discordrat | 540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 06:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe
Size

78KB
MD5

a2da8356ef064960ab8dd09372627a58
SHA1

2edb364315b7f1a5ee652e015a1316c6640d2d2b
SHA256

540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e
SHA512

9e4770e0d3a9404ea78d532b08e4b70c1be77fcd5797601fb17c18e45b991c10407c595a52ca361affd6bffeb476cdbcba184dd07142f10d74f23c4f357b6ace
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+KPIC:5Zv5PDwbjNrmAE+WIC

Score

10^/10

discordrat evasion execution persistence rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI0NjMwMTQ1MjQwNjc1MTI0Mg.GoEe4D.Ukxxcg2g6oiBh3IEoYa6C5FTUz1iU45J3sp1bU
server_id
1246300545325727776

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3192 created 612	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	5

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3836	powershell.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4328	NetSh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 25 IoCs

Web Service

T1102

flow	ioc
40	raw.githubusercontent.com
61	discord.com
24	discord.com
33	raw.githubusercontent.com
54	discord.com
60	discord.com
63	discord.com
21	discord.com
32	raw.githubusercontent.com
34	discord.com
37	discord.com
43	discord.com
62	discord.com
69	discord.com
64	discord.com
67	discord.com
68	discord.com
9	discord.com
42	discord.com
65	discord.com
36	discord.com
55	discord.com
66	raw.githubusercontent.com
8	discord.com
30	discord.com

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3192 set thread context of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	91

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2244	SCHTASKS.exe
2116	SCHTASKS.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 03 Jun 2024 06:41:38 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={7EFE0617-D683-4C35-884A-21AB35BE4EA0}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1717396897"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe
Token: SeDebugPrivilege	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe
Token: SeDebugPrivilege	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe
Token: SeDebugPrivilege	2444	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	2280	svchost.exe
Token: SeIncreaseQuotaPrivilege	2280	svchost.exe
Token: SeSecurityPrivilege	2280	svchost.exe
Token: SeTakeOwnershipPrivilege	2280	svchost.exe
Token: SeLoadDriverPrivilege	2280	svchost.exe
Token: SeSystemtimePrivilege	2280	svchost.exe
Token: SeBackupPrivilege	2280	svchost.exe
Token: SeRestorePrivilege	2280	svchost.exe
Token: SeShutdownPrivilege	2280	svchost.exe
Token: SeSystemEnvironmentPrivilege	2280	svchost.exe
Token: SeUndockPrivilege	2280	svchost.exe
Token: SeManageVolumePrivilege	2280	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2280	svchost.exe
Token: SeIncreaseQuotaPrivilege	2280	svchost.exe
Token: SeSecurityPrivilege	2280	svchost.exe
Token: SeTakeOwnershipPrivilege	2280	svchost.exe
Token: SeLoadDriverPrivilege	2280	svchost.exe
Token: SeSystemtimePrivilege	2280	svchost.exe
Token: SeBackupPrivilege	2280	svchost.exe
Token: SeRestorePrivilege	2280	svchost.exe
Token: SeShutdownPrivilege	2280	svchost.exe
Token: SeSystemEnvironmentPrivilege	2280	svchost.exe
Token: SeUndockPrivilege	2280	svchost.exe
Token: SeManageVolumePrivilege	2280	svchost.exe
Token: SeAuditPrivilege	2576	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2280	svchost.exe
Token: SeIncreaseQuotaPrivilege	2280	svchost.exe
Token: SeSecurityPrivilege	2280	svchost.exe
Token: SeTakeOwnershipPrivilege	2280	svchost.exe
Token: SeLoadDriverPrivilege	2280	svchost.exe
Token: SeSystemtimePrivilege	2280	svchost.exe
Token: SeBackupPrivilege	2280	svchost.exe
Token: SeRestorePrivilege	2280	svchost.exe
Token: SeShutdownPrivilege	2280	svchost.exe
Token: SeSystemEnvironmentPrivilege	2280	svchost.exe
Token: SeUndockPrivilege	2280	svchost.exe
Token: SeManageVolumePrivilege	2280	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2280	svchost.exe
Token: SeIncreaseQuotaPrivilege	2280	svchost.exe
Token: SeSecurityPrivilege	2280	svchost.exe
Token: SeTakeOwnershipPrivilege	2280	svchost.exe
Token: SeLoadDriverPrivilege	2280	svchost.exe
Token: SeSystemtimePrivilege	2280	svchost.exe
Token: SeBackupPrivilege	2280	svchost.exe
Token: SeRestorePrivilege	2280	svchost.exe
Token: SeShutdownPrivilege	2280	svchost.exe
Token: SeSystemEnvironmentPrivilege	2280	svchost.exe
Token: SeUndockPrivilege	2280	svchost.exe
Token: SeManageVolumePrivilege	2280	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2280	svchost.exe
Token: SeIncreaseQuotaPrivilege	2280	svchost.exe
Token: SeSecurityPrivilege	2280	svchost.exe
Token: SeTakeOwnershipPrivilege	2280	svchost.exe
Token: SeLoadDriverPrivilege	2280	svchost.exe
Token: SeSystemtimePrivilege	2280	svchost.exe
Token: SeBackupPrivilege	2280	svchost.exe
Token: SeRestorePrivilege	2280	svchost.exe
Token: SeShutdownPrivilege	2280	svchost.exe
Token: SeSystemEnvironmentPrivilege	2280	svchost.exe
Token: SeUndockPrivilege	2280	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 2244	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	89
PID 3192 wrote to memory of 2244	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	89
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	91
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	91
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	91
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	91
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	91
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	91
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	91
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	91
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	91
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	91
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	91
PID 2444 wrote to memory of 612	2444	dllhost.exe	5
PID 2444 wrote to memory of 676	2444	dllhost.exe	7
PID 2444 wrote to memory of 956	2444	dllhost.exe	12
PID 2444 wrote to memory of 388	2444	dllhost.exe	13
PID 2444 wrote to memory of 532	2444	dllhost.exe	14
PID 2444 wrote to memory of 392	2444	dllhost.exe	15
PID 2444 wrote to memory of 1020	2444	dllhost.exe	16
PID 2444 wrote to memory of 1152	2444	dllhost.exe	18
PID 2444 wrote to memory of 1176	2444	dllhost.exe	19
PID 2444 wrote to memory of 1188	2444	dllhost.exe	20
PID 2444 wrote to memory of 1196	2444	dllhost.exe	21
PID 2444 wrote to memory of 1384	2444	dllhost.exe	22
PID 2444 wrote to memory of 1408	2444	dllhost.exe	23
PID 2444 wrote to memory of 1420	2444	dllhost.exe	24
PID 2444 wrote to memory of 1460	2444	dllhost.exe	25
PID 2444 wrote to memory of 1468	2444	dllhost.exe	26
PID 2444 wrote to memory of 1540	2444	dllhost.exe	27
PID 2444 wrote to memory of 1632	2444	dllhost.exe	28
PID 2444 wrote to memory of 1700	2444	dllhost.exe	29
PID 2444 wrote to memory of 1744	2444	dllhost.exe	30
PID 2444 wrote to memory of 1796	2444	dllhost.exe	31
PID 2444 wrote to memory of 1888	2444	dllhost.exe	32
PID 2444 wrote to memory of 1896	2444	dllhost.exe	33
PID 2444 wrote to memory of 1904	2444	dllhost.exe	34
PID 2444 wrote to memory of 1916	2444	dllhost.exe	35
PID 2444 wrote to memory of 2028	2444	dllhost.exe	36
PID 2444 wrote to memory of 1768	2444	dllhost.exe	37
PID 2444 wrote to memory of 2148	2444	dllhost.exe	39
PID 2444 wrote to memory of 2280	2444	dllhost.exe	40
PID 2444 wrote to memory of 2312	2444	dllhost.exe	41
PID 2444 wrote to memory of 2404	2444	dllhost.exe	42
PID 2444 wrote to memory of 2412	2444	dllhost.exe	43
PID 2444 wrote to memory of 2496	2444	dllhost.exe	44
PID 2444 wrote to memory of 2576	2444	dllhost.exe	45
PID 2444 wrote to memory of 2584	2444	dllhost.exe	46
PID 2444 wrote to memory of 2608	2444	dllhost.exe	47
PID 2444 wrote to memory of 2628	2444	dllhost.exe	48
PID 2444 wrote to memory of 2932	2444	dllhost.exe	49
PID 2444 wrote to memory of 2968	2444	dllhost.exe	50
PID 2444 wrote to memory of 2976	2444	dllhost.exe	51
PID 2444 wrote to memory of 2196	2444	dllhost.exe	52
PID 2444 wrote to memory of 2516	2444	dllhost.exe	53
PID 2444 wrote to memory of 3356	2444	dllhost.exe	55
PID 2444 wrote to memory of 3440	2444	dllhost.exe	56
PID 2444 wrote to memory of 3544	2444	dllhost.exe	57
PID 2444 wrote to memory of 3756	2444	dllhost.exe	58
PID 2444 wrote to memory of 3932	2444	dllhost.exe	60
PID 2444 wrote to memory of 4124	2444	dllhost.exe	62
PID 2444 wrote to memory of 4740	2444	dllhost.exe	64
PID 2444 wrote to memory of 5108	2444	dllhost.exe	66
PID 2444 wrote to memory of 908	2444	dllhost.exe	68

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:388
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{030d27d6-43e4-44a7-b4ad-aae57ad4b2fd}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2444

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1152
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1468
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2028

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2968

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3356

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3440
- C:\Users\Admin\AppData\Local\Temp\540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe
  "C:\Users\Admin\AppData\Local\Temp\540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "$77540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2244
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "$77540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2116
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3836
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1148
- - C:\Windows\SYSTEM32\NetSh.exe
    "NetSh.exe" Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:4328
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3544

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3756

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3932

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4124

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2292

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1804

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:8

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5016

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:316

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
PID:2264

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2068

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pvfs1iwp.3ah.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/388-265-0x0000027F02100000-0x0000027F0212A000-memory.dmp

Filesize
168KB

Download
memory/388-27-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/388-26-0x0000027F02100000-0x0000027F0212A000-memory.dmp

Filesize
168KB

Download
memory/392-42-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/392-41-0x00000137E5F70000-0x00000137E5F9A000-memory.dmp

Filesize
168KB

Download
memory/392-269-0x00000137E5F70000-0x00000137E5F9A000-memory.dmp

Filesize
168KB

Download
memory/532-39-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/532-38-0x0000024EBAF90000-0x0000024EBAFBA000-memory.dmp

Filesize
168KB

Download
memory/532-268-0x0000024EBAF90000-0x0000024EBAFBA000-memory.dmp

Filesize
168KB

Download
memory/612-16-0x000001C372070000-0x000001C372093000-memory.dmp

Filesize
140KB

Download
memory/612-17-0x000001C372100000-0x000001C37212A000-memory.dmp

Filesize
168KB

Download
memory/612-18-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/612-263-0x00007FFC53B2D000-0x00007FFC53B2E000-memory.dmp

Filesize
4KB

Download
memory/612-262-0x000001C372100000-0x000001C37212A000-memory.dmp

Filesize
168KB

Download
memory/676-21-0x0000021FF50D0000-0x0000021FF50FA000-memory.dmp

Filesize
168KB

Download
memory/676-22-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/676-264-0x0000021FF50D0000-0x0000021FF50FA000-memory.dmp

Filesize
168KB

Download
memory/956-30-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/956-267-0x00007FFC53B2C000-0x00007FFC53B2D000-memory.dmp

Filesize
4KB

Download
memory/956-266-0x000001E265CD0000-0x000001E265CFA000-memory.dmp

Filesize
168KB

Download
memory/956-29-0x000001E265CD0000-0x000001E265CFA000-memory.dmp

Filesize
168KB

Download
memory/1020-45-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/1020-270-0x00000209090E0000-0x000002090910A000-memory.dmp

Filesize
168KB

Download
memory/1020-44-0x00000209090E0000-0x000002090910A000-memory.dmp

Filesize
168KB

Download
memory/1152-48-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/1152-47-0x0000020829330000-0x000002082935A000-memory.dmp

Filesize
168KB

Download
memory/1176-51-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/1176-50-0x0000022034890000-0x00000220348BA000-memory.dmp

Filesize
168KB

Download
memory/1188-54-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/1188-53-0x0000016AE9960000-0x0000016AE998A000-memory.dmp

Filesize
168KB

Download
memory/1196-61-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/1196-60-0x0000025E4BC80000-0x0000025E4BCAA000-memory.dmp

Filesize
168KB

Download
memory/1384-63-0x000001BE947B0000-0x000001BE947DA000-memory.dmp

Filesize
168KB

Download
memory/1384-64-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/1408-66-0x0000017C46E70000-0x0000017C46E9A000-memory.dmp

Filesize
168KB

Download
memory/1408-67-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/1420-69-0x00000176C5340000-0x00000176C536A000-memory.dmp

Filesize
168KB

Download
memory/1420-70-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/2444-11-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

Filesize
2.0MB

Download
memory/2444-10-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/2444-9-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/2444-13-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/2444-12-0x00007FFC51FD0000-0x00007FFC5208E000-memory.dmp

Filesize
760KB

Download
memory/2444-8-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/3192-2-0x000002BDA22F0000-0x000002BDA24B2000-memory.dmp

Filesize
1.8MB

Download
memory/3192-271-0x00007FFC35B73000-0x00007FFC35B75000-memory.dmp

Filesize
8KB

Download
memory/3192-5-0x000002BD89A10000-0x000002BD89A4E000-memory.dmp

Filesize
248KB

Download
memory/3192-4-0x000002BDA2B30000-0x000002BDA3058000-memory.dmp

Filesize
5.2MB

Download
memory/3192-3-0x00007FFC35B70000-0x00007FFC36631000-memory.dmp

Filesize
10.8MB

Download
memory/3192-7-0x00007FFC51FD0000-0x00007FFC5208E000-memory.dmp

Filesize
760KB

Download
memory/3192-0-0x00007FFC35B73000-0x00007FFC35B75000-memory.dmp

Filesize
8KB

Download
memory/3192-6-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

Filesize
2.0MB

Download
memory/3192-272-0x00007FFC35B70000-0x00007FFC36631000-memory.dmp

Filesize
10.8MB

Download
memory/3192-277-0x000002BDA3D10000-0x000002BDA3D86000-memory.dmp

Filesize
472KB

Download
memory/3192-278-0x000002BDA21B0000-0x000002BDA21C2000-memory.dmp

Filesize
72KB

Download
memory/3192-279-0x000002BDA28E0000-0x000002BDA28FE000-memory.dmp

Filesize
120KB

Download
memory/3192-1-0x000002BD87CB0000-0x000002BD87CC8000-memory.dmp

Filesize
96KB

Download
memory/3192-340-0x000002BDA21C0000-0x000002BDA21CE000-memory.dmp

Filesize
56KB

Download
memory/3836-317-0x000002026C620000-0x000002026C642000-memory.dmp

Filesize
136KB

Download