dcrat | b108df3575c8f9c77577486a92b52fe55bfb6508acca68b22250d8e1fc0494fb

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
16d52786d50d7c0bad6ef837ec04aa3c.exe
Size 3.7MB
Sample240615-e2hsysyfnf
SHA256 b108df3575c8f9c77577486a92b52fe55bfb6508acca68b22250d8e1fc0494fb
MD5 16d52786d50d7c0bad6ef837ec04aa3c
SHA1 ffa63681d10949806d3a8de68610460271062ffe
SHA512 300977924a08fab4f6885ad7e3616580313b8f0612b45545a95666563a2459967e5cc0660b6f059507521ae47ae3a04e661875a8032aa8569d98e00ac3815603
SSDEEP 49152:PbA3n+NYaZhQT1Wrf+VEo0k/3t/A/6jrX1zi4lernnF4iY5tTw/L/JZMAXHmOm1:PbJYaZhQJWrWqA/3t/pD15eTv/JmAXmv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 31 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		1916	schtasks.exe
		880	schtasks.exe
		560	schtasks.exe
		1608	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		bridgewinref.exe
		488	schtasks.exe
		600	schtasks.exe
		2108	schtasks.exe
		1484	schtasks.exe
		2744	schtasks.exe
		2024	schtasks.exe
		764	schtasks.exe
		2156	schtasks.exe
		2872	schtasks.exe
		2972	schtasks.exe
		2284	schtasks.exe
		2580	schtasks.exe
		1516	schtasks.exe
		2300	schtasks.exe
		1972	schtasks.exe
		2080	schtasks.exe
		2632	schtasks.exe
		1684	schtasks.exe
		708	schtasks.exe
		1544	schtasks.exe
		2032	schtasks.exe
		2304	schtasks.exe
		1604	schtasks.exe
		1672	schtasks.exe
		2344	schtasks.exe
		1432	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\dwm.exe\", \"C:\\Windows\\Help\\Help\\en-US\\smss.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\dwm.exe\", \"C:\\Windows\\Help\\Help\\en-US\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\dwm.exe\", \"C:\\Windows\\Help\\Help\\en-US\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Users\\Default\\Application Data\\cmd.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\dwm.exe\", \"C:\\Windows\\Help\\Help\\en-US\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Users\\Default\\Application Data\\cmd.exe\", \"C:\\agentreviewinto\\csrss.exe\", \"C:\\agentreviewinto\\smss.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\dwm.exe\", \"C:\\Windows\\Help\\Help\\en-US\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Users\\Default\\Application Data\\cmd.exe\", \"C:\\agentreviewinto\\csrss.exe\", \"C:\\agentreviewinto\\smss.exe\", \"C:\\Windows\\twain_32\\conhost.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\dwm.exe\", \"C:\\Windows\\Help\\Help\\en-US\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Users\\Default\\Application Data\\cmd.exe\", \"C:\\agentreviewinto\\csrss.exe\", \"C:\\agentreviewinto\\smss.exe\", \"C:\\Windows\\twain_32\\conhost.exe\", \"C:\\Windows\\BitLockerDiscoveryVolumeContents\\lsass.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\audiodg.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\dwm.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\dwm.exe\", \"C:\\Windows\\Help\\Help\\en-US\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Users\\Default\\Application Data\\cmd.exe\", \"C:\\agentreviewinto\\csrss.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\dwm.exe\", \"C:\\Windows\\Help\\Help\\en-US\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Users\\Default\\Application Data\\cmd.exe\", \"C:\\agentreviewinto\\csrss.exe\", \"C:\\agentreviewinto\\smss.exe\", \"C:\\Windows\\twain_32\\conhost.exe\", \"C:\\Windows\\BitLockerDiscoveryVolumeContents\\lsass.exe\", \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\lsass.exe\""	bridgewinref.exe

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	488	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	600	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	2668	schtasks.exe	33

UAC bypass 3 TTPs 42 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bridgewinref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bridgewinref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bridgewinref.exe

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000015d9c-14.dat	dcrat
behavioral1/memory/344-18-0x0000000001160000-0x00000000014CA000-memory.dmp	dcrat
behavioral1/memory/292-80-0x00000000013A0000-0x000000000170A000-memory.dmp	dcrat
behavioral1/memory/2544-92-0x00000000003F0000-0x000000000075A000-memory.dmp	dcrat
behavioral1/memory/2276-104-0x0000000000FE0000-0x000000000134A000-memory.dmp	dcrat
behavioral1/memory/2040-116-0x0000000001000000-0x000000000136A000-memory.dmp	dcrat
behavioral1/memory/2684-141-0x0000000000150000-0x00000000004BA000-memory.dmp	dcrat
behavioral1/memory/2848-154-0x0000000000C10000-0x0000000000F7A000-memory.dmp	dcrat
behavioral1/memory/2468-200-0x0000000001340000-0x00000000016AA000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Executes dropped EXE 14 IoCs

pid	Process
344	bridgewinref.exe
292	lsass.exe
2544	lsass.exe
2276	lsass.exe
2040	lsass.exe
296	lsass.exe
2684	lsass.exe
2848	lsass.exe
2340	lsass.exe
952	lsass.exe
2316	lsass.exe
2468	lsass.exe
2492	lsass.exe
872	lsass.exe

Loads dropped DLL 2 IoCs

pid	Process
2152	cmd.exe
2152	cmd.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\dwm.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\Help\\Help\\en-US\\smss.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\lsass.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\BitLockerDiscoveryVolumeContents\\lsass.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\BitLockerDiscoveryVolumeContents\\lsass.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\dwm.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Users\\Default\\Application Data\\cmd.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Users\\Default\\Application Data\\cmd.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\agentreviewinto\\csrss.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\agentreviewinto\\smss.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\audiodg.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\audiodg.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\Help\\Help\\en-US\\smss.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\lsass.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\agentreviewinto\\csrss.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\agentreviewinto\\smss.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\twain_32\\conhost.exe\""	bridgewinref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\twain_32\\conhost.exe\""	bridgewinref.exe

Checks whether UAC is enabled 1 TTPs 28 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bridgewinref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bridgewinref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\twain_32\088424020bedd6	bridgewinref.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe	bridgewinref.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\6203df4a6bafc7	bridgewinref.exe
File created	C:\Windows\Help\Help\en-US\smss.exe	bridgewinref.exe
File created	C:\Windows\Help\Help\en-US\69ddcba757bf72	bridgewinref.exe
File created	C:\Windows\twain_32\conhost.exe	bridgewinref.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
600	schtasks.exe
1484	schtasks.exe
2156	schtasks.exe
2304	schtasks.exe
2300	schtasks.exe
2872	schtasks.exe
1916	schtasks.exe
1672	schtasks.exe
2284	schtasks.exe
764	schtasks.exe
2972	schtasks.exe
880	schtasks.exe
2580	schtasks.exe
2632	schtasks.exe
1604	schtasks.exe
488	schtasks.exe
560	schtasks.exe
1544	schtasks.exe
1516	schtasks.exe
2080	schtasks.exe
2108	schtasks.exe
2032	schtasks.exe
1432	schtasks.exe
2744	schtasks.exe
708	schtasks.exe
1608	schtasks.exe
2024	schtasks.exe
1684	schtasks.exe
1972	schtasks.exe
2344	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2368	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
344	bridgewinref.exe
344	bridgewinref.exe
344	bridgewinref.exe
344	bridgewinref.exe
344	bridgewinref.exe
344	bridgewinref.exe
344	bridgewinref.exe
344	bridgewinref.exe
344	bridgewinref.exe
344	bridgewinref.exe
344	bridgewinref.exe
344	bridgewinref.exe
344	bridgewinref.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe
292	lsass.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	344	bridgewinref.exe
Token: SeDebugPrivilege	292	lsass.exe
Token: SeDebugPrivilege	2544	lsass.exe
Token: SeDebugPrivilege	2276	lsass.exe
Token: SeDebugPrivilege	2040	lsass.exe
Token: SeDebugPrivilege	296	lsass.exe
Token: SeDebugPrivilege	2684	lsass.exe
Token: SeDebugPrivilege	2848	lsass.exe
Token: SeDebugPrivilege	2340	lsass.exe
Token: SeDebugPrivilege	952	lsass.exe
Token: SeDebugPrivilege	2316	lsass.exe
Token: SeDebugPrivilege	2468	lsass.exe
Token: SeDebugPrivilege	2492	lsass.exe
Token: SeDebugPrivilege	872	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2480	1636	16d52786d50d7c0bad6ef837ec04aa3c.exe	28
PID 1636 wrote to memory of 2480	1636	16d52786d50d7c0bad6ef837ec04aa3c.exe	28
PID 1636 wrote to memory of 2480	1636	16d52786d50d7c0bad6ef837ec04aa3c.exe	28
PID 1636 wrote to memory of 2480	1636	16d52786d50d7c0bad6ef837ec04aa3c.exe	28
PID 1636 wrote to memory of 2220	1636	16d52786d50d7c0bad6ef837ec04aa3c.exe	29
PID 1636 wrote to memory of 2220	1636	16d52786d50d7c0bad6ef837ec04aa3c.exe	29
PID 1636 wrote to memory of 2220	1636	16d52786d50d7c0bad6ef837ec04aa3c.exe	29
PID 1636 wrote to memory of 2220	1636	16d52786d50d7c0bad6ef837ec04aa3c.exe	29
PID 2480 wrote to memory of 2152	2480	WScript.exe	30
PID 2480 wrote to memory of 2152	2480	WScript.exe	30
PID 2480 wrote to memory of 2152	2480	WScript.exe	30
PID 2480 wrote to memory of 2152	2480	WScript.exe	30
PID 2152 wrote to memory of 344	2152	cmd.exe	32
PID 2152 wrote to memory of 344	2152	cmd.exe	32
PID 2152 wrote to memory of 344	2152	cmd.exe	32
PID 2152 wrote to memory of 344	2152	cmd.exe	32
PID 344 wrote to memory of 292	344	bridgewinref.exe	64
PID 344 wrote to memory of 292	344	bridgewinref.exe	64
PID 344 wrote to memory of 292	344	bridgewinref.exe	64
PID 2152 wrote to memory of 2368	2152	cmd.exe	65
PID 2152 wrote to memory of 2368	2152	cmd.exe	65
PID 2152 wrote to memory of 2368	2152	cmd.exe	65
PID 2152 wrote to memory of 2368	2152	cmd.exe	65
PID 292 wrote to memory of 1580	292	lsass.exe	66
PID 292 wrote to memory of 1580	292	lsass.exe	66
PID 292 wrote to memory of 1580	292	lsass.exe	66
PID 292 wrote to memory of 2812	292	lsass.exe	67
PID 292 wrote to memory of 2812	292	lsass.exe	67
PID 292 wrote to memory of 2812	292	lsass.exe	67
PID 1580 wrote to memory of 2544	1580	WScript.exe	68
PID 1580 wrote to memory of 2544	1580	WScript.exe	68
PID 1580 wrote to memory of 2544	1580	WScript.exe	68
PID 2544 wrote to memory of 2408	2544	lsass.exe	69
PID 2544 wrote to memory of 2408	2544	lsass.exe	69
PID 2544 wrote to memory of 2408	2544	lsass.exe	69
PID 2544 wrote to memory of 836	2544	lsass.exe	70
PID 2544 wrote to memory of 836	2544	lsass.exe	70
PID 2544 wrote to memory of 836	2544	lsass.exe	70
PID 2408 wrote to memory of 2276	2408	WScript.exe	71
PID 2408 wrote to memory of 2276	2408	WScript.exe	71
PID 2408 wrote to memory of 2276	2408	WScript.exe	71
PID 2276 wrote to memory of 356	2276	lsass.exe	72
PID 2276 wrote to memory of 356	2276	lsass.exe	72
PID 2276 wrote to memory of 356	2276	lsass.exe	72
PID 2276 wrote to memory of 2980	2276	lsass.exe	73
PID 2276 wrote to memory of 2980	2276	lsass.exe	73
PID 2276 wrote to memory of 2980	2276	lsass.exe	73
PID 356 wrote to memory of 2040	356	WScript.exe	74
PID 356 wrote to memory of 2040	356	WScript.exe	74
PID 356 wrote to memory of 2040	356	WScript.exe	74
PID 2040 wrote to memory of 1416	2040	lsass.exe	77
PID 2040 wrote to memory of 1416	2040	lsass.exe	77
PID 2040 wrote to memory of 1416	2040	lsass.exe	77
PID 2040 wrote to memory of 1792	2040	lsass.exe	78
PID 2040 wrote to memory of 1792	2040	lsass.exe	78
PID 2040 wrote to memory of 1792	2040	lsass.exe	78
PID 1416 wrote to memory of 296	1416	WScript.exe	79
PID 1416 wrote to memory of 296	1416	WScript.exe	79
PID 1416 wrote to memory of 296	1416	WScript.exe	79
PID 296 wrote to memory of 1740	296	lsass.exe	80
PID 296 wrote to memory of 1740	296	lsass.exe	80
PID 296 wrote to memory of 1740	296	lsass.exe	80
PID 296 wrote to memory of 2984	296	lsass.exe	81
PID 296 wrote to memory of 2984	296	lsass.exe	81

System policy modification 1 TTPs 42 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bridgewinref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bridgewinref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bridgewinref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\16d52786d50d7c0bad6ef837ec04aa3c.exe
"C:\Users\Admin\AppData\Local\Temp\16d52786d50d7c0bad6ef837ec04aa3c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\agentreviewinto\WzFtekmUii64UgTyfu.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\agentreviewinto\nWl1OEQ6Nk6rkCf4DeE9UBDJxBYy.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\agentreviewinto\bridgewinref.exe
      "C:\agentreviewinto\bridgewinref.exe"
      4⤵
      DcRat
      Modifies WinLogon for persistence
      UAC bypass
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:344
    - - C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:292
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5a39c58-bc3a-4aee-8207-2115d9b010c2.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2544
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b144dfd0-1d0d-4faf-bbaf-96ae4cada632.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2276
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f11626b-4fd9-45cb-bce3-16b39660c927.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:356
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2040
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10520e84-0368-4594-b327-6d5fa2a485b5.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1416
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:296
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26e86f69-5e13-4572-9f7c-75f3af93c5cf.vbs"
        14⤵
        
        PID:1740
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2684
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e806d24b-1ae1-4def-bbb2-476d4ab8ad25.vbs"
        16⤵
        
        PID:2292
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ceac7ca-74bf-42b1-bb96-f6bbdba6ad40.vbs"
        18⤵
        
        PID:1172
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2515c41c-d5e0-439a-88e5-4e51c8ed08f1.vbs"
        20⤵
        
        PID:2096
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        21⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f00d5c3d-4143-439c-85a2-7cc5fb53448c.vbs"
        22⤵
        
        PID:3048
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        23⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2316
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc8541a2-14d1-4748-bc3a-26f6052114c8.vbs"
        24⤵
        
        PID:2388
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        25⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2468
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\254089c4-9c88-4165-86d2-3693ccaf3d13.vbs"
        26⤵
        
        PID:880
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        27⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2492
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5018430-1bdb-4b88-a3b9-8457060b5b73.vbs"
        28⤵
        
        PID:2784
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        
        C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe
        29⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:872
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a39906f-0a83-4052-821f-4d2a2eb101ad.vbs"
        30⤵
        
        PID:112
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cf07bc08-8d52-4a2b-8cf5-eb30e83d8ad9.vbs"
        30⤵
        
        PID:632
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\68f53132-7968-48c4-8e65-7680902f1371.vbs"
        28⤵
        
        PID:1884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d8eedf9-d763-437f-8dda-cc9cde373c24.vbs"
        26⤵
        
        PID:2624
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9c546284-930b-43a8-b668-041ea550b086.vbs"
        24⤵
        
        PID:856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f638e5d9-bd5a-4f27-8d5a-84e820ade57a.vbs"
        22⤵
        
        PID:1668
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0569a8c1-e93a-4ef7-8653-c33a188d7363.vbs"
        20⤵
        
        PID:2144
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c31a3b69-1c56-4a37-a880-3f34b848c0dd.vbs"
        18⤵
        
        PID:2760
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e87e416-4262-47fa-aab7-47cbba38ebd0.vbs"
        16⤵
        
        PID:2036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0d9c42c9-44ed-4092-aa3c-f10c91b3f7ea.vbs"
        14⤵
        
        PID:2984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\61dc2091-3490-4e1b-9510-246024d650e2.vbs"
        12⤵
        
        PID:1792
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27c7cacb-0c97-4fdf-bfa3-74d5a220d0cf.vbs"
        10⤵
        
        PID:2980
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e07f775-c1ee-4cc6-9356-48d725688b61.vbs"
        8⤵
        
        PID:836
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05fc5b84-b2c6-4d42-b947-e57e0403b03b.vbs"
        6⤵
        
        PID:2812
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2368
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\agentreviewinto\file.vbs"
  2⤵
  PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\Help\Help\en-US\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Help\Help\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Windows\Help\Help\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Application Data\cmd.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default\Application Data\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Application Data\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\agentreviewinto\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\agentreviewinto\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\agentreviewinto\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\agentreviewinto\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\agentreviewinto\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\agentreviewinto\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\twain_32\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\twain_32\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\twain_32\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0a39906f-0a83-4052-821f-4d2a2eb101ad.vbs

Path C:\Users\Admin\AppData\Local\Temp\0a39906f-0a83-4052-821f-4d2a2eb101ad.vbs
Size 728B
SHA256 8811900600a34d3d9712b08eace8c8e99c17bda6faf65f7f49c42d8928309b44
MD5 5501ca4771c9f29b283ea521c1befc1d
SHA1 cc3079c8b3fb4fcffbef31ad3b4a7c5cf5dfb8b0
SHA512 56d6b2d069157426d69df4b18100dd0420dd7552a2242e37785a7ab83ecee41b04aca4dd43f90a3226cd0e532d2a6b9291c334f51459dc5e76d0461d51626622
MD5 SHA1 SHA512

Submit Download

0f11626b-4fd9-45cb-bce3-16b39660c927.vbs

Path C:\Users\Admin\AppData\Local\Temp\0f11626b-4fd9-45cb-bce3-16b39660c927.vbs
Size 729B
SHA256 ea27a9591e224d0743b480a0698f6713d4b0b8f2c419e19f33d8fde288ac67ea
MD5 8cd8a893390ec998ee40865aae30ed1b
SHA1 69750385d97eac012eeb8268d65c4a6497f68fcb
SHA512 167aecff2c33ff0e6955683ba4df3c6ecdf225cf3a3336ab2f89dd327b7c99eaa2e86515ec200d350c7b40f65c3fcdcab02d7e54a5ef75020130a596e06bb7cb
MD5 SHA1 SHA512

Submit Download

10520e84-0368-4594-b327-6d5fa2a485b5.vbs

Path C:\Users\Admin\AppData\Local\Temp\10520e84-0368-4594-b327-6d5fa2a485b5.vbs
Size 729B
SHA256 a3b1506799475cae95e8c017d1e000222a518a56f01e173ddb151505fd85d714
MD5 0d3a83fc9315bee6176aecedc08c7891
SHA1 d5a5841942b66d78f9e6ea425e41a22817d9ebbf
SHA512 c30feea8c274baa6d6e47f5e6b42d1b65b82288181a5d600a7c235a0506efde8708f6282ccb5ff85574eef9dfda4edfe57856cd84f8953869cb150d4aa4d55c5
MD5 SHA1 SHA512

Submit Download

2515c41c-d5e0-439a-88e5-4e51c8ed08f1.vbs

Path C:\Users\Admin\AppData\Local\Temp\2515c41c-d5e0-439a-88e5-4e51c8ed08f1.vbs
Size 729B
SHA256 cc8ca6c52923d417a936a986a98b1d101d143afa63c0d3b031fa9694995ad5a4
MD5 53689226d0e9f1c61152498c32fcee1b
SHA1 6855ff9d48210bd81897cae0f17bc81b6b2e1826
SHA512 661e16c7179fd33a321cac163f6aa8fa5c64295a9c994136f3766429ebc44171df04b19cd66045cdc99dace2d8c0e62ca92a4e970bade1193b3d4b00fe692733
MD5 SHA1 SHA512

Submit Download

254089c4-9c88-4165-86d2-3693ccaf3d13.vbs

Path C:\Users\Admin\AppData\Local\Temp\254089c4-9c88-4165-86d2-3693ccaf3d13.vbs
Size 729B
SHA256 31c17d9cf7d1379c4249aa0b4a03c16c0bcf5f1748b42e8c6b13b0a06fc9e648
MD5 55e594f2594a9dc8cb3d3788e5c61a4d
SHA1 d44aff74f385976407e634ba2738709eec2e143a
SHA512 3882f9835ef345bc5b5980202013601f8deae273f2a7e18c3f4a366903a864965e345575c1cc59dc78ae5d040741935a451bebf73aa202a03343117413bfcae0
MD5 SHA1 SHA512

Submit Download

26e86f69-5e13-4572-9f7c-75f3af93c5cf.vbs

Path C:\Users\Admin\AppData\Local\Temp\26e86f69-5e13-4572-9f7c-75f3af93c5cf.vbs
Size 728B
SHA256 26b2410fe4bf1311a1a9dd0d7d51772239fed65e64faed653b16520f8b1e6c38
MD5 11c504fe7132d2776a966bcd0cfecddc
SHA1 e4f5f431ebf7267ead24c832b5cc0834741821c9
SHA512 c8e365c55e7244b75c75797e9e55abeb4dce89b11202197a61bd17955de2f8d6f361d693e93fcaad639ac258ef959ac0233469ce9d7d6626f1779c4e9e41afa0
MD5 SHA1 SHA512

Submit Download

2ceac7ca-74bf-42b1-bb96-f6bbdba6ad40.vbs

Path C:\Users\Admin\AppData\Local\Temp\2ceac7ca-74bf-42b1-bb96-f6bbdba6ad40.vbs
Size 729B
SHA256 4c5d97621efd8ce1ff36c75282bb544cdb9d95fbfc93bf911c38c24b27f92732
MD5 8353ac887f290785fe8e15cf31b267af
SHA1 5d40254a309f518d73b24ae9bab2476bbfd504c5
SHA512 71e578e9ba869dcc47e57cddfcc49ddfb8726b5b75815607d967788b051342ed1eaa0955c8e31c9d250c3af948d9c53fb443b0d8e5ad6fec9c2729ca16ea5c3d
MD5 SHA1 SHA512

Submit Download

8e07f775-c1ee-4cc6-9356-48d725688b61.vbs

Path C:\Users\Admin\AppData\Local\Temp\8e07f775-c1ee-4cc6-9356-48d725688b61.vbs
Size 505B
SHA256 f95fbe014d69e5358a4e4de0ca33169b55e29477e86dc3ff4ab48be78703819b
MD5 1aa6feacf830b1924cdd67471824972c
SHA1 0d249dfbf356c8f1ac684d63bba6baaccb53e52f
SHA512 186bf08f9fb3f19fea50df19b66dae9976123fd1c0546cb0fe7cf7e505fb6ab9a2c47fcaa1f37b546b8a4d7ab2e92356db5fd87a79ba4c5719a382350121644a
MD5 SHA1 SHA512

Submit Download

b144dfd0-1d0d-4faf-bbaf-96ae4cada632.vbs

Path C:\Users\Admin\AppData\Local\Temp\b144dfd0-1d0d-4faf-bbaf-96ae4cada632.vbs
Size 729B
SHA256 060a0f6e56c3e0b26ce9eb4e7dcb16ff0c283d62bbcb073e75e1e2846e978464
MD5 272ae37c176394cd7d7138e18e3d0d7f
SHA1 10e65068843b3fe15b6f1a9b77f8d01764f96dad
SHA512 f69eb654c5c5bb9010f5ae087d111041435e0ff11da5f922a6cf895ed454de8034765d661a6e4714fabee6529d8caade43c2c7ec2b5459b3f836caa5b4a6fb6e
MD5 SHA1 SHA512

Submit Download

bc8541a2-14d1-4748-bc3a-26f6052114c8.vbs

Path C:\Users\Admin\AppData\Local\Temp\bc8541a2-14d1-4748-bc3a-26f6052114c8.vbs
Size 729B
SHA256 624e11ce063ce8181c785a780ce50d98643fa498cfc460a7d27ea2235bda7b3f
MD5 9f70ebe4b988b128faa7590c7c074009
SHA1 62570c5952c34705f1a14eb6c20a987953928226
SHA512 bb67e4686355a87b05d2dfe19bd8a8cacfcd2185d8da4d4b7683df491ccd608f2aadd33de34c35852968aee2aec0a8694f30c304162cccf12905957bc8c09dfd
MD5 SHA1 SHA512

Submit Download

e806d24b-1ae1-4def-bbb2-476d4ab8ad25.vbs

Path C:\Users\Admin\AppData\Local\Temp\e806d24b-1ae1-4def-bbb2-476d4ab8ad25.vbs
Size 729B
SHA256 3c0eebdab70ea0d889f7fe1c01a52d4a94491c9c55f00bfac02289ea14e00331
MD5 43ac195b3f0cb334a0e526a24b5c9f1a
SHA1 d3340c2fafcce5ebcac2b9b157d6744d3cc4787c
SHA512 2d2c4695ee2e1e6a4eb82392187cbedd3556b2a701703667643ac44b7aa83bc7e8af7ee69eb79628c5cd385fcb727fb5d06999b10d2639e37033bc227e665d9a
MD5 SHA1 SHA512

Submit Download

f00d5c3d-4143-439c-85a2-7cc5fb53448c.vbs

Path C:\Users\Admin\AppData\Local\Temp\f00d5c3d-4143-439c-85a2-7cc5fb53448c.vbs
Size 728B
SHA256 d37a30c9a8fd778ac4c5caf83463a7d76a299bc8d08f832e6e58d254346a9913
MD5 627ba769bc71665e604d425d2d110d4f
SHA1 ff4d5139fb375f027a2f6b752d5b6018df80e393
SHA512 10323e5e447331201d14917e0551409fcda7108a7a56ed097a54fa8b5cfaa533fdd1462b57806680fd18c4ece9a6e9fb165e91e0c6a09af349a74dabd96903e9
MD5 SHA1 SHA512

Submit Download

f5018430-1bdb-4b88-a3b9-8457060b5b73.vbs

Path C:\Users\Admin\AppData\Local\Temp\f5018430-1bdb-4b88-a3b9-8457060b5b73.vbs
Size 729B
SHA256 7a94b57108d4a3e5d16253e60bb129dcb9aa45ca370fe31c7a62e6049ebd3247
MD5 aa7714a6ac000c7579d68569db42604c
SHA1 3c2d0829da9479cdbde1c71e3555561ba746c573
SHA512 75546c925d4ef59be46a7f72883772380f95989bb83248c7cd2605033a3ebe365e5f744afd150a629df36909d28b4abff0c641584bb4e5344825c36c52b2b5a5
MD5 SHA1 SHA512

Submit Download

f5a39c58-bc3a-4aee-8207-2115d9b010c2.vbs

Path C:\Users\Admin\AppData\Local\Temp\f5a39c58-bc3a-4aee-8207-2115d9b010c2.vbs
Size 728B
SHA256 03fcca46f3f3fe6d505541162020ad43bd990e9f9188da3c5eec4b12e91b30f7
MD5 2fa6eb1fcf691c9dfd9ed06c08a52434
SHA1 e7f5dbf45f7aa978f0352c2ccfefb84e2fa00cf9
SHA512 be7f0258b5ebbc41415f19391e6daca30e27b4b9a31685c8d7d2538a28337e564cb4ca03ea5b6543ab80e9c4e4efa1d9a109374667b40d30d6b6fed357a5dcc9
MD5 SHA1 SHA512

Submit Download

WzFtekmUii64UgTyfu.vbe

Path C:\agentreviewinto\WzFtekmUii64UgTyfu.vbe
Size 220B
SHA256 ac1b6cedfb687d113c8532430c506b4a69bf6ae687c5a0a9be594e6393ef367b
MD5 ca9932e3dc2092e6a9027a2c8be3347f
SHA1 d25e9ce23e55f4c26ed239b56a89c002c73ca8b7
SHA512 c2636f09c0acaaceac79810ecf97cbdc5afc0cc0b561008a540b618d548a3e8f3a4685757d2299160941da79f22ee5429cdc3c98735f8c3a16fc7f79ec6dc971
MD5 SHA1 SHA512

Submit Download

file.vbs

Path C:\agentreviewinto\file.vbs
Size 34B
SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
MD5 677cc4360477c72cb0ce00406a949c61
SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
MD5 SHA1 SHA512

Submit Download

nWl1OEQ6Nk6rkCf4DeE9UBDJxBYy.bat

Path C:\agentreviewinto\nWl1OEQ6Nk6rkCf4DeE9UBDJxBYy.bat
Size 149B
SHA256 5249fb1b1131f9a0d51ee41c8543bdc75c1564024766574d1796f61fd00a1376
MD5 4a0d4edb4bc9824f0d8337f9ebfd2de9
SHA1 a3dfa9a1c1a753207a1f498934763a735a4738a7
SHA512 e3eca53a8f04d638b6a8b570c9e2a93d6566eff6c23ebbfafca5891d7a7e23869b9abb64c41c9ec226fdb347c2b9f5227a1e6832139b4b79c9c479963e66cbcb
MD5 SHA1 SHA512

Submit Download

bridgewinref.exe

Path \agentreviewinto\bridgewinref.exe
Size 3.4MB
SHA256 3fa6ddcabcb03763ef1887117e16ebdf0553a1cc2a16b58bdecaba0735d4e60a
MD5 0c1b8d8d00d578c844a14875fb7599d3
SHA1 863f7b4b56908cb442ca705be7df48f3c96bf46b
SHA512 2f58e2f549a34c8b7dd00d709c244b9b767d148922a74ae1762cad72c01be9564cab30efc5bf6c7dc138df7124eb81ee6ed83acac737a202ad81f0de57a3b559
SSDEEP 49152:TNYaZhQT1Wrf+VEo0k/3t/A/6jrX1zi4lernnF4iY5tTw/L/JZMAXHmOm:5YaZhQJWrWqA/3t/pD15eTv/JmAXm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/292-82-0x0000000000B60000-0x0000000000BB6000-memory.dmp

Download

memory/292-81-0x0000000000600000-0x0000000000612000-memory.dmp

Download

memory/292-80-0x00000000013A0000-0x000000000170A000-memory.dmp

Download

memory/296-129-0x0000000000490000-0x00000000004A2000-memory.dmp

Download

memory/344-46-0x000000001AAA0000-0x000000001AAAE000-memory.dmp

Download

memory/344-31-0x00000000007A0000-0x00000000007AA000-memory.dmp

Download

memory/344-38-0x0000000000CA0000-0x0000000000CAC000-memory.dmp

Download

memory/344-39-0x0000000000CB0000-0x0000000000CBC000-memory.dmp

Download

memory/344-40-0x0000000000CC0000-0x0000000000CC8000-memory.dmp

Download

memory/344-41-0x0000000001150000-0x000000000115C000-memory.dmp

Download

memory/344-42-0x000000001A9E0000-0x000000001A9EC000-memory.dmp

Download

memory/344-43-0x000000001A9F0000-0x000000001A9F8000-memory.dmp

Download

memory/344-44-0x000000001AA00000-0x000000001AA0C000-memory.dmp

Download

memory/344-45-0x000000001AA90000-0x000000001AA9A000-memory.dmp

Download

memory/344-36-0x0000000000B10000-0x0000000000B18000-memory.dmp

Download

memory/344-47-0x000000001AAB0000-0x000000001AAB8000-memory.dmp

Download

memory/344-48-0x000000001AE90000-0x000000001AE9E000-memory.dmp

Download

memory/344-49-0x000000001AEA0000-0x000000001AEA8000-memory.dmp

Download

memory/344-50-0x000000001B090000-0x000000001B09C000-memory.dmp

Download

memory/344-51-0x000000001B0A0000-0x000000001B0A8000-memory.dmp

Download

memory/344-52-0x000000001B0B0000-0x000000001B0BA000-memory.dmp

Download

memory/344-53-0x000000001B0C0000-0x000000001B0CC000-memory.dmp

Download

memory/344-35-0x0000000000B00000-0x0000000000B0C000-memory.dmp

Download

memory/344-34-0x0000000000AF0000-0x0000000000AF8000-memory.dmp

Download

memory/344-33-0x0000000000AE0000-0x0000000000AEC000-memory.dmp

Download

memory/344-32-0x0000000000C50000-0x0000000000CA6000-memory.dmp

Download

memory/344-18-0x0000000001160000-0x00000000014CA000-memory.dmp

Download

memory/344-37-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

Download

memory/344-30-0x0000000000790000-0x00000000007A0000-memory.dmp

Download

memory/344-19-0x00000000001C0000-0x00000000001CE000-memory.dmp

Download

memory/344-29-0x0000000000780000-0x0000000000788000-memory.dmp

Download

memory/344-20-0x0000000000550000-0x000000000055E000-memory.dmp

Download

memory/344-21-0x0000000000560000-0x0000000000568000-memory.dmp

Download

memory/344-28-0x0000000000760000-0x000000000076C000-memory.dmp

Download

memory/344-27-0x0000000000770000-0x0000000000782000-memory.dmp

Download

memory/344-26-0x00000000005B0000-0x00000000005B8000-memory.dmp

Download

memory/344-22-0x0000000000570000-0x000000000058C000-memory.dmp

Download

memory/344-23-0x0000000000590000-0x0000000000598000-memory.dmp

Download

memory/344-25-0x0000000000740000-0x0000000000756000-memory.dmp

Download

memory/344-24-0x00000000005A0000-0x00000000005B0000-memory.dmp

Download

memory/2040-117-0x0000000000490000-0x00000000004A2000-memory.dmp

Download

memory/2040-116-0x0000000001000000-0x000000000136A000-memory.dmp

Download

memory/2276-104-0x0000000000FE0000-0x000000000134A000-memory.dmp

Download

memory/2468-200-0x0000000001340000-0x00000000016AA000-memory.dmp

Download

memory/2544-92-0x00000000003F0000-0x000000000075A000-memory.dmp

Download

memory/2684-142-0x0000000000920000-0x0000000000976000-memory.dmp

Download

memory/2684-141-0x0000000000150000-0x00000000004BA000-memory.dmp

Download

memory/2848-155-0x000000001AD90000-0x000000001ADE6000-memory.dmp

Download

memory/2848-154-0x0000000000C10000-0x0000000000F7A000-memory.dmp

Download