Malware Analysis Report

2024-11-15 05:49

Sample ID 240514-a8svaacd8s
Target a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152
SHA256 a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152
Tags
rat dcrat evasion execution infostealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152

Threat Level: Known bad

The file a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152 was found to be: Known bad.

Malicious Activity Summary

rat dcrat evasion execution infostealer trojan

Dcrat family

UAC bypass

Process spawned unexpected child process

DCRat payload

DcRat

DCRat payload

Detects executables packed with SmartAssembly

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Checks computer location settings

Checks whether UAC is enabled

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

System policy modification

Uses Task Scheduler COM API

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-14 00:53

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-14 00:53

Reported

2024-05-14 00:55

Platform

win7-20240221-en

Max time kernel

108s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables packed with SmartAssembly

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Windows Defender\csrss.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Program Files (x86)\Google\Temp\RCX1807.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RCX1EF0.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\explorer.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Program Files\Windows Defender\ja-JP\wininit.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\RCX20F5.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ja-JP\RCX27DE.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Program Files\Windows Defender\ja-JP\56085415360792 C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\explorer.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Program Files (x86)\Internet Explorer\ja-JP\audiodg.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Program Files (x86)\Internet Explorer\ja-JP\42af1c969fbb7b C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\7a0fd90576e088 C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Program Files (x86)\Google\Temp\RCX1808.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Program Files\Windows Defender\ja-JP\wininit.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\csrss.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ja-JP\RCX27DF.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Program Files (x86)\Google\Temp\7a0fd90576e088 C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Program Files (x86)\Windows Defender\886983d96e3d3e C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Program Files (x86)\Google\Temp\explorer.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Program Files\Windows Defender\ja-JP\RCX1A0C.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RCX1EF1.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ja-JP\audiodg.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\RCX2163.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Program Files (x86)\Google\Temp\explorer.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Program Files\Windows Defender\ja-JP\RCX1A0D.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\ShellNew\RCX1C7F.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Windows\ShellNew\sppsvc.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Windows\DigitalLocker\de-DE\RCX2367.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Windows\DigitalLocker\de-DE\RCX2368.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Windows\ShellNew\sppsvc.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Windows\ShellNew\0a1fd5f707cd16 C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Windows\DigitalLocker\de-DE\101b941d020240 C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Windows\ShellNew\RCX1C7E.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Windows\DigitalLocker\de-DE\lsm.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Windows\DigitalLocker\de-DE\lsm.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
N/A N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1720 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1720 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Program Files\Windows Defender\ja-JP\wininit.exe
PID 1720 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Program Files\Windows Defender\ja-JP\wininit.exe
PID 1720 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Program Files\Windows Defender\ja-JP\wininit.exe
PID 2112 wrote to memory of 1980 N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe C:\Windows\System32\WScript.exe
PID 2112 wrote to memory of 1980 N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe C:\Windows\System32\WScript.exe
PID 2112 wrote to memory of 1980 N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe C:\Windows\System32\WScript.exe
PID 2112 wrote to memory of 1556 N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe C:\Windows\System32\WScript.exe
PID 2112 wrote to memory of 1556 N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe C:\Windows\System32\WScript.exe
PID 2112 wrote to memory of 1556 N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe C:\Windows\System32\WScript.exe
PID 1980 wrote to memory of 2468 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Defender\ja-JP\wininit.exe
PID 1980 wrote to memory of 2468 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Defender\ja-JP\wininit.exe
PID 1980 wrote to memory of 2468 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Defender\ja-JP\wininit.exe
PID 2468 wrote to memory of 2616 N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe C:\Windows\System32\WScript.exe
PID 2468 wrote to memory of 2616 N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe C:\Windows\System32\WScript.exe
PID 2468 wrote to memory of 2616 N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe C:\Windows\System32\WScript.exe
PID 2468 wrote to memory of 2936 N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe C:\Windows\System32\WScript.exe
PID 2468 wrote to memory of 2936 N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe C:\Windows\System32\WScript.exe
PID 2468 wrote to memory of 2936 N/A C:\Program Files\Windows Defender\ja-JP\wininit.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Defender\ja-JP\wininit.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe

"C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\Temp\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Temp\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\ja-JP\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\ja-JP\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\ja-JP\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Windows\ShellNew\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\ShellNew\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Windows\ShellNew\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Windows\DigitalLocker\de-DE\lsm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\de-DE\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Windows\DigitalLocker\de-DE\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\taskhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\audiodg.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\audiodg.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Program Files\Windows Defender\ja-JP\wininit.exe

"C:\Program Files\Windows Defender\ja-JP\wininit.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\413a7cb5-67b4-4ea0-9043-e78841d3455f.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\328c5629-bcf3-4a59-a127-5cd78f32a355.vbs"

C:\Program Files\Windows Defender\ja-JP\wininit.exe

"C:\Program Files\Windows Defender\ja-JP\wininit.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e4a79a4-97f5-4228-9d1e-19e4bc5360bc.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\235315e5-9449-4144-8b12-fcc8ec65657f.vbs"

C:\Program Files\Windows Defender\ja-JP\wininit.exe

"C:\Program Files\Windows Defender\ja-JP\wininit.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\944a39d5-f21c-4b7a-bef9-31a0bc9d583a.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6e809e3-bf87-42bd-be61-bc83425e4c22.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 a0887556.xsph.ru udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp

Files

memory/1720-0-0x000007FEF57C3000-0x000007FEF57C4000-memory.dmp

memory/1720-1-0x0000000000E40000-0x000000000117C000-memory.dmp

memory/1720-2-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

memory/1720-3-0x0000000000BE0000-0x0000000000BEE000-memory.dmp

memory/1720-4-0x0000000000BF0000-0x0000000000BFE000-memory.dmp

memory/1720-5-0x0000000000C00000-0x0000000000C08000-memory.dmp

memory/1720-6-0x0000000000DE0000-0x0000000000DFC000-memory.dmp

memory/1720-7-0x0000000000D90000-0x0000000000D98000-memory.dmp

memory/1720-8-0x0000000000E00000-0x0000000000E10000-memory.dmp

memory/1720-9-0x0000000000E10000-0x0000000000E26000-memory.dmp

memory/1720-10-0x0000000000E30000-0x0000000000E38000-memory.dmp

memory/1720-11-0x00000000026A0000-0x00000000026B0000-memory.dmp

memory/1720-12-0x0000000002680000-0x000000000268A000-memory.dmp

memory/1720-13-0x00000000026B0000-0x0000000002706000-memory.dmp

memory/1720-14-0x0000000002690000-0x000000000269C000-memory.dmp

memory/1720-15-0x0000000002700000-0x0000000002708000-memory.dmp

memory/1720-16-0x0000000002710000-0x000000000271C000-memory.dmp

memory/1720-17-0x0000000002720000-0x0000000002728000-memory.dmp

memory/1720-18-0x0000000002730000-0x0000000002742000-memory.dmp

memory/1720-19-0x0000000002740000-0x000000000274C000-memory.dmp

memory/1720-20-0x000000001AE40000-0x000000001AE4C000-memory.dmp

memory/1720-21-0x000000001AE50000-0x000000001AE5C000-memory.dmp

memory/1720-22-0x000000001AE60000-0x000000001AE6C000-memory.dmp

memory/1720-23-0x000000001AE70000-0x000000001AE78000-memory.dmp

memory/1720-24-0x000000001AE80000-0x000000001AE8A000-memory.dmp

memory/1720-25-0x000000001AE90000-0x000000001AE9E000-memory.dmp

memory/1720-27-0x000000001AEB0000-0x000000001AEBE000-memory.dmp

memory/1720-26-0x000000001AEA0000-0x000000001AEA8000-memory.dmp

memory/1720-28-0x000000001AFC0000-0x000000001AFCC000-memory.dmp

memory/1720-30-0x000000001AFE0000-0x000000001AFEA000-memory.dmp

memory/1720-29-0x000000001AFD0000-0x000000001AFD8000-memory.dmp

memory/1720-31-0x000000001AFF0000-0x000000001AFFC000-memory.dmp

memory/1720-32-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\explorer.exe

MD5 1553f67a0859a3057cde01f77db9dbc0
SHA1 2cfe40d1fea16093e16c96a35f3240b98da9a5e1
SHA256 a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152
SHA512 4ff68e4ad4299aa2ca2be8dfd1742d641cf9aee6b687f94b1e3c68062630b2e167a13550a8a184c8ff5a3df1da5b3182ebd29759a84a219af37a8688df6f0de5

C:\Program Files (x86)\Windows Defender\csrss.exe

MD5 e5bd2eb74017da8167f8190df2b5e160
SHA1 dd2339931cb2532176aa1947c3763677c8e5e0b2
SHA256 070bd4093b734e38ee715ade0573757e8933049fd737b5594ff7026c395836a1
SHA512 ce530140fd05949a3fd2878494cfc81cbd570952154b913cc8ca1dfa0e715d708ced9fde50dde70b5b8739f94430b7ebcf7c3e06f72e6b18f497d73c0817d437

memory/2968-169-0x000000001B770000-0x000000001BA52000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 87879bfc037e4d31bbc4309bec1d430f
SHA1 33d379a1946874cf41eb86cd508a6a73ce52c307
SHA256 62da0975e1527a9973e1e3504cf89a44cca5b0dc76060a7e9dfe288386afd2ac
SHA512 b70378282a1e1146009fd013b50179040f6557baa42365bc4e01dbd46a00e10ae9710d98863c84355bed0ca4419298ef49745b248ea636109afdcaa16301a703

memory/2864-175-0x0000000001F30000-0x0000000001F38000-memory.dmp

memory/2112-226-0x0000000000BE0000-0x0000000000F1C000-memory.dmp

memory/1720-227-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\413a7cb5-67b4-4ea0-9043-e78841d3455f.vbs

MD5 a9f7f6f135657dd13e62e8d4305683ac
SHA1 092bbd9563e5dad679d8098d058eea0431654b25
SHA256 c85b7ae082ac0fd2883f890ff3a81d5ce638e78732872264ba61c871653885db
SHA512 547222653c37c045af04c1871f5050fbf0b26958ed0aa5a073c6ef2a4224ccd83dbd28d286301cb0de84663d6fa0ec081ee35ed0bf001521a4f50589ca234828

C:\Users\Admin\AppData\Local\Temp\328c5629-bcf3-4a59-a127-5cd78f32a355.vbs

MD5 22c912a581a28f7ebef81ce8f813f61e
SHA1 20208a75c7c370bc2a0bf36fa3003eb8ea690aea
SHA256 8aa801d4f61c232eeb0b315ef960423059dd6f2276a4e9912313b8ff4399eaa7
SHA512 b5dc83f882f662f9469c4be3b39ba6a2d5344f67c85da9952947535dceb8d54e48926ed95b2adddb66de6d49b71b50e34bc161c23ded0cc535ebeff601b2a379

memory/2468-238-0x0000000000F70000-0x00000000012AC000-memory.dmp

memory/2468-239-0x0000000000B80000-0x0000000000B92000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2e4a79a4-97f5-4228-9d1e-19e4bc5360bc.vbs

MD5 e6641cecc7df2e5ae458afda9c4fd78a
SHA1 30df669f217fbcd40bfed4f5912524194265327a
SHA256 259bf7c565830e2589c8169f5da1913e560df5735937fa9c377f7c175261e68b
SHA512 dbbaf6ed2b85f4a3433f69b3dc35049bf4e913365bb68f0b9aa340a3b7d351337fcb9b69d6fa074f5fb83beaafd41317fb500e63b984dfa815052cbbdeb8299b

memory/1972-251-0x0000000000150000-0x000000000048C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\944a39d5-f21c-4b7a-bef9-31a0bc9d583a.vbs

MD5 1771326029e08d890f137cb3823b37ae
SHA1 2b90a83128fe95d45a535824a7d44fb6a2bba0b3
SHA256 0c0980cbf6d04742dc5f59dfbdfd84224bdd81a43843c80c8d049567a272040a
SHA512 12c147535ec289002eaa47ecbde4cfbf500b59005e1468dc8d2163d61831caf13811802f37a9e38cac695ef98422ca5210f8e21496263463fa0fa59c958883e5

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-14 00:53

Reported

2024-05-14 00:56

Platform

win10v2004-20240426-en

Max time kernel

97s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables packed with SmartAssembly

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\MSBuild\RCX381C.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Program Files (x86)\MSBuild\RuntimeBroker.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Program Files (x86)\MSBuild\RuntimeBroker.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Program Files (x86)\MSBuild\9e8d7a4ca61bd9 C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Program Files (x86)\MSBuild\RCX379E.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly\Idle.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Windows\assembly\6ccacd8608530f C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Windows\Speech\886983d96e3d3e C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Windows\assembly\RCX358A.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Windows\Speech\RCX3D41.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Windows\assembly\Idle.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File created C:\Windows\Speech\csrss.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Windows\assembly\RCX3589.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Windows\Speech\RCX3CC3.tmp C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
File opened for modification C:\Windows\Speech\csrss.exe C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3860 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 244 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 244 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3860 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Program Files (x86)\MSBuild\RuntimeBroker.exe
PID 3860 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe C:\Program Files (x86)\MSBuild\RuntimeBroker.exe
PID 1564 wrote to memory of 5348 N/A C:\Program Files (x86)\MSBuild\RuntimeBroker.exe C:\Windows\System32\WScript.exe
PID 1564 wrote to memory of 5348 N/A C:\Program Files (x86)\MSBuild\RuntimeBroker.exe C:\Windows\System32\WScript.exe
PID 1564 wrote to memory of 5396 N/A C:\Program Files (x86)\MSBuild\RuntimeBroker.exe C:\Windows\System32\WScript.exe
PID 1564 wrote to memory of 5396 N/A C:\Program Files (x86)\MSBuild\RuntimeBroker.exe C:\Windows\System32\WScript.exe
PID 5348 wrote to memory of 6020 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\MSBuild\RuntimeBroker.exe
PID 5348 wrote to memory of 6020 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\MSBuild\RuntimeBroker.exe
PID 6020 wrote to memory of 1600 N/A C:\Program Files (x86)\MSBuild\RuntimeBroker.exe C:\Windows\System32\WScript.exe
PID 6020 wrote to memory of 1600 N/A C:\Program Files (x86)\MSBuild\RuntimeBroker.exe C:\Windows\System32\WScript.exe
PID 6020 wrote to memory of 3372 N/A C:\Program Files (x86)\MSBuild\RuntimeBroker.exe C:\Windows\System32\WScript.exe
PID 6020 wrote to memory of 3372 N/A C:\Program Files (x86)\MSBuild\RuntimeBroker.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\MSBuild\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe

"C:\Users\Admin\AppData\Local\Temp\a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Windows\assembly\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\assembly\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Windows\assembly\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\Speech\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Speech\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\Speech\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Program Files (x86)\MSBuild\RuntimeBroker.exe

"C:\Program Files (x86)\MSBuild\RuntimeBroker.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a13119a6-cb34-4e8a-bdb1-bb1a4672aa93.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10a6481c-b96d-4f4e-8729-13c0b0aa586b.vbs"

C:\Program Files (x86)\MSBuild\RuntimeBroker.exe

"C:\Program Files (x86)\MSBuild\RuntimeBroker.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d416d0ac-0eea-4f36-91fb-1c6364bb88d1.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\41adea57-f8ce-4fcf-9ad5-b1ae6413810e.vbs"

C:\Program Files (x86)\MSBuild\RuntimeBroker.exe

"C:\Program Files (x86)\MSBuild\RuntimeBroker.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d1c1fe13-f769-4d85-a3c1-d63ee2899e54.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8f0c679-c47e-49bb-b864-a9f5e6cd8cc2.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 a0887556.xsph.ru udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp

Files

memory/3860-0-0x00007FF85A1F0000-0x00007FF85A4B9000-memory.dmp

memory/3860-1-0x0000000000D50000-0x000000000108C000-memory.dmp

memory/3860-2-0x00007FF85A1F0000-0x00007FF85A4B9000-memory.dmp

memory/3860-3-0x0000000003190000-0x000000000319E000-memory.dmp

memory/3860-4-0x00000000031A0000-0x00000000031AE000-memory.dmp

memory/3860-5-0x00000000031C0000-0x00000000031C8000-memory.dmp

memory/3860-6-0x00000000031D0000-0x00000000031EC000-memory.dmp

memory/3860-7-0x000000001BD80000-0x000000001BDD0000-memory.dmp

memory/3860-11-0x0000000003230000-0x0000000003238000-memory.dmp

memory/3860-12-0x0000000003250000-0x0000000003260000-memory.dmp

memory/3860-10-0x0000000003210000-0x0000000003226000-memory.dmp

memory/3860-8-0x00000000031F0000-0x00000000031F8000-memory.dmp

memory/3860-9-0x0000000003200000-0x0000000003210000-memory.dmp

memory/3860-13-0x0000000003240000-0x000000000324A000-memory.dmp

memory/3860-14-0x000000001BDD0000-0x000000001BE26000-memory.dmp

memory/3860-15-0x0000000003260000-0x000000000326C000-memory.dmp

memory/3860-16-0x0000000003280000-0x0000000003288000-memory.dmp

memory/3860-17-0x0000000003290000-0x000000000329C000-memory.dmp

memory/3860-18-0x000000001C430000-0x000000001C438000-memory.dmp

memory/3860-19-0x000000001C440000-0x000000001C452000-memory.dmp

memory/3860-20-0x000000001C9A0000-0x000000001CEC8000-memory.dmp

memory/3860-21-0x000000001C470000-0x000000001C47C000-memory.dmp

memory/3860-22-0x000000001C480000-0x000000001C48C000-memory.dmp

memory/3860-23-0x000000001C490000-0x000000001C49C000-memory.dmp

memory/3860-24-0x000000001C4A0000-0x000000001C4AC000-memory.dmp

memory/3860-26-0x000000001C5C0000-0x000000001C5CA000-memory.dmp

memory/3860-30-0x000000001C700000-0x000000001C70C000-memory.dmp

memory/3860-33-0x000000001C860000-0x000000001C86A000-memory.dmp

memory/3860-34-0x000000001C760000-0x000000001C76C000-memory.dmp

memory/3860-32-0x00007FF85A1F0000-0x00007FF85A4B9000-memory.dmp

memory/3860-31-0x000000001C710000-0x000000001C718000-memory.dmp

memory/3860-29-0x000000001C6F0000-0x000000001C6FE000-memory.dmp

memory/3860-28-0x000000001C6E0000-0x000000001C6E8000-memory.dmp

memory/3860-27-0x000000001C5D0000-0x000000001C5DE000-memory.dmp

memory/3860-25-0x000000001C5B0000-0x000000001C5B8000-memory.dmp

C:\ProgramData\csrss.exe

MD5 1553f67a0859a3057cde01f77db9dbc0
SHA1 2cfe40d1fea16093e16c96a35f3240b98da9a5e1
SHA256 a9ac10090fed177df3867fc88eda57dd852c595dde10953b7b798523e1043152
SHA512 4ff68e4ad4299aa2ca2be8dfd1742d641cf9aee6b687f94b1e3c68062630b2e167a13550a8a184c8ff5a3df1da5b3182ebd29759a84a219af37a8688df6f0de5

C:\Program Files (x86)\MSBuild\RuntimeBroker.exe

MD5 187dcfceeb378fabb5a2aad4f5f4be22
SHA1 8e031b914505e24bf50808bf45640db0fc7300c1
SHA256 d8e395612d1acd4475f13c2bdf076daadd8755e4753ee0d675d8683ee6ffa7ec
SHA512 c9bb1c7f5f4399d4e473b297c630880665c55f59c86751b1622f71895b75e6348343931e72ffba5076391ffa890307018c9a64ce9e098dad3f7cc44168233c39

C:\Windows\Speech\csrss.exe

MD5 1cdc3fecb9ac2859c93c125102afef44
SHA1 c07ec6f2b971f6fa84ddffada072aa84b873fb3c
SHA256 bc97f05e303f67abcb26fbb4d39c246a59e01de044f1d8d8835c623906b16e82
SHA512 f64960533fa553e059ea325019fe9a53c4e5035e4fbf63fe99c270d1a20e74e719c95ec7eb3f95ea7263673570e3c77eee230f453fe1781c78ccf96d8496e65a

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3smyilil.xso.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/244-170-0x0000017C34080000-0x0000017C340A2000-memory.dmp

memory/3860-267-0x00007FF85A1F0000-0x00007FF85A4B9000-memory.dmp

memory/1564-268-0x0000000000170000-0x00000000004AC000-memory.dmp

memory/1564-269-0x000000001CCA0000-0x000000001CCF6000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3a6bad9528f8e23fb5c77fbd81fa28e8
SHA1 f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512 846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e243a38635ff9a06c87c2a61a2200656
SHA1 ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256 af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA512 4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 aaaac7c68d2b7997ed502c26fd9f65c2
SHA1 7c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA256 8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512 c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

C:\Users\Admin\AppData\Local\Temp\a13119a6-cb34-4e8a-bdb1-bb1a4672aa93.vbs

MD5 19c1fcd252674fd7cf28f536b6f5c11e
SHA1 c5d6f6b2e51da7da9b3e3eabb14a729277b36190
SHA256 0d342e0b1dab756e58daa0a3e277512210c8f653671894c9139bd8a09faf8859
SHA512 f77d9801506ca08fc23c5292f02c4dbf2582256a1f3a96ee4371af929d5c18772f798bcf7ef07b5be8cd3a71cb7f332e2873700fefe87c8df98b8d0fe7171011

C:\Users\Admin\AppData\Local\Temp\10a6481c-b96d-4f4e-8729-13c0b0aa586b.vbs

MD5 cb047628993dc2a9aa715f03246b20bd
SHA1 fd19901ddd1b86fffdfbe210006c7b4f7b936ff6
SHA256 90ec599be14b52091c840f766134c4f9c2e4bf995f71a74e9f9b8d75027767b4
SHA512 49089cc671bc57a44a75dc71a3f649bf69341f46640aabeb98ef2cd13d4af8aef6f3f4ccab5af7ebd07ee99f781325538db75680c3bcbf69303495cc952bc48b

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

MD5 49b64127208271d8f797256057d0b006
SHA1 b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
SHA512 f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

C:\Users\Admin\AppData\Local\Temp\d416d0ac-0eea-4f36-91fb-1c6364bb88d1.vbs

MD5 d87dce8d8a944d2f069916173b606f06
SHA1 986d7ea0d2028374053c8dbeb073c581efef67e4
SHA256 c6d88aaa3d6ad6f988da81c9573a10e30fac6d096aff8789144cb933e1be62d6
SHA512 d2b3189f0e88f3a272886c7ef88795e93fa2419369cc08cc8b7486884fe1c66ad73d90a92e3fe5ad7c860cd5caa453a0af2946eb61c5874edcbfa8909be4c987

C:\Users\Admin\AppData\Local\Temp\d1c1fe13-f769-4d85-a3c1-d63ee2899e54.vbs

MD5 5f078c351854e4a04c88612b5089e73e
SHA1 40d2840eaef945b81101e5b865704c5453bc344d
SHA256 cfc58c8c315454084d39a66abf3ba3cd144b2a8490b64b3193ba648b7734f6c5
SHA512 309cd7c295ae5e4c525ca2edf1efaf21cfb64609728300312cbb9e6ad853f316183fbbcea1d1601818e69d14cf8ceb8e3919323e72cb9bbd032858f06f1faada