dcrat | 9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64

Analysis

max time kernel
148s
max time network
144s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 01:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
Size

1.7MB
MD5

b244f673168b94dfbd0c4120790db0c1
SHA1

504ae2d279ef5640bd6a91729a856f6f62744756
SHA256

9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64
SHA512

37ac77251f3f776483e0cbfec920365e4916c2f8f9cd115e72c485cedd6975af5ee6eb8edad86837beceeebe633776ea1e8782b3e4209c78490ec2d221485a94
SSDEEP

49152:ZTNFXGRlxp2vui7e4E/wcimfuUx8+iUI:ZT+Rl6vHXE/O6uUx8+iN

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1316	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2596	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	2596	schtasks.exe	28

UAC bypass 3 TTPs 45 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2248-1-0x0000000000100000-0x00000000002B0000-memory.dmp	dcrat
behavioral1/files/0x0006000000016c5d-26.dat	dcrat
behavioral1/files/0x0007000000016d44-99.dat	dcrat
behavioral1/memory/2060-172-0x00000000012E0000-0x0000000001490000-memory.dmp	dcrat
behavioral1/memory/2636-195-0x00000000012F0000-0x00000000014A0000-memory.dmp	dcrat
behavioral1/memory/2036-263-0x0000000001370000-0x0000000001520000-memory.dmp	dcrat
behavioral1/memory/1632-298-0x0000000001390000-0x0000000001540000-memory.dmp	dcrat
behavioral1/memory/2884-310-0x0000000000340000-0x00000000004F0000-memory.dmp	dcrat
behavioral1/memory/1948-322-0x0000000000A20000-0x0000000000BD0000-memory.dmp	dcrat

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral1/memory/2248-5-0x00000000003B0000-0x00000000003C0000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/2248-7-0x00000000003E0000-0x00000000003EA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/2248-12-0x0000000000810000-0x000000000081A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/2248-14-0x0000000002340000-0x000000000234C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/2248-16-0x0000000002360000-0x000000000236A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1956	powershell.exe
1476	powershell.exe
904	powershell.exe
356	powershell.exe
1616	powershell.exe
1372	powershell.exe
1328	powershell.exe
1304	powershell.exe
332	powershell.exe
1288	powershell.exe
1940	powershell.exe

Executes dropped EXE 14 IoCs

pid	Process
2060	lsass.exe
348	lsass.exe
2636	lsass.exe
1656	lsass.exe
892	lsass.exe
2444	lsass.exe
1004	lsass.exe
2884	lsass.exe
2036	lsass.exe
1928	lsass.exe
2580	lsass.exe
1632	lsass.exe
2884	lsass.exe
1948	lsass.exe

Checks whether UAC is enabled 1 TTPs 30 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\taskhost.exe	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
File created	C:\Program Files\Windows Media Player\b75386f1303e64	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
File opened for modification	C:\Program Files\Windows Media Player\RCX3185.tmp	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
File opened for modification	C:\Program Files\Windows Media Player\taskhost.exe	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Vss\Writers\Idle.exe	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
File created	C:\Windows\Vss\Writers\6ccacd8608530f	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
File created	C:\Windows\Help\OEM\886983d96e3d3e	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
File opened for modification	C:\Windows\Resources\RCX2AFD.tmp	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
File opened for modification	C:\Windows\Resources\lsass.exe	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
File created	C:\Windows\Resources\lsass.exe	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
File created	C:\Windows\Resources\6203df4a6bafc7	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
File created	C:\Windows\Help\OEM\csrss.exe	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
File opened for modification	C:\Windows\Vss\Writers\RCX24F1.tmp	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
File opened for modification	C:\Windows\Vss\Writers\Idle.exe	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
File opened for modification	C:\Windows\Help\OEM\RCX33F6.tmp	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
File opened for modification	C:\Windows\Help\OEM\csrss.exe	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2752	schtasks.exe
1292	schtasks.exe
2776	schtasks.exe
1620	schtasks.exe
2148	schtasks.exe
3024	schtasks.exe
1040	schtasks.exe
2304	schtasks.exe
1316	schtasks.exe
1252	schtasks.exe
1992	schtasks.exe
2664	schtasks.exe
2788	schtasks.exe
2204	schtasks.exe
2840	schtasks.exe
2772	schtasks.exe
1928	schtasks.exe
3064	schtasks.exe
2568	schtasks.exe
2808	schtasks.exe
1764	schtasks.exe
2904	schtasks.exe
2056	schtasks.exe
2708	schtasks.exe
2948	schtasks.exe
2824	schtasks.exe
1200	schtasks.exe
1920	schtasks.exe
1424	schtasks.exe
2488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
904	powershell.exe
1476	powershell.exe
1328	powershell.exe
1956	powershell.exe
356	powershell.exe
1940	powershell.exe
332	powershell.exe
1372	powershell.exe
1288	powershell.exe
1616	powershell.exe
1304	powershell.exe
2060	lsass.exe
348	lsass.exe
2636	lsass.exe
1656	lsass.exe
892	lsass.exe
2444	lsass.exe
1004	lsass.exe
2884	lsass.exe
2036	lsass.exe
1928	lsass.exe
2580	lsass.exe
1632	lsass.exe
2884	lsass.exe
1948	lsass.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
Token: SeDebugPrivilege	904	powershell.exe
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	356	powershell.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeDebugPrivilege	332	powershell.exe
Token: SeDebugPrivilege	1372	powershell.exe
Token: SeDebugPrivilege	1288	powershell.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	1304	powershell.exe
Token: SeDebugPrivilege	2060	lsass.exe
Token: SeDebugPrivilege	348	lsass.exe
Token: SeDebugPrivilege	2636	lsass.exe
Token: SeDebugPrivilege	1656	lsass.exe
Token: SeDebugPrivilege	892	lsass.exe
Token: SeDebugPrivilege	2444	lsass.exe
Token: SeDebugPrivilege	1004	lsass.exe
Token: SeDebugPrivilege	2884	lsass.exe
Token: SeDebugPrivilege	2036	lsass.exe
Token: SeDebugPrivilege	1928	lsass.exe
Token: SeDebugPrivilege	2580	lsass.exe
Token: SeDebugPrivilege	1632	lsass.exe
Token: SeDebugPrivilege	2884	lsass.exe
Token: SeDebugPrivilege	1948	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1328	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	59
PID 2248 wrote to memory of 1328	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	59
PID 2248 wrote to memory of 1328	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	59
PID 2248 wrote to memory of 1956	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	60
PID 2248 wrote to memory of 1956	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	60
PID 2248 wrote to memory of 1956	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	60
PID 2248 wrote to memory of 1940	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	61
PID 2248 wrote to memory of 1940	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	61
PID 2248 wrote to memory of 1940	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	61
PID 2248 wrote to memory of 1372	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	63
PID 2248 wrote to memory of 1372	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	63
PID 2248 wrote to memory of 1372	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	63
PID 2248 wrote to memory of 1616	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	64
PID 2248 wrote to memory of 1616	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	64
PID 2248 wrote to memory of 1616	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	64
PID 2248 wrote to memory of 1476	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	66
PID 2248 wrote to memory of 1476	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	66
PID 2248 wrote to memory of 1476	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	66
PID 2248 wrote to memory of 356	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	67
PID 2248 wrote to memory of 356	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	67
PID 2248 wrote to memory of 356	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	67
PID 2248 wrote to memory of 1304	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	69
PID 2248 wrote to memory of 1304	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	69
PID 2248 wrote to memory of 1304	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	69
PID 2248 wrote to memory of 1288	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	70
PID 2248 wrote to memory of 1288	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	70
PID 2248 wrote to memory of 1288	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	70
PID 2248 wrote to memory of 332	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	71
PID 2248 wrote to memory of 332	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	71
PID 2248 wrote to memory of 332	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	71
PID 2248 wrote to memory of 904	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	72
PID 2248 wrote to memory of 904	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	72
PID 2248 wrote to memory of 904	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	72
PID 2248 wrote to memory of 1508	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	81
PID 2248 wrote to memory of 1508	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	81
PID 2248 wrote to memory of 1508	2248	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe	81
PID 1508 wrote to memory of 2676	1508	cmd.exe	83
PID 1508 wrote to memory of 2676	1508	cmd.exe	83
PID 1508 wrote to memory of 2676	1508	cmd.exe	83
PID 1508 wrote to memory of 2060	1508	cmd.exe	84
PID 1508 wrote to memory of 2060	1508	cmd.exe	84
PID 1508 wrote to memory of 2060	1508	cmd.exe	84
PID 2060 wrote to memory of 264	2060	lsass.exe	85
PID 2060 wrote to memory of 264	2060	lsass.exe	85
PID 2060 wrote to memory of 264	2060	lsass.exe	85
PID 2060 wrote to memory of 1076	2060	lsass.exe	86
PID 2060 wrote to memory of 1076	2060	lsass.exe	86
PID 2060 wrote to memory of 1076	2060	lsass.exe	86
PID 264 wrote to memory of 348	264	WScript.exe	87
PID 264 wrote to memory of 348	264	WScript.exe	87
PID 264 wrote to memory of 348	264	WScript.exe	87
PID 348 wrote to memory of 620	348	lsass.exe	88
PID 348 wrote to memory of 620	348	lsass.exe	88
PID 348 wrote to memory of 620	348	lsass.exe	88
PID 348 wrote to memory of 2028	348	lsass.exe	89
PID 348 wrote to memory of 2028	348	lsass.exe	89
PID 348 wrote to memory of 2028	348	lsass.exe	89
PID 620 wrote to memory of 2636	620	WScript.exe	90
PID 620 wrote to memory of 2636	620	WScript.exe	90
PID 620 wrote to memory of 2636	620	WScript.exe	90
PID 2636 wrote to memory of 2200	2636	lsass.exe	91
PID 2636 wrote to memory of 2200	2636	lsass.exe	91
PID 2636 wrote to memory of 2200	2636	lsass.exe	91
PID 2636 wrote to memory of 2104	2636	lsass.exe	92

System policy modification 1 TTPs 45 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe
"C:\Users\Admin\AppData\Local\Temp\9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Vss\Writers\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Resources\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\taskhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Help\OEM\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AFF5hliR7g.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2676
- - C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe
    "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2060
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04b2823b-b194-456b-aeb7-173afa633f56.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:264
    - - C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:348
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d11ba26b-4933-4562-bc04-d6c9ffd2b3ae.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:620
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2636
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f50e57a-a135-4259-94db-fcc8c5acb4bd.vbs"
        8⤵
        
        PID:2200
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe"
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1656
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eba172d5-ae07-446c-a51c-d53a414f594d.vbs"
        10⤵
        
        PID:2896
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe"
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:892
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e9df990-6ee5-49cf-bf9e-d2b64d4cef69.vbs"
        12⤵
        
        PID:2248
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe"
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e6f72e65-069d-4105-9a90-374c53e8ebb6.vbs"
        14⤵
        
        PID:1944
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe"
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1004
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\093cb249-9c92-4fc5-a44b-c938acd84eaf.vbs"
        16⤵
        
        PID:2572
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe"
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\791c4edb-89e3-4e11-b368-7ad96592eab3.vbs"
        18⤵
        
        PID:1956
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe"
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0fb2bb95-b6ee-486c-ba90-ce26d667aa8f.vbs"
        20⤵
        
        PID:1360
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe"
        21⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1928
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9b5214a7-01a5-4ce9-b959-4ad57d3aa1c5.vbs"
        22⤵
        
        PID:2844
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe"
        23⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2580
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\613d7958-e214-4eda-b690-e3aad559e623.vbs"
        24⤵
        
        PID:2604
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe"
        25⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1632
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2c3c2a91-af01-44aa-8682-d25dbc135aee.vbs"
        26⤵
        
        PID:2308
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe"
        27⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0fee3d53-b82b-40bc-9964-2e75eaa90ea4.vbs"
        28⤵
        
        PID:764
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe"
        29⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c1cc3ed6-25d9-4d7e-8b5f-99c6f562ef5b.vbs"
        30⤵
        
        PID:1740
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05df3311-bb1c-43cc-93de-ebccb199cf64.vbs"
        30⤵
        
        PID:2544
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78e5eca0-1d60-4b50-beed-3b6dd21cc389.vbs"
        28⤵
        
        PID:2504
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cb4ac21c-91f7-4310-8f0d-bcc02bc748d0.vbs"
        26⤵
        
        PID:1984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2580e6f5-68c1-4a07-b5d6-03550be1fb06.vbs"
        24⤵
        
        PID:2660
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d65d151-3154-44b0-9b51-41d7b0d33e23.vbs"
        22⤵
        
        PID:1756
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\768dc9d9-4a72-4807-9ad0-b27e7c5ed284.vbs"
        20⤵
        
        PID:2448
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\06a3b784-1082-4880-b71c-3c2f073005a7.vbs"
        18⤵
        
        PID:2232
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fca86325-20c3-4908-9a62-271bcff903ef.vbs"
        16⤵
        
        PID:1228
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2abcb4af-ca17-4eb6-8adc-fb7f8646c7ab.vbs"
        14⤵
        
        PID:1696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62136ba5-ecf4-4b47-8dc0-76d2d620c30a.vbs"
        12⤵
        
        PID:2784
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\859be087-e026-4fc7-9207-74b3c9e232fc.vbs"
        10⤵
        
        PID:3000
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3398dd94-332a-475c-a320-2238214d2d1b.vbs"
        8⤵
        
        PID:2104
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3baaa3aa-cd49-46c6-932d-482720fd9811.vbs"
        6⤵
        
        PID:2028
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\68d747ab-e2cd-4bdf-a326-97595606517b.vbs"
      4⤵
      PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Windows\Vss\Writers\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\Vss\Writers\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Default\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\Default\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Windows\Resources\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Resources\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\Resources\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Downloads\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Public\Downloads\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Downloads\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Media Player\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\Help\OEM\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Help\OEM\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\Help\OEM\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe

Filesize
1.7MB

MD5
b244f673168b94dfbd0c4120790db0c1

SHA1
504ae2d279ef5640bd6a91729a856f6f62744756

SHA256
9697dd9c108c9d9bd2a67091f18650bb790d7ecce4f51c6f83aa5e4365b45d64

SHA512
37ac77251f3f776483e0cbfec920365e4916c2f8f9cd115e72c485cedd6975af5ee6eb8edad86837beceeebe633776ea1e8782b3e4209c78490ec2d221485a94

Download Submit
C:\Program Files\Windows Media Player\taskhost.exe

Filesize
1.7MB

MD5
06f0070d3588cf6ed4bf34ba0d784ed1

SHA1
f3dc63b2212e62df1bab79170abb5695f65b4272

SHA256
ba4a91d7f8c835934fb5347e47b3c1d908db79857d94ae958fd828dbc5d82dca

SHA512
16c0186e092e4e863d26c8d47dc0e4cad27fa98d2eb21fca4dd36e25b366606ca50fb2c67034ac1c45833d756c8c2523fbafdd920e23316fa1dcd264de7492d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\04b2823b-b194-456b-aeb7-173afa633f56.vbs

Filesize
748B

MD5
5488a03aca6dbbe13af45b2b5878ed18

SHA1
34236511bf427504cbf2e04bda405fbcea1ef304

SHA256
b1c06033c644e9aa0e8034d98caa17305a4392a23cf29dcdc31bc72af110d68c

SHA512
b66c1124ea11f57e9b717102f012234872b518b401f30bde5a4eab1658050d029f22b78eac9415f2a2cad2d66f6d5877db7800051a72fe4518ee534905a2f429

Download Submit
C:\Users\Admin\AppData\Local\Temp\093cb249-9c92-4fc5-a44b-c938acd84eaf.vbs

Filesize
748B

MD5
6d17e4e9740f4d7854caa0890074da79

SHA1
3f3e2fb71ad5017b536239896aa62cf6620249bf

SHA256
275df000e1547e331d3741212d6fd9add0f9eefb2a5b9babe94cca436961aabe

SHA512
86786aa91e8f069788c9df9bf4c17e2b461ed8d631c3a25818348249bbc34fc9b9e888f22bfc4c0b9a8ecb500dba31b928fb91aee064d8d738e196ceaf5e1cee

Download Submit
C:\Users\Admin\AppData\Local\Temp\0fb2bb95-b6ee-486c-ba90-ce26d667aa8f.vbs

Filesize
748B

MD5
766595d8eab74f73c2a5d6f56ade410c

SHA1
9cb823b872a8cfb672383b514f20c6094493e32c

SHA256
ba95d23116f8e838f8d40946c4ba97b8ed8695161b96b6a8af9ddd76f8d3959a

SHA512
65e4f97d04eaa3652eb8541ca2bbcd14301fb14a963aa4f9a112c81e9059977d8ad4fc07721b5d465a111303d7156eadae2e8e589c15de4cd64278b453572f6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2c3c2a91-af01-44aa-8682-d25dbc135aee.vbs

Filesize
748B

MD5
a3c5c7a5e7bef542830ce2ddfe25564f

SHA1
b59eaca474ed0938e45f1c3ff46858f0b23adb1f

SHA256
5d4304e06f0cd7388a598971a7e99c760b4b9223842aa1edd6edef59143c9109

SHA512
9b34cffb789eb5ff972841d48e680a58f06ff753b077da9a70e86b7fe62c5fbcead3a03bda849e22c95362131afcb9d1d317d4db0d2b86e1da2ad0d282f2f7c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\4f50e57a-a135-4259-94db-fcc8c5acb4bd.vbs

Filesize
748B

MD5
23adbb3f878c32f48548b671cb52db78

SHA1
f04085af3f364a48acab26f84bfdb797f7a6d367

SHA256
1223bfd00a89bdeb65dee7ba2458c4bdde3420ec4023912d3250598c50e3901f

SHA512
b92405c436e55d910eac01264f9ca2fa05095b5349d61d94211a5658e828955dcca697d566b1638fe8c99a0b4bee69a48004f04434d412c366cb8336afbd83b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\613d7958-e214-4eda-b690-e3aad559e623.vbs

Filesize
748B

MD5
a0fab8242727c949fb568dfcf926dad6

SHA1
da1854eab87a3ca5ff0af0d3ba54340752c0055d

SHA256
7abee378484388f474007dd5c0ccde88d67ee645a2f0bdbcec0f26acb53f08e2

SHA512
ba2c56ab0057b51cfded28963c6dd8297cbbbf25304f7e0b2bc1383e88c092f602c71a24c0caaa784e3f82828ad09fb3beff77fbb1c527c52d063535418417d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\68d747ab-e2cd-4bdf-a326-97595606517b.vbs

Filesize
524B

MD5
54a468f69a794de52fac828c2553a6af

SHA1
31cb8e749ac8a312c7bac338b8af74bc5e9722f6

SHA256
6a1df4045ccd9e3fc06c7de44975f9a5be774948abefc7cf8fd0795af114dffe

SHA512
595581bbd159c821bec308da3ef7b27a79de50800af9e69e538e2c8df7d314013020691d892d1b1b5cf7c3e4077e22c1288d574bde26a987780633e79a0b01ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\791c4edb-89e3-4e11-b368-7ad96592eab3.vbs

Filesize
748B

MD5
b5230970b847213f64875f7fba0ed173

SHA1
1fac2ceb73dcab053fd9c6185cb07081ccee7f14

SHA256
2fdd66d498ba8a70b667b516ca98fb4a969cd6fb8e2de4f110b6f32fa06b1133

SHA512
9ef6fd716ea4d5ad00552c37588fcff050952de7026331249814a3782b6c710b6ad2916a57a45887debd59d26f8e9f6e9fc5025ebebb3e99556c5969f1c0e2d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7e9df990-6ee5-49cf-bf9e-d2b64d4cef69.vbs

Filesize
747B

MD5
9a25b461806157695c919738a37c28d2

SHA1
ffa8e2e2301333e5650cb6b53aa066c6661d746f

SHA256
29b02e0fa77de1230b91aeab62732bf48360760e70ee2f72ac033e3f77b0629f

SHA512
90023aea0a946acabca55c70cd4e0902669c8e4da224f04610d73e38d7c132050d1000c370cb8bdd96aff3e2f86541898636eaf94f617d5f6884bc4f5baa4322

Download Submit
C:\Users\Admin\AppData\Local\Temp\9b5214a7-01a5-4ce9-b959-4ad57d3aa1c5.vbs

Filesize
748B

MD5
c592bfd9f2ecb2b314bbfef91536da8b

SHA1
a8ba7a0cbec7f0ef28286e7fb5c4a5420290c0f4

SHA256
28b2ec2d884fdcefc0a18632e36c538f9f2c35bcf2e63099fe57b307a893609c

SHA512
876de67bffb47fddfc16260813c02a930bf3b5c008b4031b11985d39a23a9bac2db007ffd55cdfeeae2a327e90150fa44ee06a8263bf96b689668390c095899a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AFF5hliR7g.bat

Filesize
237B

MD5
11ba1a47d4815c1d6bbf547978b784ab

SHA1
92e5aeb56e63bb29dac5a99d906ec8d95af2d008

SHA256
be4ca71c65e8e0f6a09c6a5139910b5268a2341bfa500601150c5b81b8193ce8

SHA512
10c60d381dade067256c29235d4fc4efa5424c5def4193473f1dac206b72a3c5ab19b982ef667ffaea54407f624fa311f317f79dbc941bbe22119c94f1f8c1fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\d11ba26b-4933-4562-bc04-d6c9ffd2b3ae.vbs

Filesize
747B

MD5
5e29724014efe866468cca394701934b

SHA1
256377fa6adf54769b26c90b9c1846f68780adf9

SHA256
9e2907c9199eb858e3d63c935d490a80b67fc2d5ab095a032e32b91748f2a7cc

SHA512
5200d798a84802c381ba671e437a3162a211048d46f37b945f0a3e41e2b577ada1ec5f47b9afa1fa97986554d3b38cef632af1744ded50f5a549fafe0b1c1617

Download Submit
C:\Users\Admin\AppData\Local\Temp\e6f72e65-069d-4105-9a90-374c53e8ebb6.vbs

Filesize
748B

MD5
b888caf087ea2022d5e1a0f8844c7492

SHA1
5e9d230b32e13c2e86edd47aece11550d199f89d

SHA256
e94e0ef0f48bb08db94db3958d2ec8bcc7a2105a2e04c499b56d38039bc0d221

SHA512
4d05fb14012f12e3b4384c077a54133ecad4bc8dcd4e1a9d0a1448aebcd5e4b728aad17ab5618ad8e4bf2f0aef5c1a748cf82ab51e8844015963ac38107c35e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\eba172d5-ae07-446c-a51c-d53a414f594d.vbs

Filesize
748B

MD5
1e43276f7afd5dc79829d61ac5c39748

SHA1
09f4c185f2d8f87a3975af6e4b3ba0670245db5b

SHA256
ed0c0d66fd73e7b6e6846efa112c074a5be663ae108d3b5cb68780238fafd2c8

SHA512
cf15b976810de7d3360bd3259308aaf014b3afaf6e390bb033029971398e7de9bba67b330fbd073be7c0eaf72c9d301310f4283b24ee9c715a1eaa71d3c515d9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b4ea32dd4dddaa7cbf9bbad56c441a9

SHA1
97ba53f26f72502d781f04bf7947a61aad47810b

SHA256
38bd12b58c90a7b767b334453938e27f61ba56c197399c911d19ce1df0673648

SHA512
5e9694ad0b10610e8e7604160866b97e90c6dd232aca7932af852ec09ba24452f52b81645f58a26bd68961cd7661e82f21ba5d20599c7f473c66b47870e6b0db

Download Submit
memory/1328-131-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/1476-143-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/1632-298-0x0000000001390000-0x0000000001540000-memory.dmp

Filesize
1.7MB

Download
memory/1948-322-0x0000000000A20000-0x0000000000BD0000-memory.dmp

Filesize
1.7MB

Download
memory/2036-263-0x0000000001370000-0x0000000001520000-memory.dmp

Filesize
1.7MB

Download
memory/2060-172-0x00000000012E0000-0x0000000001490000-memory.dmp

Filesize
1.7MB

Download
memory/2060-173-0x0000000000460000-0x0000000000472000-memory.dmp

Filesize
72KB

Download
memory/2248-9-0x00000000007A0000-0x00000000007B2000-memory.dmp

Filesize
72KB

Download
memory/2248-3-0x0000000000370000-0x000000000038C000-memory.dmp

Filesize
112KB

Download
memory/2248-163-0x000007FEF6090000-0x000007FEF6A7C000-memory.dmp

Filesize
9.9MB

Download
memory/2248-13-0x0000000000820000-0x000000000082E000-memory.dmp

Filesize
56KB

Download
memory/2248-12-0x0000000000810000-0x000000000081A000-memory.dmp

Filesize
40KB

Download
memory/2248-11-0x0000000000800000-0x0000000000808000-memory.dmp

Filesize
32KB

Download
memory/2248-16-0x0000000002360000-0x000000000236A000-memory.dmp

Filesize
40KB

Download
memory/2248-10-0x00000000007F0000-0x00000000007FC000-memory.dmp

Filesize
48KB

Download
memory/2248-17-0x0000000002370000-0x000000000237C000-memory.dmp

Filesize
48KB

Download
memory/2248-8-0x00000000005F0000-0x00000000005F8000-memory.dmp

Filesize
32KB

Download
memory/2248-7-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download
memory/2248-6-0x00000000003C0000-0x00000000003D6000-memory.dmp

Filesize
88KB

Download
memory/2248-1-0x0000000000100000-0x00000000002B0000-memory.dmp

Filesize
1.7MB

Download
memory/2248-5-0x00000000003B0000-0x00000000003C0000-memory.dmp

Filesize
64KB

Download
memory/2248-0-0x000007FEF6093000-0x000007FEF6094000-memory.dmp

Filesize
4KB

Download
memory/2248-4-0x0000000000390000-0x0000000000398000-memory.dmp

Filesize
32KB

Download
memory/2248-14-0x0000000002340000-0x000000000234C000-memory.dmp

Filesize
48KB

Download
memory/2248-15-0x0000000002350000-0x0000000002358000-memory.dmp

Filesize
32KB

Download
memory/2248-2-0x000007FEF6090000-0x000007FEF6A7C000-memory.dmp

Filesize
9.9MB

Download
memory/2580-286-0x0000000000360000-0x0000000000372000-memory.dmp

Filesize
72KB

Download
memory/2636-195-0x00000000012F0000-0x00000000014A0000-memory.dmp

Filesize
1.7MB

Download
memory/2884-251-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download
memory/2884-310-0x0000000000340000-0x00000000004F0000-memory.dmp

Filesize
1.7MB

Download