-0x000002A677BD4000-memory.dmp

Filesize
144KB

Download
memory/608-196-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

Filesize
64KB

Download
memory/672-501-0x0000021E327E0000-0x0000021E327FC000-memory.dmp

Filesize
112KB

Download
memory/672-509-0x0000021E327D0000-0x0000021E327D8000-memory.dmp

Filesize
32KB

Download
memory/672-497-0x0000021E32590000-0x0000021E325AC000-memory.dmp

Filesize
112KB

Download
memory/672-507-0x0000021E327C0000-0x0000021E327CA000-memory.dmp

Filesize
40KB

Download
memory/672-508-0x0000021E32820000-0x0000021E3283A000-memory.dmp

Filesize
104KB

Download
memory/672-511-0x0000021E32810000-0x0000021E3281A000-memory.dmp

Filesize
40KB

Download
memory/672-499-0x0000021E32670000-0x0000021E3267A000-memory.dmp

Filesize
40KB

Download
memory/672-510-0x0000021E32800000-0x0000021E32806000-memory.dmp

Filesize
24KB

Download
memory/672-498-0x0000021E325B0000-0x0000021E32665000-memory.dmp

Filesize
724KB

Download
memory/676-199-0x000002469A200000-0x000002469A22B000-memory.dmp

Filesize
172KB

Download
memory/676-200-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

Filesize
64KB

Download
memory/696-211-0x000002693D700000-0x000002693D72B000-memory.dmp

Filesize
172KB

Download
memory/696-212-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

Filesize
64KB

Download
memory/956-208-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

Filesize
64KB

Download
memory/956-207-0x0000021718FD0000-0x0000021718FFB000-memory.dmp

Filesize
172KB

Download
memory/1048-229-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

Filesize
64KB

Download
memory/1048-228-0x000001CB89770000-0x000001CB8979B000-memory.dmp

Filesize
172KB

Download
memory/1084-231-0x000001E69FAC0000-0x000001E69FAEB000-memory.dmp

Filesize
172KB

Download
memory/1084-232-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

Filesize
64KB

Download
memory/1096-234-0x0000018A6B710000-0x0000018A6B73B000-memory.dmp

Filesize
172KB

Download
memory/1096-235-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

Filesize
64KB

Download
memory/1184-238-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

Filesize
64KB

Download
memory/1184-237-0x00000284EE660000-0x00000284EE68B000-memory.dmp

Filesize
172KB

Download
memory/1248-241-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

Filesize
64KB

Download
memory/1248-240-0x000001CB1F720000-0x000001CB1F74B000-memory.dmp

Filesize
172KB

Download
memory/1288-244-0x000001FD373A0000-0x000001FD373CB000-memory.dmp

Filesize
172KB

Download
memory/1288-245-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

Filesize
64KB

Download
memory/1604-89-0x000001B243400000-0x000001B243422000-memory.dmp

Filesize
136KB

Download
memory/1684-94-0x0000000005CC0000-0x0000000005D52000-memory.dmp

Filesize
584KB

Download
memory/1684-61-0x0000000004EF0000-0x0000000004FFA000-memory.dmp

Filesize
1.0MB

Download
memory/1684-167-0x0000000006980000-0x0000000006B42000-memory.dmp

Filesize
1.8MB

Download
memory/1684-82-0x00000000061D0000-0x0000000006774000-memory.dmp

Filesize
5.6MB

Download
memory/1684-143-0x00000000060B0000-0x00000000060CE000-memory.dmp

Filesize
120KB

Download
memory/1684-132-0x0000000005D60000-0x0000000005DD6000-memory.dmp

Filesize
472KB

Download
memory/1684-181-0x0000000007860000-0x0000000007D8C000-memory.dmp

Filesize
5.2MB

Download
memory/1684-63-0x0000000004DE0000-0x0000000004E2C000-memory.dmp

Filesize
304KB

Download
memory/1684-64-0x0000000005080000-0x00000000050E6000-memory.dmp

Filesize
408KB

Download
memory/1684-38-0x0000000000270000-0x00000000002E8000-memory.dmp

Filesize
480KB

Download
memory/1684-62-0x0000000004D90000-0x0000000004DCC000-memory.dmp

Filesize
240KB

Download
memory/1684-500-0x0000000006900000-0x0000000006950000-memory.dmp

Filesize
320KB

Download
memory/1684-60-0x0000000004D30000-0x0000000004D42000-memory.dmp

Filesize
72KB

Download
memory/1684-59-0x0000000005400000-0x0000000005A18000-memory.dmp

Filesize
6.1MB

Download
memory/3192-173-0x000002446C150000-0x000002446C151000-memory.dmp

Filesize
4KB

Download
memory/3192-172-0x000002446C270000-0x000002446C6E1000-memory.dmp

Filesize
4.4MB

Download
memory/3192-171-0x000002446C270000-0x000002446C6E1000-memory.dmp

Filesize
4.4MB

Download
memory/3192-170-0x000002446C270000-0x000002446C6E1000-memory.dmp

Filesize
4.4MB

Download
memory/3192-169-0x000002446C140000-0x000002446C141000-memory.dmp

Filesize
4KB

Download
memory/4608-48-0x0000000000400000-0x0000000001BE6000-memory.dmp

Filesize
23.9MB

Download
memory/4928-166-0x00000000028C0000-0x00000000028CE000-memory.dmp

Filesize
56KB

Download
memory/4928-81-0x0000000000640000-0x00000000008FE000-memory.dmp

Filesize
2.7MB

Download
memory/4980-182-0x00007FF8B2D30000-0x00007FF8B2F25000-memory.dmp

Filesize
2.0MB

Download
memory/4980-178-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4980-183-0x00007FF8B1FC0000-0x00007FF8B207E000-memory.dmp

Filesize
760KB

Download
memory/4980-180-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4980-175-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4980-176-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4980-187-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4980-177-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download