dcrat | de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3

Analysis

max time kernel
130s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
Size 1.0MB
Sample240526-eeattsef32
SHA256 de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3
MD5 1a5dd417abbc79ae58ab38ee99bedc25
SHA1 8ed0830ac848cb1b952a5c5473faff69a6b3b9e9
SHA512 0306a310f0584aaad45806eeeaefe715f2092df4650b3a331d7762fa1676fe436e45be014577d19760cf5bbc409543def1430012401d500cf5ff2156fde680c3
SSDEEP 12288:PubxAa9sUFxZ8oq7URPvyKBozWeL+vSgmtjJcDVrCTZSXlVB0mGEB0aNN/cPUeWl:Q9sUFxZq7URPt6RL6nBrEZUjGE/L8YZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5764	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5804	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5584	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5400	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5232	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3792	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5288	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3628	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5788	2084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5660	2084	schtasks.exe	82

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sppsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sppsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sppsvc.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/5072-1-0x00000000007B0000-0x00000000008C2000-memory.dmp	dcrat
behavioral2/files/0x0007000000023400-18.dat	dcrat
behavioral2/files/0x0004000000022aa2-124.dat	dcrat

Detects executables packed with SmartAssembly 3 IoCs

resource	yara_rule
behavioral2/memory/5072-4-0x0000000000FB0000-0x0000000000FC0000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5072-5-0x0000000001220000-0x000000000122A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5072-6-0x0000000001230000-0x000000000123C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5504	powershell.exe
1596	powershell.exe
2056	powershell.exe
1548	powershell.exe
1460	powershell.exe
4124	powershell.exe
2740	powershell.exe
5792	powershell.exe
4204	powershell.exe
732	powershell.exe
5556	powershell.exe
1320	powershell.exe
1600	powershell.exe
1004	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe

Executes dropped EXE 1 IoCs

pid	Process
3228	sppsvc.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sppsvc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sppsvc.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\RuntimeBroker.exe	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\es-ES\9e8d7a4ca61bd9	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File opened for modification	C:\Program Files\WindowsPowerShell\TextInputHost.exe	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File opened for modification	C:\Program Files\dotnet\swidtag\sppsvc.exe	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\es-ES\RuntimeBroker.exe	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\RCX454C.tmp	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File created	C:\Program Files\Microsoft Office\sppsvc.exe	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File opened for modification	C:\Program Files\dotnet\swidtag\RCX3AA8.tmp	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File opened for modification	C:\Program Files\dotnet\RCX4955.tmp	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File created	C:\Program Files\dotnet\swidtag\0a1fd5f707cd16	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File created	C:\Program Files\dotnet\sihost.exe	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File created	C:\Program Files\dotnet\66fc9ff0ee96c2	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File opened for modification	C:\Program Files\Uninstall Information\MusNotification.exe	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File opened for modification	C:\Program Files\Microsoft Office\RCX4F63.tmp	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File created	C:\Program Files\dotnet\swidtag\sppsvc.exe	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\StartMenuExperienceHost.exe	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File opened for modification	C:\Program Files\dotnet\sihost.exe	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File created	C:\Program Files\Uninstall Information\aa97147c4c782d	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File created	C:\Program Files\WindowsPowerShell\TextInputHost.exe	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File opened for modification	C:\Program Files\WindowsPowerShell\RCX4D5F.tmp	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\es-ES\RCX40C6.tmp	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File created	C:\Program Files (x86)\Internet Explorer\es-ES\RuntimeBroker.exe	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File created	C:\Program Files (x86)\WindowsPowerShell\StartMenuExperienceHost.exe	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File created	C:\Program Files\Uninstall Information\MusNotification.exe	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File opened for modification	C:\Program Files\Uninstall Information\RCX4B5A.tmp	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File opened for modification	C:\Program Files\Microsoft Office\sppsvc.exe	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File created	C:\Program Files (x86)\WindowsPowerShell\55b276f4edf653	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File created	C:\Program Files\WindowsPowerShell\22eafd247d37c3	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File created	C:\Program Files\Microsoft Office\0a1fd5f707cd16	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ModemLogs\sppsvc.exe	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File created	C:\Windows\ModemLogs\0a1fd5f707cd16	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File opened for modification	C:\Windows\ModemLogs\RCX4751.tmp	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
File opened for modification	C:\Windows\ModemLogs\sppsvc.exe	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2412	schtasks.exe
4952	schtasks.exe
1896	schtasks.exe
5788	schtasks.exe
5584	schtasks.exe
5104	schtasks.exe
4996	schtasks.exe
4892	schtasks.exe
4512	schtasks.exe
1904	schtasks.exe
2316	schtasks.exe
2732	schtasks.exe
1440	schtasks.exe
4816	schtasks.exe
1016	schtasks.exe
5764	schtasks.exe
5076	schtasks.exe
3164	schtasks.exe
2012	schtasks.exe
2216	schtasks.exe
4604	schtasks.exe
3300	schtasks.exe
4900	schtasks.exe
5804	schtasks.exe
4812	schtasks.exe
1888	schtasks.exe
5288	schtasks.exe
536	schtasks.exe
4048	schtasks.exe
4388	schtasks.exe
5232	schtasks.exe
4472	schtasks.exe
4212	schtasks.exe
4016	schtasks.exe
3628	schtasks.exe
5660	schtasks.exe
3120	schtasks.exe
5400	schtasks.exe
3792	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
4124	powershell.exe
4124	powershell.exe
1548	powershell.exe
1548	powershell.exe
1320	powershell.exe
1596	powershell.exe
1596	powershell.exe
1320	powershell.exe
4204	powershell.exe
4204	powershell.exe
732	powershell.exe
732	powershell.exe
1600	powershell.exe
1600	powershell.exe
2740	powershell.exe
2740	powershell.exe
1460	powershell.exe
1460	powershell.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	732	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeDebugPrivilege	5792	powershell.exe
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	1460	powershell.exe
Token: SeDebugPrivilege	5504	powershell.exe
Token: SeDebugPrivilege	5556	powershell.exe
Token: SeDebugPrivilege	3228	sppsvc.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 5556	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	131
PID 5072 wrote to memory of 5556	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	131
PID 5072 wrote to memory of 5504	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	132
PID 5072 wrote to memory of 5504	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	132
PID 5072 wrote to memory of 5792	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	133
PID 5072 wrote to memory of 5792	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	133
PID 5072 wrote to memory of 2740	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	134
PID 5072 wrote to memory of 2740	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	134
PID 5072 wrote to memory of 1460	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	135
PID 5072 wrote to memory of 1460	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	135
PID 5072 wrote to memory of 1596	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	136
PID 5072 wrote to memory of 1596	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	136
PID 5072 wrote to memory of 4204	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	138
PID 5072 wrote to memory of 4204	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	138
PID 5072 wrote to memory of 1320	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	139
PID 5072 wrote to memory of 1320	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	139
PID 5072 wrote to memory of 2056	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	140
PID 5072 wrote to memory of 2056	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	140
PID 5072 wrote to memory of 1548	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	141
PID 5072 wrote to memory of 1548	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	141
PID 5072 wrote to memory of 1600	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	142
PID 5072 wrote to memory of 1600	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	142
PID 5072 wrote to memory of 732	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	143
PID 5072 wrote to memory of 732	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	143
PID 5072 wrote to memory of 1004	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	144
PID 5072 wrote to memory of 1004	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	144
PID 5072 wrote to memory of 4124	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	145
PID 5072 wrote to memory of 4124	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	145
PID 5072 wrote to memory of 1248	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	158
PID 5072 wrote to memory of 1248	5072	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe	158
PID 1248 wrote to memory of 5988	1248	cmd.exe	162
PID 1248 wrote to memory of 5988	1248	cmd.exe	162
PID 1248 wrote to memory of 3228	1248	cmd.exe	164
PID 1248 wrote to memory of 3228	1248	cmd.exe	164

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sppsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sppsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sppsvc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe
"C:\Users\Admin\AppData\Local\Temp\de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\swidtag\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\es-ES\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\StartMenuExperienceHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ModemLogs\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\sihost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\MusNotification.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\TextInputHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\unsecapp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mrJC8HLqdf.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:5988
- - C:\Program Files\dotnet\swidtag\sppsvc.exe
    "C:\Program Files\dotnet\swidtag\sppsvc.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\swidtag\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files\dotnet\swidtag\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Windows\ModemLogs\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\ModemLogs\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Windows\ModemLogs\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\dotnet\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\dotnet\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\dotnet\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Program Files\WindowsPowerShell\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX5467.tmp

Path C:\Recovery\WindowsRE\RCX5467.tmp
Size 1.0MB
SHA256 980f615970dbf58444e8f94f4c838d4e33f2bfa8567e60e4cd4ca8334801bf39
MD5 53b0276078eeee95853405e5fc75d6c2
SHA1 6f1d4ec07ec792bffbeb3147fc103dd83b06a915
SHA512 bdb34ac4c2643fa59493344c23406f7c602a220fd2d00d7faca4d0d22eb767a5824060f8ee6cd97625739e199f8a05472ff8f441fed9d0fdc7f36ec94818e793
SSDEEP 12288:/ubxAa9sUFxZ8oq7URPvyKBozWeL+vSgmtjJcDVrCTZSXlVB0mGEB0aNN/cPUeWl:g9sUFxZq7URPt6RL6nBrEZUjGE/L8YZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

RuntimeBroker.exe

Path C:\Recovery\WindowsRE\RuntimeBroker.exe
Size 1.0MB
SHA256 de0c4aa5d9069264d43509584ed0818e4bdceb95dd0bbe602d0a76d9488f99e3
MD5 1a5dd417abbc79ae58ab38ee99bedc25
SHA1 8ed0830ac848cb1b952a5c5473faff69a6b3b9e9
SHA512 0306a310f0584aaad45806eeeaefe715f2092df4650b3a331d7762fa1676fe436e45be014577d19760cf5bbc409543def1430012401d500cf5ff2156fde680c3
SSDEEP 12288:PubxAa9sUFxZ8oq7URPvyKBozWeL+vSgmtjJcDVrCTZSXlVB0mGEB0aNN/cPUeWl:Q9sUFxZq7URPt6RL6nBrEZUjGE/L8YZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe
MD5 a43e653ffb5ab07940f4bdd9cc8fade4
SHA1 af43d04e3427f111b22dc891c5c7ee8a10ac4123
SHA512 62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b
MD5 SHA1 SHA512

Submit Download