discordrat | 540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e

General

Target

540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe
Size

78KB
MD5

a2da8356ef064960ab8dd09372627a58
SHA1

2edb364315b7f1a5ee652e015a1316c6640d2d2b
SHA256

540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e
SHA512

9e4770e0d3a9404ea78d532b08e4b70c1be77fcd5797601fb17c18e45b991c10407c595a52ca361affd6bffeb476cdbcba184dd07142f10d74f23c4f357b6ace
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+KPIC:5Zv5PDwbjNrmAE+WIC

Score

10^/10

discordrat evasion execution persistence rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI0NjMwMTQ1MjQwNjc1MTI0Mg.GoEe4D.Ukxxcg2g6oiBh3IEoYa6C5FTUz1iU45J3sp1bU
server_id
1246300545325727776

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe

description pid process target process

PID 3192 created 612 3192 540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe winlogon.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

3836 powershell.exe
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

NetSh.exe

pid process

4328 NetSh.exe

description	pid	process	target process
PID 3192 created 612	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	winlogon.exe

pid	process
3836	powershell.exe

pid	process
4328	NetSh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 25 IoCs

Web Service

T1102

Processes:

flow	ioc
40	raw.githubusercontent.com
61	discord.com
24	discord.com
33	raw.githubusercontent.com
54	discord.com
60	discord.com
63	discord.com
21	discord.com
32	raw.githubusercontent.com
34	discord.com
37	discord.com
43	discord.com
62	discord.com
69	discord.com
64	discord.com
67	discord.com
68	discord.com
9	discord.com
42	discord.com
65	discord.com
36	discord.com
55	discord.com
66	raw.githubusercontent.com
8	discord.com
30	discord.com

Drops file in System32 directory 10 IoCs

Processes:

svchost.exesvchost.exeOfficeClickToRun.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe

description	pid	process	target process
PID 3192 set thread context of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	dllhost.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

SCHTASKS.exeSCHTASKS.exe

pid process

2244 SCHTASKS.exe
2116 SCHTASKS.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

wmiprvse.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe

pid	process
2244	SCHTASKS.exe
2116	SCHTASKS.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 14 IoCs

Processes:

OfficeClickToRun.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 03 Jun 2024 06:41:38 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={7EFE0617-D683-4C35-884A-21AB35BE4EA0}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1717396897"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exedllhost.exe

pid	process
3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe
2444	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exedllhost.exesvchost.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe
Token: SeDebugPrivilege	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe
Token: SeDebugPrivilege	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe
Token: SeDebugPrivilege	2444	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	2280	svchost.exe
Token: SeIncreaseQuotaPrivilege	2280	svchost.exe
Token: SeSecurityPrivilege	2280	svchost.exe
Token: SeTakeOwnershipPrivilege	2280	svchost.exe
Token: SeLoadDriverPrivilege	2280	svchost.exe
Token: SeSystemtimePrivilege	2280	svchost.exe
Token: SeBackupPrivilege	2280	svchost.exe
Token: SeRestorePrivilege	2280	svchost.exe
Token: SeShutdownPrivilege	2280	svchost.exe
Token: SeSystemEnvironmentPrivilege	2280	svchost.exe
Token: SeUndockPrivilege	2280	svchost.exe
Token: SeManageVolumePrivilege	2280	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2280	svchost.exe
Token: SeIncreaseQuotaPrivilege	2280	svchost.exe
Token: SeSecurityPrivilege	2280	svchost.exe
Token: SeTakeOwnershipPrivilege	2280	svchost.exe
Token: SeLoadDriverPrivilege	2280	svchost.exe
Token: SeSystemtimePrivilege	2280	svchost.exe
Token: SeBackupPrivilege	2280	svchost.exe
Token: SeRestorePrivilege	2280	svchost.exe
Token: SeShutdownPrivilege	2280	svchost.exe
Token: SeSystemEnvironmentPrivilege	2280	svchost.exe
Token: SeUndockPrivilege	2280	svchost.exe
Token: SeManageVolumePrivilege	2280	svchost.exe
Token: SeAuditPrivilege	2576	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2280	svchost.exe
Token: SeIncreaseQuotaPrivilege	2280	svchost.exe
Token: SeSecurityPrivilege	2280	svchost.exe
Token: SeTakeOwnershipPrivilege	2280	svchost.exe
Token: SeLoadDriverPrivilege	2280	svchost.exe
Token: SeSystemtimePrivilege	2280	svchost.exe
Token: SeBackupPrivilege	2280	svchost.exe
Token: SeRestorePrivilege	2280	svchost.exe
Token: SeShutdownPrivilege	2280	svchost.exe
Token: SeSystemEnvironmentPrivilege	2280	svchost.exe
Token: SeUndockPrivilege	2280	svchost.exe
Token: SeManageVolumePrivilege	2280	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2280	svchost.exe
Token: SeIncreaseQuotaPrivilege	2280	svchost.exe
Token: SeSecurityPrivilege	2280	svchost.exe
Token: SeTakeOwnershipPrivilege	2280	svchost.exe
Token: SeLoadDriverPrivilege	2280	svchost.exe
Token: SeSystemtimePrivilege	2280	svchost.exe
Token: SeBackupPrivilege	2280	svchost.exe
Token: SeRestorePrivilege	2280	svchost.exe
Token: SeShutdownPrivilege	2280	svchost.exe
Token: SeSystemEnvironmentPrivilege	2280	svchost.exe
Token: SeUndockPrivilege	2280	svchost.exe
Token: SeManageVolumePrivilege	2280	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2280	svchost.exe
Token: SeIncreaseQuotaPrivilege	2280	svchost.exe
Token: SeSecurityPrivilege	2280	svchost.exe
Token: SeTakeOwnershipPrivilege	2280	svchost.exe
Token: SeLoadDriverPrivilege	2280	svchost.exe
Token: SeSystemtimePrivilege	2280	svchost.exe
Token: SeBackupPrivilege	2280	svchost.exe
Token: SeRestorePrivilege	2280	svchost.exe
Token: SeShutdownPrivilege	2280	svchost.exe
Token: SeSystemEnvironmentPrivilege	2280	svchost.exe
Token: SeUndockPrivilege	2280	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exedllhost.exe

description	pid	process	target process
PID 3192 wrote to memory of 2244	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	SCHTASKS.exe
PID 3192 wrote to memory of 2244	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	SCHTASKS.exe
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	dllhost.exe
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	dllhost.exe
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	dllhost.exe
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	dllhost.exe
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	dllhost.exe
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	dllhost.exe
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	dllhost.exe
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	dllhost.exe
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	dllhost.exe
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	dllhost.exe
PID 3192 wrote to memory of 2444	3192	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	dllhost.exe
PID 2444 wrote to memory of 612	2444	dllhost.exe	winlogon.exe
PID 2444 wrote to memory of 676	2444	dllhost.exe	lsass.exe
PID 2444 wrote to memory of 956	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 388	2444	dllhost.exe	dwm.exe
PID 2444 wrote to memory of 532	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 392	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1020	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1152	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1176	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1188	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1196	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1384	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1408	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1420	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1460	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1468	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1540	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1632	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1700	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1744	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1796	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1888	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1896	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1904	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1916	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 2028	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 1768	2444	dllhost.exe	spoolsv.exe
PID 2444 wrote to memory of 2148	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 2280	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 2312	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 2404	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 2412	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 2496	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 2576	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 2584	2444	dllhost.exe	sysmon.exe
PID 2444 wrote to memory of 2608	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 2628	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 2932	2444	dllhost.exe	sihost.exe
PID 2444 wrote to memory of 2968	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 2976	2444	dllhost.exe	unsecapp.exe
PID 2444 wrote to memory of 2196	2444	dllhost.exe	taskhostw.exe
PID 2444 wrote to memory of 2516	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 3356	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 3440	2444	dllhost.exe	Explorer.EXE
PID 2444 wrote to memory of 3544	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 3756	2444	dllhost.exe	DllHost.exe
PID 2444 wrote to memory of 3932	2444	dllhost.exe	RuntimeBroker.exe
PID 2444 wrote to memory of 4124	2444	dllhost.exe	RuntimeBroker.exe
PID 2444 wrote to memory of 4740	2444	dllhost.exe	RuntimeBroker.exe
PID 2444 wrote to memory of 5108	2444	dllhost.exe	svchost.exe
PID 2444 wrote to memory of 908	2444	dllhost.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:388

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{030d27d6-43e4-44a7-b4ad-aae57ad4b2fd}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1152

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:2196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1468

C:\Windows\system32\sihost.exe
sihost.exe
2⤵
PID:2932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2028

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2968

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3356

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3440

C:\Users\Admin\AppData\Local\Temp\540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe
"C:\Users\Admin\AppData\Local\Temp\540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192

C:\Windows\SYSTEM32\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe'" /sc onlogon /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:2244

C:\Windows\SYSTEM32\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe'" /sc onlogon /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:2116

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:2368

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:3836

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:1148

C:\Windows\SYSTEM32\NetSh.exe
"NetSh.exe" Advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
PID:4328

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:4764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3544

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3756

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3932

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4124

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2292

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1804

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:8

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5016

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:316

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
PID:2264

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2068

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:2088

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Create or Modify System Process

1

T1543

Windows Service

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pvfs1iwp.3ah.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/388-265-0x0000027F02100000-0x0000027F0212A000-memory.dmp

Filesize
168KB

Download
memory/388-27-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/388-26-0x0000027F02100000-0x0000027F0212A000-memory.dmp

Filesize
168KB

Download
memory/392-42-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/392-41-0x00000137E5F70000-0x00000137E5F9A000-memory.dmp

Filesize
168KB

Download
memory/392-269-0x00000137E5F70000-0x00000137E5F9A000-memory.dmp

Filesize
168KB

Download
memory/532-39-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/532-38-0x0000024EBAF90000-0x0000024EBAFBA000-memory.dmp

Filesize
168KB

Download
memory/532-268-0x0000024EBAF90000-0x0000024EBAFBA000-memory.dmp

Filesize
168KB

Download
memory/612-16-0x000001C372070000-0x000001C372093000-memory.dmp

Filesize
140KB

Download
memory/612-17-0x000001C372100000-0x000001C37212A000-memory.dmp

Filesize
168KB

Download
memory/612-18-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/612-263-0x00007FFC53B2D000-0x00007FFC53B2E000-memory.dmp

Filesize
4KB

Download
memory/612-262-0x000001C372100000-0x000001C37212A000-memory.dmp

Filesize
168KB

Download
memory/676-21-0x0000021FF50D0000-0x0000021FF50FA000-memory.dmp

Filesize
168KB

Download
memory/676-22-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/676-264-0x0000021FF50D0000-0x0000021FF50FA000-memory.dmp

Filesize
168KB

Download
memory/956-30-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/956-267-0x00007FFC53B2C000-0x00007FFC53B2D000-memory.dmp

Filesize
4KB

Download
memory/956-266-0x000001E265CD0000-0x000001E265CFA000-memory.dmp

Filesize
168KB

Download
memory/956-29-0x000001E265CD0000-0x000001E265CFA000-memory.dmp

Filesize
168KB

Download
memory/1020-45-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/1020-270-0x00000209090E0000-0x000002090910A000-memory.dmp

Filesize
168KB

Download
memory/1020-44-0x00000209090E0000-0x000002090910A000-memory.dmp

Filesize
168KB

Download
memory/1152-48-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/1152-47-0x0000020829330000-0x000002082935A000-memory.dmp

Filesize
168KB

Download
memory/1176-51-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/1176-50-0x0000022034890000-0x00000220348BA000-memory.dmp

Filesize
168KB

Download
memory/1188-54-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/1188-53-0x0000016AE9960000-0x0000016AE998A000-memory.dmp

Filesize
168KB

Download
memory/1196-61-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/1196-60-0x0000025E4BC80000-0x0000025E4BCAA000-memory.dmp

Filesize
168KB

Download
memory/1384-63-0x000001BE947B0000-0x000001BE947DA000-memory.dmp

Filesize
168KB

Download
memory/1384-64-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/1408-66-0x0000017C46E70000-0x0000017C46E9A000-memory.dmp

Filesize
168KB

Download
memory/1408-67-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/1420-69-0x00000176C5340000-0x00000176C536A000-memory.dmp

Filesize
168KB

Download
memory/1420-70-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

Filesize
64KB

Download
memory/2444-11-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

Filesize
2.0MB

Download
memory/2444-10-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/2444-9-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/2444-13-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/2444-12-0x00007FFC51FD0000-0x00007FFC5208E000-memory.dmp

Filesize
760KB

Download
memory/2444-8-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/3192-2-0x000002BDA22F0000-0x000002BDA24B2000-memory.dmp

Filesize
1.8MB

Download
memory/3192-271-0x00007FFC35B73000-0x00007FFC35B75000-memory.dmp

Filesize
8KB

Download
memory/3192-5-0x000002BD89A10000-0x000002BD89A4E000-memory.dmp

Filesize
248KB

Download
memory/3192-4-0x000002BDA2B30000-0x000002BDA3058000-memory.dmp

Filesize
5.2MB

Download
memory/3192-3-0x00007FFC35B70000-0x00007FFC36631000-memory.dmp

Filesize
10.8MB

Download
memory/3192-7-0x00007FFC51FD0000-0x00007FFC5208E000-memory.dmp

Filesize
760KB

Download
memory/3192-0-0x00007FFC35B73000-0x00007FFC35B75000-memory.dmp

Filesize
8KB

Download
memory/3192-6-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

Filesize
2.0MB

Download
memory/3192-272-0x00007FFC35B70000-0x00007FFC36631000-memory.dmp

Filesize
10.8MB

Download
memory/3192-277-0x000002BDA3D10000-0x000002BDA3D86000-memory.dmp

Filesize
472KB

Download
memory/3192-278-0x000002BDA21B0000-0x000002BDA21C2000-memory.dmp

Filesize
72KB

Download
memory/3192-279-0x000002BDA28E0000-0x000002BDA28FE000-memory.dmp

Filesize
120KB

Download
memory/3192-1-0x000002BD87CB0000-0x000002BD87CC8000-memory.dmp

Filesize
96KB

Download
memory/3192-340-0x000002BDA21C0000-0x000002BDA21CE000-memory.dmp

Filesize
56KB

Download
memory/3836-317-0x000002026C620000-0x000002026C642000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads