dcrat | 3fa6ddcabcb03763ef1887117e16ebdf0553a1cc2a16b58bdecaba0735d4e60a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0c1b8d8d00d578c844a14875fb7599d3.exe
Size 3.4MB
Sample240615-d2216axgla
SHA256 3fa6ddcabcb03763ef1887117e16ebdf0553a1cc2a16b58bdecaba0735d4e60a
MD5 0c1b8d8d00d578c844a14875fb7599d3
SHA1 863f7b4b56908cb442ca705be7df48f3c96bf46b
SHA512 2f58e2f549a34c8b7dd00d709c244b9b767d148922a74ae1762cad72c01be9564cab30efc5bf6c7dc138df7124eb81ee6ed83acac737a202ad81f0de57a3b559
SSDEEP 49152:TNYaZhQT1Wrf+VEo0k/3t/A/6jrX1zi4lernnF4iY5tTw/L/JZMAXHmOm:5YaZhQJWrWqA/3t/pD15eTv/JmAXm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		4312	schtasks.exe
		1488	schtasks.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\a6ac6e6b689772		0c1b8d8d00d578c844a14875fb7599d3.exe
		4892	schtasks.exe
		2936	schtasks.exe
		3184	schtasks.exe
		3536	schtasks.exe
		1668	schtasks.exe
		3208	schtasks.exe
		4852	schtasks.exe
		4984	schtasks.exe
		4824	schtasks.exe
		2548	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		0c1b8d8d00d578c844a14875fb7599d3.exe
		4680	schtasks.exe
		3912	schtasks.exe
		4028	schtasks.exe
		2640	schtasks.exe
		2372	schtasks.exe
		844	schtasks.exe
		2996	schtasks.exe
		4828	schtasks.exe
		4180	schtasks.exe
		2092	schtasks.exe
		2848	schtasks.exe
		732	schtasks.exe
		1804	schtasks.exe
		4832	schtasks.exe
		760	schtasks.exe
		2440	schtasks.exe
		4848	schtasks.exe
		4756	schtasks.exe
		4564	schtasks.exe
		1004	schtasks.exe
		4292	schtasks.exe
		2692	schtasks.exe
		2676	schtasks.exe
		3492	schtasks.exe
		3596	schtasks.exe
		3704	schtasks.exe
		1268	schtasks.exe
		224	schtasks.exe
		5000	schtasks.exe
		1696	schtasks.exe
		2540	schtasks.exe
		4980	schtasks.exe
		4736	schtasks.exe
		4452	schtasks.exe
		1552	schtasks.exe
		664	schtasks.exe
		4440	schtasks.exe
		3540	schtasks.exe
		1464	schtasks.exe
		5028	schtasks.exe
		1152	schtasks.exe
		4744	schtasks.exe
		1504	schtasks.exe
		968	schtasks.exe
		876	schtasks.exe
		2536	schtasks.exe
		3340	schtasks.exe
		1220	schtasks.exe
		2228	schtasks.exe
		3128	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 22 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4736	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	324	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4828	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4312	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3208	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4028	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	732	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4292	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3540	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	3144	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	3144	schtasks.exe	84

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4004-1-0x0000000000060000-0x00000000003CA000-memory.dmp	dcrat
behavioral2/files/0x0007000000023416-48.dat	dcrat
behavioral2/files/0x000700000002345a-163.dat	dcrat

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	0c1b8d8d00d578c844a14875fb7599d3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	0c1b8d8d00d578c844a14875fb7599d3.exe

Executes dropped EXE 11 IoCs

pid	Process
4552	csrss.exe
3404	csrss.exe
1124	csrss.exe
2600	csrss.exe
4272	csrss.exe
4636	csrss.exe
4564	csrss.exe
3272	csrss.exe
948	csrss.exe
1972	csrss.exe
368	csrss.exe

Adds Run key to start application 2 TTPs 44 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Users\\Default User\\StartMenuExperienceHost.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\Registry.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0c1b8d8d00d578c844a14875fb7599d3 = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Provisioning\\Cosa\\wininit.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Public\\Desktop\\csrss.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Provisioning\\Cosa\\wininit.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\upfc.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RuntimeBroker.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Admin\\lsass.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Users\\Public\\Pictures\\sysmon.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\explorer.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\upfc.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\All Users\\RuntimeBroker.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\Microsoft Office 15\\backgroundTaskHost.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\CbsTemp\\fontdrvhost.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RuntimeBroker.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Users\\Public\\Pictures\\sysmon.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Public\\Downloads\\winlogon.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Users\\Default User\\StartMenuExperienceHost.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\appcompat\\appraiser\\Telemetry\\StartMenuExperienceHost.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files\\Windows Mail\\unsecapp.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\All Users\\RuntimeBroker.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\Microsoft Office 15\\backgroundTaskHost.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Default User\\WmiPrvSE.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Default User\\WmiPrvSE.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0c1b8d8d00d578c844a14875fb7599d3 = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Public\\Desktop\\csrss.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Public\\Downloads\\winlogon.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\explorer.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\Registry.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\CbsTemp\\fontdrvhost.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\appcompat\\appraiser\\Telemetry\\StartMenuExperienceHost.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Admin\\lsass.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files\\Windows Mail\\unsecapp.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0c1b8d8d00d578c844a14875fb7599d3.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\7a0fd90576e088	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\upfc.exe	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\ea1d8f6d871115	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\dllhost.exe	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\a6ac6e6b689772	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\spoolsv.exe	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\f3b6ecef712a24	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files\Windows Mail\29c1c3cc0f7685	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\explorer.exe	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files\Microsoft Office 15\eddb19405b7ce1	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\Registry.exe	0c1b8d8d00d578c844a14875fb7599d3.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RuntimeBroker.exe	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\9e8d7a4ca61bd9	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\0c1b8d8d00d578c844a14875fb7599d3.exe	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files\Windows Mail\unsecapp.exe	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\0a1fd5f707cd16	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\ee2ad38f3d4382	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RuntimeBroker.exe	0c1b8d8d00d578c844a14875fb7599d3.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\0c1b8d8d00d578c844a14875fb7599d3.exe	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files\Microsoft Office 15\backgroundTaskHost.exe	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\5940a34987c991	0c1b8d8d00d578c844a14875fb7599d3.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\appcompat\appraiser\Telemetry\StartMenuExperienceHost.exe	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Windows\appcompat\appraiser\Telemetry\55b276f4edf653	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Windows\CbsTemp\fontdrvhost.exe	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Windows\CbsTemp\5b884080fd4f94	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Windows\Provisioning\Cosa\wininit.exe	0c1b8d8d00d578c844a14875fb7599d3.exe
File created	C:\Windows\Provisioning\Cosa\56085415360792	0c1b8d8d00d578c844a14875fb7599d3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4440	schtasks.exe
3912	schtasks.exe
3128	schtasks.exe
4892	schtasks.exe
4980	schtasks.exe
2548	schtasks.exe
4852	schtasks.exe
4736	schtasks.exe
224	schtasks.exe
1552	schtasks.exe
4680	schtasks.exe
3208	schtasks.exe
4292	schtasks.exe
1464	schtasks.exe
4656	schtasks.exe
3340	schtasks.exe
4984	schtasks.exe
1488	schtasks.exe
760	schtasks.exe
1668	schtasks.exe
4748	schtasks.exe
4848	schtasks.exe
4824	schtasks.exe
1696	schtasks.exe
732	schtasks.exe
2372	schtasks.exe
1220	schtasks.exe
844	schtasks.exe
324	schtasks.exe
3540	schtasks.exe
3596	schtasks.exe
2092	schtasks.exe
3492	schtasks.exe
1504	schtasks.exe
876	schtasks.exe
4028	schtasks.exe
2540	schtasks.exe
2228	schtasks.exe
4180	schtasks.exe
3536	schtasks.exe
2996	schtasks.exe
4312	schtasks.exe
2536	schtasks.exe
1152	schtasks.exe
968	schtasks.exe
3704	schtasks.exe
664	schtasks.exe
4828	schtasks.exe
2640	schtasks.exe
4756	schtasks.exe
1004	schtasks.exe
2676	schtasks.exe
5000	schtasks.exe
3184	schtasks.exe
4832	schtasks.exe
2692	schtasks.exe
1268	schtasks.exe
2440	schtasks.exe
5028	schtasks.exe
4452	schtasks.exe
4564	schtasks.exe
1804	schtasks.exe
4744	schtasks.exe
2848	schtasks.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	0c1b8d8d00d578c844a14875fb7599d3.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	csrss.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4004	0c1b8d8d00d578c844a14875fb7599d3.exe
4004	0c1b8d8d00d578c844a14875fb7599d3.exe
4004	0c1b8d8d00d578c844a14875fb7599d3.exe
4004	0c1b8d8d00d578c844a14875fb7599d3.exe
4004	0c1b8d8d00d578c844a14875fb7599d3.exe
4004	0c1b8d8d00d578c844a14875fb7599d3.exe
4004	0c1b8d8d00d578c844a14875fb7599d3.exe
4004	0c1b8d8d00d578c844a14875fb7599d3.exe
4004	0c1b8d8d00d578c844a14875fb7599d3.exe
4004	0c1b8d8d00d578c844a14875fb7599d3.exe
4004	0c1b8d8d00d578c844a14875fb7599d3.exe
4004	0c1b8d8d00d578c844a14875fb7599d3.exe
4004	0c1b8d8d00d578c844a14875fb7599d3.exe
1960	0c1b8d8d00d578c844a14875fb7599d3.exe
1960	0c1b8d8d00d578c844a14875fb7599d3.exe
1960	0c1b8d8d00d578c844a14875fb7599d3.exe
1960	0c1b8d8d00d578c844a14875fb7599d3.exe
1960	0c1b8d8d00d578c844a14875fb7599d3.exe
1960	0c1b8d8d00d578c844a14875fb7599d3.exe
1960	0c1b8d8d00d578c844a14875fb7599d3.exe
1960	0c1b8d8d00d578c844a14875fb7599d3.exe
1960	0c1b8d8d00d578c844a14875fb7599d3.exe
1960	0c1b8d8d00d578c844a14875fb7599d3.exe
1960	0c1b8d8d00d578c844a14875fb7599d3.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe
4552	csrss.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4004	0c1b8d8d00d578c844a14875fb7599d3.exe
Token: SeDebugPrivilege	1960	0c1b8d8d00d578c844a14875fb7599d3.exe
Token: SeDebugPrivilege	4552	csrss.exe
Token: SeDebugPrivilege	3404	csrss.exe
Token: SeDebugPrivilege	1124	csrss.exe
Token: SeDebugPrivilege	2600	csrss.exe
Token: SeDebugPrivilege	4272	csrss.exe
Token: SeDebugPrivilege	4636	csrss.exe
Token: SeDebugPrivilege	4564	csrss.exe
Token: SeDebugPrivilege	3272	csrss.exe
Token: SeDebugPrivilege	948	csrss.exe
Token: SeDebugPrivilege	1972	csrss.exe
Token: SeDebugPrivilege	368	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 5020	4004	0c1b8d8d00d578c844a14875fb7599d3.exe	130
PID 4004 wrote to memory of 5020	4004	0c1b8d8d00d578c844a14875fb7599d3.exe	130
PID 5020 wrote to memory of 3400	5020	cmd.exe	132
PID 5020 wrote to memory of 3400	5020	cmd.exe	132
PID 5020 wrote to memory of 1960	5020	cmd.exe	133
PID 5020 wrote to memory of 1960	5020	cmd.exe	133
PID 1960 wrote to memory of 4552	1960	0c1b8d8d00d578c844a14875fb7599d3.exe	155
PID 1960 wrote to memory of 4552	1960	0c1b8d8d00d578c844a14875fb7599d3.exe	155
PID 4552 wrote to memory of 1240	4552	csrss.exe	157
PID 4552 wrote to memory of 1240	4552	csrss.exe	157
PID 4552 wrote to memory of 4896	4552	csrss.exe	158
PID 4552 wrote to memory of 4896	4552	csrss.exe	158
PID 1240 wrote to memory of 3404	1240	WScript.exe	160
PID 1240 wrote to memory of 3404	1240	WScript.exe	160
PID 3404 wrote to memory of 2260	3404	csrss.exe	164
PID 3404 wrote to memory of 2260	3404	csrss.exe	164
PID 3404 wrote to memory of 2596	3404	csrss.exe	165
PID 3404 wrote to memory of 2596	3404	csrss.exe	165
PID 2260 wrote to memory of 1124	2260	WScript.exe	167
PID 2260 wrote to memory of 1124	2260	WScript.exe	167
PID 1124 wrote to memory of 1552	1124	csrss.exe	170
PID 1124 wrote to memory of 1552	1124	csrss.exe	170
PID 1124 wrote to memory of 2912	1124	csrss.exe	171
PID 1124 wrote to memory of 2912	1124	csrss.exe	171
PID 1552 wrote to memory of 2600	1552	WScript.exe	172
PID 1552 wrote to memory of 2600	1552	WScript.exe	172
PID 2600 wrote to memory of 4680	2600	csrss.exe	173
PID 2600 wrote to memory of 4680	2600	csrss.exe	173
PID 2600 wrote to memory of 4548	2600	csrss.exe	174
PID 2600 wrote to memory of 4548	2600	csrss.exe	174
PID 4680 wrote to memory of 4272	4680	WScript.exe	175
PID 4680 wrote to memory of 4272	4680	WScript.exe	175
PID 4272 wrote to memory of 4508	4272	csrss.exe	176
PID 4272 wrote to memory of 4508	4272	csrss.exe	176
PID 4272 wrote to memory of 4360	4272	csrss.exe	177
PID 4272 wrote to memory of 4360	4272	csrss.exe	177
PID 4508 wrote to memory of 4636	4508	WScript.exe	178
PID 4508 wrote to memory of 4636	4508	WScript.exe	178
PID 4636 wrote to memory of 3264	4636	csrss.exe	179
PID 4636 wrote to memory of 3264	4636	csrss.exe	179
PID 4636 wrote to memory of 3372	4636	csrss.exe	180
PID 4636 wrote to memory of 3372	4636	csrss.exe	180
PID 4564 wrote to memory of 3960	4564	csrss.exe	182
PID 4564 wrote to memory of 3960	4564	csrss.exe	182
PID 4564 wrote to memory of 4192	4564	csrss.exe	183
PID 4564 wrote to memory of 4192	4564	csrss.exe	183
PID 3960 wrote to memory of 3272	3960	WScript.exe	184
PID 3960 wrote to memory of 3272	3960	WScript.exe	184
PID 3272 wrote to memory of 3824	3272	csrss.exe	185
PID 3272 wrote to memory of 3824	3272	csrss.exe	185
PID 3272 wrote to memory of 464	3272	csrss.exe	186
PID 3272 wrote to memory of 464	3272	csrss.exe	186
PID 3824 wrote to memory of 948	3824	WScript.exe	187
PID 3824 wrote to memory of 948	3824	WScript.exe	187
PID 948 wrote to memory of 3388	948	csrss.exe	188
PID 948 wrote to memory of 3388	948	csrss.exe	188
PID 948 wrote to memory of 4932	948	csrss.exe	189
PID 948 wrote to memory of 4932	948	csrss.exe	189
PID 3388 wrote to memory of 1972	3388	WScript.exe	190
PID 3388 wrote to memory of 1972	3388	WScript.exe	190
PID 1972 wrote to memory of 4928	1972	csrss.exe	191
PID 1972 wrote to memory of 4928	1972	csrss.exe	191
PID 1972 wrote to memory of 1472	1972	csrss.exe	192
PID 1972 wrote to memory of 1472	1972	csrss.exe	192

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0c1b8d8d00d578c844a14875fb7599d3.exe
"C:\Users\Admin\AppData\Local\Temp\0c1b8d8d00d578c844a14875fb7599d3.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x4Y6QG4qwI.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3400
- - C:\Users\Admin\AppData\Local\Temp\0c1b8d8d00d578c844a14875fb7599d3.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1b8d8d00d578c844a14875fb7599d3.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Checks computer location settings
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1960
  - - C:\Users\Public\Desktop\csrss.exe
      "C:\Users\Public\Desktop\csrss.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4552
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7175768e-b881-4e78-a130-8fcf90371e7a.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1240
      - C:\Users\Public\Desktop\csrss.exe
        
        C:\Users\Public\Desktop\csrss.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3404
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac9a806b-ed44-45dc-9a10-b45892faccdc.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2260
        
        C:\Users\Public\Desktop\csrss.exe
        
        C:\Users\Public\Desktop\csrss.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1124
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a0e1e4f2-226b-4b63-9866-a8672a17560a.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Users\Public\Desktop\csrss.exe
        
        C:\Users\Public\Desktop\csrss.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26a9acf8-1a5e-4ec9-8a55-a9c4845e6b9f.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Users\Public\Desktop\csrss.exe
        
        C:\Users\Public\Desktop\csrss.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df258e26-c133-44d1-8b36-0fa5b36ed4dc.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Users\Public\Desktop\csrss.exe
        
        C:\Users\Public\Desktop\csrss.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4636
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc584289-534f-4a1a-a1f2-63023f7d5f8f.vbs"
        15⤵
        
        PID:3264
        
        C:\Users\Public\Desktop\csrss.exe
        
        C:\Users\Public\Desktop\csrss.exe
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4564
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c1d8444a-3410-4fcc-833f-02d433b991f0.vbs"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Users\Public\Desktop\csrss.exe
        
        C:\Users\Public\Desktop\csrss.exe
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\34e45682-3b6e-4792-bcf1-53c608d10902.vbs"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:3824
        
        C:\Users\Public\Desktop\csrss.exe
        
        C:\Users\Public\Desktop\csrss.exe
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d6ad8be2-2e17-4596-afab-23f18fffaee0.vbs"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Users\Public\Desktop\csrss.exe
        
        C:\Users\Public\Desktop\csrss.exe
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\03f31fdb-0135-4cfd-8913-49e9dfff475f.vbs"
        23⤵
        
        PID:4928
        
        C:\Users\Public\Desktop\csrss.exe
        
        C:\Users\Public\Desktop\csrss.exe
        24⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:368
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1b897d2-c1d2-482b-b5dc-9b0e73af73f0.vbs"
        23⤵
        
        PID:1472
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f494181-83cd-4670-9961-f61c705b1600.vbs"
        21⤵
        
        PID:4932
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0d45962c-8d0c-4b19-92ba-29e4e068ea24.vbs"
        19⤵
        
        PID:464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\37b2f9a8-2159-4638-8833-12d61716a783.vbs"
        17⤵
        
        PID:4192
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f289fba-2e0a-4113-bcba-02ec83b82dec.vbs"
        15⤵
        
        PID:3372
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea1c5095-0992-4fb0-81e9-2fad8c073f26.vbs"
        13⤵
        
        PID:4360
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\888d4c12-9c29-4fa9-81bf-b8912802a8e8.vbs"
        11⤵
        
        PID:4548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ddbcaa8f-e263-412d-8d19-520e4c23cd32.vbs"
        9⤵
        
        PID:2912
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\752b12a3-f2bd-4737-8a28-449554607741.vbs"
        7⤵
        
        PID:2596
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f97c2092-470d-4cc9-a778-06cf1254c16b.vbs"
        5⤵
        
        PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "0c1b8d8d00d578c844a14875fb7599d30" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\0c1b8d8d00d578c844a14875fb7599d3.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "0c1b8d8d00d578c844a14875fb7599d3" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\0c1b8d8d00d578c844a14875fb7599d3.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "0c1b8d8d00d578c844a14875fb7599d30" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\0c1b8d8d00d578c844a14875fb7599d3.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\unsecapp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Pictures\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Public\Pictures\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Pictures\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Downloads\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Downloads\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Downloads\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files\dotnet\host\fxr\7.0.16\upfc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\dotnet\host\fxr\7.0.16\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Program Files\dotnet\host\fxr\7.0.16\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office 15\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office 15\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Windows\CbsTemp\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\CbsTemp\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Windows\CbsTemp\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Windows\Provisioning\Cosa\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Provisioning\Cosa\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\Provisioning\Cosa\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Windows\appcompat\appraiser\Telemetry\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\appcompat\appraiser\Telemetry\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Windows\appcompat\appraiser\Telemetry\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Desktop\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Desktop\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Desktop\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0c1b8d8d00d578c844a14875fb7599d3.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\0c1b8d8d00d578c844a14875fb7599d3.exe.log
Size 1KB
SHA256 2b1ffeab025cc7c61c50e3e2e4c9253046d9174cf00181a8c1de733a4c0daa14
MD5 655010c15ea0ca05a6e5ddcd84986b98
SHA1 120bf7e516aeed462c07625fbfcdab5124ad05d3
SHA512 e52c26718d7d1e979837b5ac626dde26920fe7413b8aa7be6f1be566a1b0f035582f4d313400e3ad6b92552abb1dfaf186b60b875fb955a2a94fd839fe841437
MD5 SHA1 SHA512

Submit Download

csrss.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log
Size 1KB
SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
MD5 49b64127208271d8f797256057d0b006
SHA1 b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
SHA512 f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e
MD5 SHA1 SHA512

Submit Download

03f31fdb-0135-4cfd-8913-49e9dfff475f.vbs

Path C:\Users\Admin\AppData\Local\Temp\03f31fdb-0135-4cfd-8913-49e9dfff475f.vbs
Size 709B
SHA256 98da353966825dcc8e109a4dfd24265880db640d6f52c8a815d900984781cdd1
MD5 44752a14e2610219fe51eb522cc74d66
SHA1 6948f33246b0594a8e3033a0ab87a5545c4d04b7
SHA512 bec7c874a2553ac11154dee01af5a72f7b18a7cc7ed45517c4414414ad495e81b0f3ab954e1bdd8974c97546b802556666d49ee000aae54eee51296dc60aaff7
MD5 SHA1 SHA512

Submit Download

26a9acf8-1a5e-4ec9-8a55-a9c4845e6b9f.vbs

Path C:\Users\Admin\AppData\Local\Temp\26a9acf8-1a5e-4ec9-8a55-a9c4845e6b9f.vbs
Size 709B
SHA256 1678ec443bb535911665ca725254fe1ef7b89458de6d1606729685fb3c4aa8b7
MD5 bff705390a4a1d962e7bab77dde1c2be
SHA1 e932630de54cb31573cb879c8c02383b1b701f16
SHA512 1490c1b0e6f520a542387e846dafd48831250761fe0113520629591c7f65b7ecdb0192537f90e5de546d622c35f41743187061e1d5317138aa2b35046193e2a2
MD5 SHA1 SHA512

Submit Download

34e45682-3b6e-4792-bcf1-53c608d10902.vbs

Path C:\Users\Admin\AppData\Local\Temp\34e45682-3b6e-4792-bcf1-53c608d10902.vbs
Size 709B
SHA256 2e8a53e3240b242ecd6fe4933cbb2049a4c27b7b31fc18f4b67e58f010bd0f0a
MD5 e13a3aa50e43a1273de8e872bce800c5
SHA1 e170d7e1ce74a3e2b84e1339502eaef20656ec6c
SHA512 0de18c377f63db10053cdf358508923dd20b7e71b73361d4ff702951140c144e1bc45bb6d156a1990fa83a9e2f31dc056cd0c93899e86d8e84fc16d168230cc5
MD5 SHA1 SHA512

Submit Download

7175768e-b881-4e78-a130-8fcf90371e7a.vbs

Path C:\Users\Admin\AppData\Local\Temp\7175768e-b881-4e78-a130-8fcf90371e7a.vbs
Size 709B
SHA256 09b1998120188f04da41caeda9e88ad6d8801b7aaa50747a460a378a4eedf481
MD5 5d714738b5601b5f6015bd1c82735b34
SHA1 1db89e908763f935aa08daa5df0137eb39f83361
SHA512 d7664a0795ca9459bd7098c034cd1c11342974dd07ef46bee990c884028e899e9a4a3d2efc35162feb6310eba8af677200f1a856968a849a757ca118f9dff335
MD5 SHA1 SHA512

Submit Download

a0e1e4f2-226b-4b63-9866-a8672a17560a.vbs

Path C:\Users\Admin\AppData\Local\Temp\a0e1e4f2-226b-4b63-9866-a8672a17560a.vbs
Size 709B
SHA256 8eb356b5e9474d099aaf452ee438078d13193d2eaa82be7228833cfb2eea5d16
MD5 bd8d6bf5d10a6f34275eee8a7bc81381
SHA1 85e59e9e2263b6ce2cd84296a72cee029d51006f
SHA512 a445a564070202102169a58569713e9660a7bbc670538d01ee890e81ed5e43b51d2a8c7aae6df5c3eb898577a0f6b86e0b98986a8262853770d344604689a09c
MD5 SHA1 SHA512

Submit Download

a2a5173e342e90b07777679e3347833237e60b55.exe

Path C:\Users\Admin\AppData\Local\Temp\a2a5173e342e90b07777679e3347833237e60b55.exe
Size 3.4MB
SHA256 b6c1f3994dda4346abe43b7eb8ca9bca2a9848aa2f31053f462d6394c6c0b634
MD5 4401fc16cb8a92e1c037a5de0d3ebbb8
SHA1 dc64426b43273be75d88af98d6198e34f3ee9272
SHA512 7e607afa14c6d845732738f4923b47c02532353933b2e34272fbe31306bb46dad425b78a0cb8e2aa9481f8bd58f2f154e3ffa03fe243f4850ec4e37fa83ac913
SSDEEP 49152:oNYaZhQT1Wrf+VEo0k/3t/A/6jrX1zi4lernnF4iY5tTw/L/JZMAXHmOm:kYaZhQJWrWqA/3t/pD15eTv/JmAXm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ac9a806b-ed44-45dc-9a10-b45892faccdc.vbs

Path C:\Users\Admin\AppData\Local\Temp\ac9a806b-ed44-45dc-9a10-b45892faccdc.vbs
Size 709B
SHA256 1d6981170830ab9128ba1ca0153f8622e5ee6b2177a025c46c37c84129f12146
MD5 4b8b4bfe862973379a1ecd8f47dcc743
SHA1 8f16bf383b56a13e213974d35a4fa32e9cc49eca
SHA512 d3aa0cff5ba4f357a800d1b6ca7d02d6c29012d0ce98bb0028d19c4b408fdc5966720f456d0114dbb9f0aeac436cf9b836823976b07804421fbdc716f99358bc
MD5 SHA1 SHA512

Submit Download

c1d8444a-3410-4fcc-833f-02d433b991f0.vbs

Path C:\Users\Admin\AppData\Local\Temp\c1d8444a-3410-4fcc-833f-02d433b991f0.vbs
Size 709B
SHA256 addbad0c664b67c5f976096ca5eaf3dbb1df0a7571860d5120d880ad35469bef
MD5 7c90d72a23ebb0fbfc0de167ed6f77d4
SHA1 d161316471c7b95ce05b5b0d71a250e2108f6fe2
SHA512 59ad011e8e0b7c6dc08a092878d667bce51f65635d3c1ec8f2b5eb5a42ac99999e306b0d23e58becea3ab479dc150e781c89126033d74baf18ec61f269be094f
MD5 SHA1 SHA512

Submit Download

d6ad8be2-2e17-4596-afab-23f18fffaee0.vbs

Path C:\Users\Admin\AppData\Local\Temp\d6ad8be2-2e17-4596-afab-23f18fffaee0.vbs
Size 708B
SHA256 c9a70b1933da77a46726030873ffe802bc573034ff9f681794d503b0da124c26
MD5 0a47784f336a929bf6ccf0bd3491bba0
SHA1 e4dd2de94d15505e41bcefb8c3e34b7d18cd5e78
SHA512 7cda76e6309499cf4a54bc5eada0c4ecdc59e5b04bd720e37e1d2aa679a6d3595b79273a6142c032641750627ead46c2d7cff1b33f09abaccb282a26eb241272
MD5 SHA1 SHA512

Submit Download

df258e26-c133-44d1-8b36-0fa5b36ed4dc.vbs

Path C:\Users\Admin\AppData\Local\Temp\df258e26-c133-44d1-8b36-0fa5b36ed4dc.vbs
Size 709B
SHA256 c25be82060543b77b47df77adb43c8158aef81312ec797d2707264623fb237eb
MD5 fb1641afa34a985aaa762bce9df7b8a1
SHA1 a0e63b53ae509db78603cd53c533458748d1d18b
SHA512 f89208687cd1f4202ab284e726d6ec6622197b1f81a66db20d4112b7e2a121e64eb61aaeeec1c5586b7e132aeb1a03ae1aab2699f594cff57a6be797ab0d8d14
MD5 SHA1 SHA512

Submit Download

f97c2092-470d-4cc9-a778-06cf1254c16b.vbs

Path C:\Users\Admin\AppData\Local\Temp\f97c2092-470d-4cc9-a778-06cf1254c16b.vbs
Size 485B
SHA256 e912e76576871427e09e37b7c5c5295e43cc12ffbaf912efe31702ba7d12441e
MD5 b3028e75e6901fafe2b88978aedd09c0
SHA1 92cef0998fa9d288e82dc723da8b36480169f7f3
SHA512 baa16bb94ac7627df521a37ad24f80a9ae33f4ce2b4ca947ddc4fdb4832021adfd19490a75a1abcab1bc3529647101c3cb2357047224157690ef370c3998667f
MD5 SHA1 SHA512

Submit Download

x4Y6QG4qwI.bat

Path C:\Users\Admin\AppData\Local\Temp\x4Y6QG4qwI.bat
Size 235B
SHA256 6af734b649baad7d204d4d44aba703de4e72bf63fb9f9c605c356eb3155ead9a
MD5 67e92a7793e5a800ff010f8268f81a96
SHA1 2e14ccedcb1b1c3725d75b6fb9b64264a055bf31
SHA512 8bc9161d6b21e0ac56436410975432d0e2bf3d6564737f235b3e3d96f381991d912dea9f6fd7766ab17151479866dda2ca42ea750abe46f16e634bd30640713d
MD5 SHA1 SHA512

Submit Download

winlogon.exe

Path C:\Users\Public\Downloads\winlogon.exe
Size 3.4MB
SHA256 3fa6ddcabcb03763ef1887117e16ebdf0553a1cc2a16b58bdecaba0735d4e60a
MD5 0c1b8d8d00d578c844a14875fb7599d3
SHA1 863f7b4b56908cb442ca705be7df48f3c96bf46b
SHA512 2f58e2f549a34c8b7dd00d709c244b9b767d148922a74ae1762cad72c01be9564cab30efc5bf6c7dc138df7124eb81ee6ed83acac737a202ad81f0de57a3b559
SSDEEP 49152:TNYaZhQT1Wrf+VEo0k/3t/A/6jrX1zi4lernnF4iY5tTw/L/JZMAXHmOm:5YaZhQJWrWqA/3t/pD15eTv/JmAXm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/368-216-0x000000001BFF0000-0x000000001C002000-memory.dmp

Download

memory/948-193-0x000000001CDF0000-0x000000001CE02000-memory.dmp

Download

memory/1124-125-0x000000001CC40000-0x000000001CC52000-memory.dmp

Download

memory/2600-137-0x000000001CDF0000-0x000000001CE02000-memory.dmp

Download

memory/3272-181-0x000000001C9F0000-0x000000001CA02000-memory.dmp

Download

memory/4004-15-0x000000001B090000-0x000000001B0A0000-memory.dmp

Download

memory/4004-76-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Download

memory/4004-23-0x000000001BE10000-0x000000001C338000-memory.dmp

Download

memory/4004-24-0x000000001B8E0000-0x000000001B8EC000-memory.dmp

Download

memory/4004-25-0x000000001B8F0000-0x000000001B8FC000-memory.dmp

Download

memory/4004-27-0x000000001B910000-0x000000001B91C000-memory.dmp

Download

memory/4004-26-0x000000001B900000-0x000000001B908000-memory.dmp

Download

memory/4004-28-0x000000001B920000-0x000000001B92C000-memory.dmp

Download

memory/4004-29-0x000000001BA40000-0x000000001BA48000-memory.dmp

Download

memory/4004-30-0x000000001BA30000-0x000000001BA3C000-memory.dmp

Download

memory/4004-36-0x000000001BBA0000-0x000000001BBAC000-memory.dmp

Download

memory/4004-38-0x000000001BBC0000-0x000000001BBCA000-memory.dmp

Download

memory/4004-35-0x000000001BB90000-0x000000001BB98000-memory.dmp

Download

memory/4004-34-0x000000001BB80000-0x000000001BB8E000-memory.dmp

Download

memory/4004-33-0x000000001BB70000-0x000000001BB78000-memory.dmp

Download

memory/4004-32-0x000000001BB60000-0x000000001BB6E000-memory.dmp

Download

memory/4004-31-0x000000001BA50000-0x000000001BA5A000-memory.dmp

Download

memory/4004-39-0x000000001BBD0000-0x000000001BBDC000-memory.dmp

Download

memory/4004-37-0x000000001BBB0000-0x000000001BBB8000-memory.dmp

Download

memory/4004-21-0x000000001B8A0000-0x000000001B8A8000-memory.dmp

Download

memory/4004-20-0x000000001B0E0000-0x000000001B0EC000-memory.dmp

Download

memory/4004-22-0x000000001B8B0000-0x000000001B8C2000-memory.dmp

Download

memory/4004-19-0x000000001B0D0000-0x000000001B0D8000-memory.dmp

Download

memory/4004-18-0x000000001B0C0000-0x000000001B0CC000-memory.dmp

Download

memory/4004-17-0x000000001B850000-0x000000001B8A6000-memory.dmp

Download

memory/4004-16-0x000000001B0B0000-0x000000001B0BA000-memory.dmp

Download

memory/4004-0-0x00007FFB82733000-0x00007FFB82735000-memory.dmp

Download

memory/4004-14-0x000000001B080000-0x000000001B088000-memory.dmp

Download

memory/4004-13-0x000000001B0A0000-0x000000001B0AC000-memory.dmp

Download

memory/4004-12-0x000000001B070000-0x000000001B082000-memory.dmp

Download

memory/4004-7-0x000000001B700000-0x000000001B750000-memory.dmp

Download

memory/4004-10-0x000000001B030000-0x000000001B046000-memory.dmp

Download

memory/4004-11-0x000000001B060000-0x000000001B068000-memory.dmp

Download

memory/4004-9-0x000000001B020000-0x000000001B030000-memory.dmp

Download

memory/4004-8-0x0000000002630000-0x0000000002638000-memory.dmp

Download

memory/4004-6-0x0000000002610000-0x000000000262C000-memory.dmp

Download

memory/4004-5-0x0000000002600000-0x0000000002608000-memory.dmp

Download

memory/4004-4-0x00000000025F0000-0x00000000025FE000-memory.dmp

Download

memory/4004-3-0x00000000025E0000-0x00000000025EE000-memory.dmp

Download

memory/4004-2-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Download

memory/4004-1-0x0000000000060000-0x00000000003CA000-memory.dmp

Download

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\explorer.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\upfc.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\", \"C:\\Users\\Default User\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\Registry.exe\", \"C:\\Windows\\CbsTemp\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Cosa\\wininit.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\Windows\\appcompat\\appraiser\\Telemetry\\StartMenuExperienceHost.exe\", \"C:\\Users\\Admin\\lsass.exe\", \"C:\\Users\\Public\\Desktop\\csrss.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\explorer.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\upfc.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\", \"C:\\Users\\Default User\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\Registry.exe\", \"C:\\Windows\\CbsTemp\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RuntimeBroker.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\explorer.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\upfc.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\explorer.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\upfc.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\", \"C:\\Users\\Default User\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\Registry.exe\", \"C:\\Windows\\CbsTemp\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Cosa\\wininit.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\explorer.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\upfc.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\explorer.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\upfc.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\explorer.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\upfc.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\", \"C:\\Users\\Default User\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\Registry.exe\", \"C:\\Windows\\CbsTemp\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\explorer.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\upfc.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\", \"C:\\Users\\Default User\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\Registry.exe\", \"C:\\Windows\\CbsTemp\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Cosa\\wininit.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\explorer.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\upfc.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\", \"C:\\Users\\Default User\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\Registry.exe\", \"C:\\Windows\\CbsTemp\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Cosa\\wininit.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\Windows\\appcompat\\appraiser\\Telemetry\\StartMenuExperienceHost.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\explorer.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\upfc.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\backgroundTaskHost.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\explorer.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\upfc.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\", \"C:\\Users\\Default User\\StartMenuExperienceHost.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\explorer.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\upfc.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\", \"C:\\Users\\Default User\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\Registry.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\explorer.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\upfc.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\", \"C:\\Users\\Default User\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\Registry.exe\", \"C:\\Windows\\CbsTemp\\fontdrvhost.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\explorer.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\upfc.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\", \"C:\\Users\\Default User\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\Registry.exe\", \"C:\\Windows\\CbsTemp\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Cosa\\wininit.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\Windows\\appcompat\\appraiser\\Telemetry\\StartMenuExperienceHost.exe\", \"C:\\Users\\Admin\\lsass.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\0c1b8d8d00d578c844a14875fb7599d3.exe\", \"C:\\Program Files\\Windows Mail\\unsecapp.exe\", \"C:\\Users\\Public\\Pictures\\sysmon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\sppsvc.exe\", \"C:\\Users\\Public\\Downloads\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\explorer.exe\""	0c1b8d8d00d578c844a14875fb7599d3.exe