Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
15/06/2024, 04:26
Behavioral task
behavioral1
Sample
16d52786d50d7c0bad6ef837ec04aa3c.exe
Resource
win7-20240220-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
16d52786d50d7c0bad6ef837ec04aa3c.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target 16d52786d50d7c0bad6ef837ec04aa3c.exe
- Size 3.7MB
- Sample240615-e2hsysyfnf
- SHA256 b108df3575c8f9c77577486a92b52fe55bfb6508acca68b22250d8e1fc0494fb
- MD5 16d52786d50d7c0bad6ef837ec04aa3c
- SHA1 ffa63681d10949806d3a8de68610460271062ffe
- SHA512 300977924a08fab4f6885ad7e3616580313b8f0612b45545a95666563a2459967e5cc0660b6f059507521ae47ae3a04e661875a8032aa8569d98e00ac3815603
- SSDEEP 49152:PbA3n+NYaZhQT1Wrf+VEo0k/3t/A/6jrX1zi4lernnF4iY5tTw/L/JZMAXHmOm1:PbJYaZhQJWrWqA/3t/pD15eTv/JmAXmv
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- DcRat 50 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process 3064 schtasks.exe 1588 schtasks.exe 316 schtasks.exe 4556 schtasks.exe 3584 schtasks.exe 744 schtasks.exe 4988 schtasks.exe 2096 schtasks.exe 4212 schtasks.exe 1184 schtasks.exe 3264 schtasks.exe 3700 schtasks.exe File created C:\Program Files\Windows Defender\de-DE\5940a34987c991 bridgewinref.exe 4596 schtasks.exe 4008 schtasks.exe 2468 schtasks.exe 3392 schtasks.exe 5020 schtasks.exe 4492 schtasks.exe 764 schtasks.exe 4304 schtasks.exe 4824 schtasks.exe 1612 schtasks.exe 2428 schtasks.exe 3284 schtasks.exe 4320 schtasks.exe 4232 schtasks.exe 4356 schtasks.exe 4956 schtasks.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 16d52786d50d7c0bad6ef837ec04aa3c.exe 3712 schtasks.exe 2768 schtasks.exe 4588 schtasks.exe 3480 schtasks.exe 1956 schtasks.exe 3776 schtasks.exe 4760 schtasks.exe 624 schtasks.exe 4660 schtasks.exe 4592 schtasks.exe 3240 schtasks.exe 4512 schtasks.exe 4268 schtasks.exe 4924 schtasks.exe 4216 schtasks.exe 4336 schtasks.exe 1892 schtasks.exe 4372 schtasks.exe 2700 schtasks.exe 844 schtasks.exe - Modifies WinLogon for persistence 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Admin\\SendTo\\Registry.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-2080292272-204036150-2159171770-1000\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Admin\\SendTo\\Registry.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-2080292272-204036150-2159171770-1000\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\taskhostw.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Admin\\SendTo\\Registry.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-2080292272-204036150-2159171770-1000\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\taskhostw.exe\", \"C:\\agentreviewinto\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Admin\\SendTo\\Registry.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-2080292272-204036150-2159171770-1000\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\taskhostw.exe\", \"C:\\agentreviewinto\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\Internet Explorer\\es-ES\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Admin\\SendTo\\Registry.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-2080292272-204036150-2159171770-1000\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\taskhostw.exe\", \"C:\\agentreviewinto\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\Internet Explorer\\es-ES\\StartMenuExperienceHost.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Admin\\SendTo\\Registry.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-2080292272-204036150-2159171770-1000\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\taskhostw.exe\", \"C:\\agentreviewinto\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\Internet Explorer\\es-ES\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Program Files (x86)\\Common Files\\Java\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Admin\\SendTo\\Registry.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-2080292272-204036150-2159171770-1000\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\taskhostw.exe\", \"C:\\agentreviewinto\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\Internet Explorer\\es-ES\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Program Files (x86)\\Common Files\\Java\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Admin\\SendTo\\Registry.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-2080292272-204036150-2159171770-1000\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\taskhostw.exe\", \"C:\\agentreviewinto\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\Internet Explorer\\es-ES\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Program Files (x86)\\Common Files\\Java\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files\\Windows Portable Devices\\conhost.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Admin\\SendTo\\Registry.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-2080292272-204036150-2159171770-1000\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\taskhostw.exe\", \"C:\\agentreviewinto\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\Internet Explorer\\es-ES\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Program Files (x86)\\Common Files\\Java\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files\\Windows Portable Devices\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Admin\\SendTo\\Registry.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Admin\\SendTo\\Registry.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-2080292272-204036150-2159171770-1000\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\taskhostw.exe\", \"C:\\agentreviewinto\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\Internet Explorer\\es-ES\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Program Files (x86)\\Common Files\\Java\\RuntimeBroker.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Admin\\SendTo\\Registry.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-2080292272-204036150-2159171770-1000\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\taskhostw.exe\", \"C:\\agentreviewinto\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\Internet Explorer\\es-ES\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Program Files (x86)\\Common Files\\Java\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files\\Windows Portable Devices\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\Documents\\My Music\\csrss.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Admin\\SendTo\\Registry.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-2080292272-204036150-2159171770-1000\\csrss.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Admin\\SendTo\\Registry.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-2080292272-204036150-2159171770-1000\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\taskhostw.exe\", \"C:\\agentreviewinto\\TextInputHost.exe\"" bridgewinref.exe - Process spawned unexpected child process 48 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3264 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4956 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4492 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4660 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4760 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3700 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 624 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1892 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3584 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1184 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3240 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4588 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3064 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2428 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3392 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2768 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3776 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1612 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4596 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4372 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3284 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4008 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4988 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 744 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4320 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 764 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3480 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2700 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4512 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3712 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1956 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1588 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2468 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4232 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 844 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2096 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4304 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4268 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4824 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4924 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4216 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 316 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4356 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4336 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4556 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4212 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5020 4436 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4592 4436 schtasks.exe 90 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bridgewinref.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bridgewinref.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bridgewinref.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe -
resource yara_rule behavioral2/files/0x0007000000023418-15.dat dcrat behavioral2/memory/5088-17-0x0000000000CB0000-0x000000000101A000-memory.dmp dcrat - Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 16d52786d50d7c0bad6ef837ec04aa3c.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation bridgewinref.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe - Executes dropped EXE 15 IoCs
pid Process 5088 bridgewinref.exe 4992 RuntimeBroker.exe 3264 RuntimeBroker.exe 2352 RuntimeBroker.exe 3736 RuntimeBroker.exe 3244 RuntimeBroker.exe 4560 RuntimeBroker.exe 468 RuntimeBroker.exe 4364 RuntimeBroker.exe 1120 RuntimeBroker.exe 3220 RuntimeBroker.exe 3532 RuntimeBroker.exe 3104 RuntimeBroker.exe 316 RuntimeBroker.exe 4748 RuntimeBroker.exe - Adds Run key to start application 2 TTPs 32 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Recovery\\WindowsRE\\cmd.exe\"" bridgewinref.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default User\\RuntimeBroker.exe\"" bridgewinref.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\"" bridgewinref.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Recovery\\WindowsRE\\cmd.exe\"" bridgewinref.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Common Files\\Java\\RuntimeBroker.exe\"" bridgewinref.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Windows Portable Devices\\conhost.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Admin\\SendTo\\Registry.exe\"" bridgewinref.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-2080292272-204036150-2159171770-1000\\csrss.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-2080292272-204036150-2159171770-1000\\csrss.exe\"" bridgewinref.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files (x86)\\Windows Portable Devices\\taskhostw.exe\"" bridgewinref.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\"" bridgewinref.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\"" bridgewinref.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Admin\\Documents\\My Music\\csrss.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\agentreviewinto\\TextInputHost.exe\"" bridgewinref.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Windows Portable Devices\\conhost.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Admin\\Documents\\My Music\\csrss.exe\"" bridgewinref.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Windows Defender\\de-DE\\dllhost.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Internet Explorer\\es-ES\\StartMenuExperienceHost.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\"" bridgewinref.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Common Files\\Java\\RuntimeBroker.exe\"" bridgewinref.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\agentreviewinto\\TextInputHost.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default User\\RuntimeBroker.exe\"" bridgewinref.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Admin\\SendTo\\Registry.exe\"" bridgewinref.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files (x86)\\Windows Portable Devices\\taskhostw.exe\"" bridgewinref.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Internet Explorer\\es-ES\\StartMenuExperienceHost.exe\"" bridgewinref.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bridgewinref.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bridgewinref.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe - Drops file in Program Files directory 13 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Multimedia Platform\cmd.exe bridgewinref.exe File created C:\Program Files (x86)\Common Files\Java\9e8d7a4ca61bd9 bridgewinref.exe File created C:\Program Files\Windows Defender\de-DE\dllhost.exe bridgewinref.exe File created C:\Program Files (x86)\Windows Multimedia Platform\ebf1f9fa8afd6d bridgewinref.exe File created C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe bridgewinref.exe File created C:\Program Files\Internet Explorer\es-ES\55b276f4edf653 bridgewinref.exe File created C:\Program Files\Windows Portable Devices\conhost.exe bridgewinref.exe File created C:\Program Files\Windows Portable Devices\088424020bedd6 bridgewinref.exe File created C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe bridgewinref.exe File opened for modification C:\Program Files\Windows Defender\de-DE\dllhost.exe bridgewinref.exe File created C:\Program Files\Windows Defender\de-DE\5940a34987c991 bridgewinref.exe File created C:\Program Files (x86)\Windows Portable Devices\ea9f0e6c9e2dcd bridgewinref.exe File created C:\Program Files\Internet Explorer\es-ES\StartMenuExperienceHost.exe bridgewinref.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 48 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2428 schtasks.exe 1612 schtasks.exe 3712 schtasks.exe 844 schtasks.exe 4592 schtasks.exe 3264 schtasks.exe 1184 schtasks.exe 2768 schtasks.exe 1956 schtasks.exe 2096 schtasks.exe 4924 schtasks.exe 4492 schtasks.exe 3480 schtasks.exe 4268 schtasks.exe 4216 schtasks.exe 4356 schtasks.exe 4336 schtasks.exe 5020 schtasks.exe 4660 schtasks.exe 1892 schtasks.exe 3064 schtasks.exe 4008 schtasks.exe 4988 schtasks.exe 4212 schtasks.exe 1588 schtasks.exe 4304 schtasks.exe 3700 schtasks.exe 4588 schtasks.exe 3284 schtasks.exe 744 schtasks.exe 4320 schtasks.exe 4512 schtasks.exe 4956 schtasks.exe 4760 schtasks.exe 624 schtasks.exe 3392 schtasks.exe 2700 schtasks.exe 316 schtasks.exe 3240 schtasks.exe 3776 schtasks.exe 4372 schtasks.exe 4556 schtasks.exe 3584 schtasks.exe 4596 schtasks.exe 764 schtasks.exe 2468 schtasks.exe 4232 schtasks.exe 4824 schtasks.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings 16d52786d50d7c0bad6ef837ec04aa3c.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings bridgewinref.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings RuntimeBroker.exe - Modifies registry key 1 TTPs 1 IoCs
pid Process 1580 reg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5088 bridgewinref.exe 5088 bridgewinref.exe 5088 bridgewinref.exe 5088 bridgewinref.exe 5088 bridgewinref.exe 5088 bridgewinref.exe 5088 bridgewinref.exe 5088 bridgewinref.exe 5088 bridgewinref.exe 5088 bridgewinref.exe 5088 bridgewinref.exe 5088 bridgewinref.exe 5088 bridgewinref.exe 5088 bridgewinref.exe 5088 bridgewinref.exe 5088 bridgewinref.exe 5088 bridgewinref.exe 5088 bridgewinref.exe 5088 bridgewinref.exe 4992 RuntimeBroker.exe 4992 RuntimeBroker.exe 4992 RuntimeBroker.exe 4992 RuntimeBroker.exe 4992 RuntimeBroker.exe 4992 RuntimeBroker.exe 4992 RuntimeBroker.exe 4992 RuntimeBroker.exe 4992 RuntimeBroker.exe 4992 RuntimeBroker.exe 4992 RuntimeBroker.exe 4992 RuntimeBroker.exe 4992 RuntimeBroker.exe 4992 RuntimeBroker.exe 4992 RuntimeBroker.exe 4992 RuntimeBroker.exe 4992 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 3264 RuntimeBroker.exe 2352 RuntimeBroker.exe 2352 RuntimeBroker.exe 2352 RuntimeBroker.exe - Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 5088 bridgewinref.exe Token: SeDebugPrivilege 4992 RuntimeBroker.exe Token: SeDebugPrivilege 3264 RuntimeBroker.exe Token: SeDebugPrivilege 2352 RuntimeBroker.exe Token: SeDebugPrivilege 3736 RuntimeBroker.exe Token: SeDebugPrivilege 3244 RuntimeBroker.exe Token: SeDebugPrivilege 4560 RuntimeBroker.exe Token: SeDebugPrivilege 468 RuntimeBroker.exe Token: SeDebugPrivilege 4364 RuntimeBroker.exe Token: SeDebugPrivilege 1120 RuntimeBroker.exe Token: SeDebugPrivilege 3220 RuntimeBroker.exe Token: SeDebugPrivilege 3532 RuntimeBroker.exe Token: SeDebugPrivilege 3104 RuntimeBroker.exe Token: SeDebugPrivilege 316 RuntimeBroker.exe Token: SeDebugPrivilege 4748 RuntimeBroker.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3580 wrote to memory of 2640 3580 16d52786d50d7c0bad6ef837ec04aa3c.exe 82 PID 3580 wrote to memory of 2640 3580 16d52786d50d7c0bad6ef837ec04aa3c.exe 82 PID 3580 wrote to memory of 2640 3580 16d52786d50d7c0bad6ef837ec04aa3c.exe 82 PID 3580 wrote to memory of 1616 3580 16d52786d50d7c0bad6ef837ec04aa3c.exe 83 PID 3580 wrote to memory of 1616 3580 16d52786d50d7c0bad6ef837ec04aa3c.exe 83 PID 3580 wrote to memory of 1616 3580 16d52786d50d7c0bad6ef837ec04aa3c.exe 83 PID 2640 wrote to memory of 4744 2640 WScript.exe 87 PID 2640 wrote to memory of 4744 2640 WScript.exe 87 PID 2640 wrote to memory of 4744 2640 WScript.exe 87 PID 4744 wrote to memory of 5088 4744 cmd.exe 89 PID 4744 wrote to memory of 5088 4744 cmd.exe 89 PID 5088 wrote to memory of 3344 5088 bridgewinref.exe 139 PID 5088 wrote to memory of 3344 5088 bridgewinref.exe 139 PID 3344 wrote to memory of 3788 3344 cmd.exe 141 PID 3344 wrote to memory of 3788 3344 cmd.exe 141 PID 4744 wrote to memory of 1580 4744 cmd.exe 142 PID 4744 wrote to memory of 1580 4744 cmd.exe 142 PID 4744 wrote to memory of 1580 4744 cmd.exe 142 PID 3344 wrote to memory of 4992 3344 cmd.exe 143 PID 3344 wrote to memory of 4992 3344 cmd.exe 143 PID 4992 wrote to memory of 1340 4992 RuntimeBroker.exe 144 PID 4992 wrote to memory of 1340 4992 RuntimeBroker.exe 144 PID 4992 wrote to memory of 2916 4992 RuntimeBroker.exe 145 PID 4992 wrote to memory of 2916 4992 RuntimeBroker.exe 145 PID 1340 wrote to memory of 3264 1340 WScript.exe 146 PID 1340 wrote to memory of 3264 1340 WScript.exe 146 PID 3264 wrote to memory of 2980 3264 RuntimeBroker.exe 147 PID 3264 wrote to memory of 2980 3264 RuntimeBroker.exe 147 PID 3264 wrote to memory of 3368 3264 RuntimeBroker.exe 148 PID 3264 wrote to memory of 3368 3264 RuntimeBroker.exe 148 PID 2980 wrote to memory of 2352 2980 WScript.exe 149 PID 2980 wrote to memory of 2352 2980 WScript.exe 149 PID 2352 wrote to memory of 1852 2352 RuntimeBroker.exe 151 PID 2352 wrote to memory of 1852 2352 RuntimeBroker.exe 151 PID 2352 wrote to memory of 5036 2352 RuntimeBroker.exe 152 PID 2352 wrote to memory of 5036 2352 RuntimeBroker.exe 152 PID 1852 wrote to memory of 3736 1852 WScript.exe 154 PID 1852 wrote to memory of 3736 1852 WScript.exe 154 PID 3736 wrote to memory of 4744 3736 RuntimeBroker.exe 155 PID 3736 wrote to memory of 4744 3736 RuntimeBroker.exe 155 PID 3736 wrote to memory of 4516 3736 RuntimeBroker.exe 156 PID 3736 wrote to memory of 4516 3736 RuntimeBroker.exe 156 PID 4744 wrote to memory of 3244 4744 WScript.exe 157 PID 4744 wrote to memory of 3244 4744 WScript.exe 157 PID 3244 wrote to memory of 1384 3244 RuntimeBroker.exe 158 PID 3244 wrote to memory of 1384 3244 RuntimeBroker.exe 158 PID 3244 wrote to memory of 4000 3244 RuntimeBroker.exe 159 PID 3244 wrote to memory of 4000 3244 RuntimeBroker.exe 159 PID 1384 wrote to memory of 4560 1384 WScript.exe 160 PID 1384 wrote to memory of 4560 1384 WScript.exe 160 PID 4560 wrote to memory of 2764 4560 RuntimeBroker.exe 161 PID 4560 wrote to memory of 2764 4560 RuntimeBroker.exe 161 PID 4560 wrote to memory of 5084 4560 RuntimeBroker.exe 162 PID 4560 wrote to memory of 5084 4560 RuntimeBroker.exe 162 PID 2764 wrote to memory of 468 2764 WScript.exe 163 PID 2764 wrote to memory of 468 2764 WScript.exe 163 PID 468 wrote to memory of 4444 468 RuntimeBroker.exe 164 PID 468 wrote to memory of 4444 468 RuntimeBroker.exe 164 PID 468 wrote to memory of 2624 468 RuntimeBroker.exe 165 PID 468 wrote to memory of 2624 468 RuntimeBroker.exe 165 PID 4444 wrote to memory of 4364 4444 WScript.exe 166 PID 4444 wrote to memory of 4364 4444 WScript.exe 166 PID 4364 wrote to memory of 2904 4364 RuntimeBroker.exe 167 PID 4364 wrote to memory of 2904 4364 RuntimeBroker.exe 167 - System policy modification 1 TTPs 45 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bridgewinref.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bridgewinref.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bridgewinref.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\16d52786d50d7c0bad6ef837ec04aa3c.exe"C:\Users\Admin\AppData\Local\Temp\16d52786d50d7c0bad6ef837ec04aa3c.exe"1⤵
- DcRat
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\agentreviewinto\WzFtekmUii64UgTyfu.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\agentreviewinto\nWl1OEQ6Nk6rkCf4DeE9UBDJxBYy.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\agentreviewinto\bridgewinref.exe"C:\agentreviewinto\bridgewinref.exe"4⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5088 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ewSk9McFKz.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:3788
-
-
C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4992 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\65701465-1aaa-426f-95b1-18300b79b8cd.vbs"7⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3264 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7737722c-dc95-42c0-af8f-dde9e2470dba.vbs"9⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2352 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ce85c6e-742f-4ef3-8702-61bed7ca0d29.vbs"11⤵
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3736 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b787543b-d051-45b5-bb73-10ba3b84eaa1.vbs"13⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3244 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23863335-2428-4910-9a50-bbcde46dbbed.vbs"15⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4560 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c08fb444-5dbd-43d1-badb-00143510f2bd.vbs"17⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:468 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\197de063-638d-4f45-ae58-9c635ead778b.vbs"19⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4364 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9419a675-5aec-457f-98f1-be90ede1139e.vbs"21⤵PID:2904
-
C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1120 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28e945c2-4f83-4830-8b23-1c5a69d276c5.vbs"23⤵PID:2200
-
C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"24⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3220 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75d60589-57ea-4fda-8ccc-bbd399917307.vbs"25⤵PID:8
-
C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"26⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3532 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\58973a90-cf36-4bf9-be85-062636dae5f3.vbs"27⤵PID:3444
-
C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"28⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3104 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\25420b1c-ab5a-4bd3-90c0-c53bf1e84720.vbs"29⤵PID:2192
-
C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"30⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:316 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db34a1a9-db88-40d5-bae5-00dfd2b24507.vbs"31⤵PID:740
-
C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe"32⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4748 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\089f2fe9-f1b2-4ae4-a5f8-202158b12e33.vbs"33⤵PID:1120
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ebe7e17-ede3-4717-b7c4-2cb1a1191980.vbs"33⤵PID:1100
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\958670a7-92c0-4992-a3b8-36a6a409bafc.vbs"31⤵PID:1868
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\88280c61-b728-42dd-8454-ebfe9bf012a2.vbs"29⤵PID:2956
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e284c8f4-13d2-4aab-9b98-d7e5119f525c.vbs"27⤵PID:2676
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5be2cb76-0d8a-4789-b750-146bf38a85a3.vbs"25⤵PID:4368
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c46deb08-d6ad-4494-a0ad-2cfad6a005cf.vbs"23⤵PID:4332
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\07d20e79-e140-4b0c-8ef4-83c65ed1998c.vbs"21⤵PID:5104
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08a6bcdf-773e-4b3a-bc9b-c91ea38b6836.vbs"19⤵PID:2624
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8cabeca0-9211-4c0c-8619-ca1d7eb8d95c.vbs"17⤵PID:5084
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bdf6aaf1-f0fe-4832-bd7d-6af8e7da1b1e.vbs"15⤵PID:4000
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\047a9ed7-0e33-46f5-b1d2-0e4617277b1f.vbs"13⤵PID:4516
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7b19bbc5-1630-4ca9-a801-e8c5b8702572.vbs"11⤵PID:5036
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\de75e33c-e21d-4d7e-b733-bfc7003c29c1.vbs"9⤵PID:3368
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4661285f-3a20-4fe8-aa78-809cd7dd0664.vbs"7⤵PID:2916
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
- Modifies registry key
PID:1580
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\agentreviewinto\file.vbs"2⤵PID:1616
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\de-DE\dllhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3264
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\de-DE\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4492
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\SendTo\Registry.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\Registry.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\SendTo\Registry.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-2080292272-204036150-2159171770-1000\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-2080292272-204036150-2159171770-1000\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3240
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-2080292272-204036150-2159171770-1000\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\cmd.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\cmd.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\cmd.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3392
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2768
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3776
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1612
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\agentreviewinto\TextInputHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\agentreviewinto\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\agentreviewinto\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:744
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\es-ES\StartMenuExperienceHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4320
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\es-ES\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\es-ES\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3712
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Java\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4232
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:844
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2096
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4268
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4336
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Documents\My Music\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Documents\My Music\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Documents\My Music\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4592
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
- Size 1KB
- SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
- MD5 49b64127208271d8f797256057d0b006
- SHA1 b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
- SHA512 f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\089f2fe9-f1b2-4ae4-a5f8-202158b12e33.vbs
- Size 734B
- SHA256 d91724920a4d3b3dc927aee1f43ce267b2c67f55a28a70edabff4d0b0a738c07
- MD5 4b44644dcb7c369ecb929ba99f066126
- SHA1 96840c12b1e07fc3399cffdfe2ea3c8dbd92b47f
- SHA512 fd7f175249a3c38d62949c5f28b6ef82b9db5d6f49458b349e2b6c4ee57545aac18aa0ab788118a4166756275efab35703bdb6a8c6d451f3b5b9fbfdf3111507
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\197de063-638d-4f45-ae58-9c635ead778b.vbs
- Size 733B
- SHA256 0ec6e6711c19cf932f71d9e253fb65479e09deafa94ba26181c4ecee75c9550f
- MD5 774e58d63188a21b388eca034ba0b1eb
- SHA1 2ac37027316c3b9524e148c2f9ecfd159425f40c
- SHA512 8d198f86fe0c0dd0e9dd379f9bb2346d76f9a964b6f2aadd42bfe61498bbf1d0164b2274e72f5301d23fc37121313b620ab1112a68e98770c0615dc05c7eb9a8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\1ce85c6e-742f-4ef3-8702-61bed7ca0d29.vbs
- Size 734B
- SHA256 53add5a81636e63e348956404e06ca918edb58059f9c797793e56217eeec1921
- MD5 0d0e61b503f8013d06f77757c42bc59f
- SHA1 b67c8000072d41b63cbb1c5031b0bc3d392b3658
- SHA512 7ae6cb8d0b102ab9bd94b6fe9046220f9b3f771dc0f95808c8131603cecc1657fc7a27e64fafd21546249527b93f5c4e20ee1ae8b873b0b28db7ba322b48c83e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\23863335-2428-4910-9a50-bbcde46dbbed.vbs
- Size 734B
- SHA256 83e85eabee8c85f6b739b8c49689a383e4ec745157e09338f430cbfe6f2bc812
- MD5 7b8ed2c7dee2e6c69280253488bfdf46
- SHA1 22a75220f410011628d0716387800e0fa1e58357
- SHA512 6968f0480b95fb47cd564c8ee11b151bde93e3257e8584fd371b61bce532a19f7f003849669dd4417643bb4829d223ce6ab396e92b205323c570b317bec379af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\25420b1c-ab5a-4bd3-90c0-c53bf1e84720.vbs
- Size 734B
- SHA256 7150df3253668c1fd5d1f35a527626c00f46e888f298319f453c6c0e4241b4a0
- MD5 d84424863a3a3284a3aab8db263bdd1b
- SHA1 3e7ab111a2b4e062a1f5c6a355a7dee0f4f489f5
- SHA512 6e2f235f55e1899b47ded73e557b9b759dce5aec74b982321af8fc3f22a5cf79d2c1b58cbc018bb8c5c80ae38fe43aff8bac3c433bbadaa5aa6cc00ad2db18cc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\28e945c2-4f83-4830-8b23-1c5a69d276c5.vbs
- Size 734B
- SHA256 4e549e77af9764229401792b5409a524cc1f523568fe3d84a2c624e4d93323a3
- MD5 7ed84f2093a2fe44633a30162ffc1e5c
- SHA1 5393979350a34ff4e4fa9e3f1c4377f55c56d62a
- SHA512 fd69c4bcb91a1b55e9bb3410304cf22e2864c831bd066ae3c0f29535805a24cb979483b15a9140ef287d4f0501972a2011de65d5dc11a9c3a29548ba472872fa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\4661285f-3a20-4fe8-aa78-809cd7dd0664.vbs
- Size 510B
- SHA256 7e85baf37dce385cf354a4fb5c18ed633d86d2b67dcd35eb3d829ea9146d6cf1
- MD5 631fe3aa01fc610036f8be70a400d79d
- SHA1 b432bf1517b1c6f2d41fa994ee475c5ee8b2813c
- SHA512 38dbbbfcc29efd20aa434490efa34c90c3e11a2098e08cc421cf2d487a654c00187536ffcb9a7f2a5108c23cf0ea0e8b448e1c5e3561095ef1bbb3de8ac29009
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\58973a90-cf36-4bf9-be85-062636dae5f3.vbs
- Size 734B
- SHA256 319c79a3c7f4f61d2d52d469aee93c294c592a5d6bd57edcd66436b611d2db76
- MD5 d349bdbe6408e9a355c6a66848a887a3
- SHA1 29d23ac1d15ce157dca59dbc02d146754c699d78
- SHA512 990307443cfe96587bcc8e4eaa286662664d43a144e125847efc908b0b05fccb27f167c55efcd7189ac73dfb1eee583b9c676ccd7465826000449d492253f588
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\65701465-1aaa-426f-95b1-18300b79b8cd.vbs
- Size 734B
- SHA256 003c9ea633cd317ee2c59ceb98239e138154c75a0101194c8152507945d86e2f
- MD5 e6fb13e5cf1ec9333b94f5be81f132dc
- SHA1 954830913bcc08525c83acea5c965322c76d6dae
- SHA512 cda600a951a4036d9e323addc84d0598c1353b9ec1cb9149172ea1a4c09ddfbb5dc8c984a1327348facb999e22808bab5b9b0ae4b7d207cb4a70c996f16a4ba6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\75d60589-57ea-4fda-8ccc-bbd399917307.vbs
- Size 734B
- SHA256 b137ab4fbef374b11a8586cb4e7289fa03a7a550cbe438447747bcd24bb7af88
- MD5 1f43f088021304f54f7114252e5130a4
- SHA1 a17473a82b60f71a71b3d0a3f207151c32bdaf5c
- SHA512 a2997d238066c16c7cb63a5e61a0229fbe9ddc921ca78018f4bc578806a3c511b0e2723915964c982d93d8e06a09b99e8d4067daed6fb15e4a181281b0635456
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7737722c-dc95-42c0-af8f-dde9e2470dba.vbs
- Size 734B
- SHA256 f13bce9c51ae40b06cd3543f9554b88433225f1ffd4ad2b02e991d8b922c77d6
- MD5 9641c10291f04098edcad214c10f0392
- SHA1 21c387673c08c30f6a78f8740f7a261b779bd8d4
- SHA512 1e5729ee9c95c8eb1fdec49c0f08f85628d6de6bc6821b7c5484ed398ea2df9ed1fb681c07daed9574512491d8ed3b215a0978bb52b502157c8693ce4bc2d9f2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\9419a675-5aec-457f-98f1-be90ede1139e.vbs
- Size 734B
- SHA256 a82d58a5fea0e8fa7506724a9afc241206075cbb79d5a948e0fd8c5e17bac553
- MD5 e3d3a656269d24b31fdf31fe908e8708
- SHA1 5aad7607176f132d7d6778012eb08582827296ae
- SHA512 ec280f2606481aac82e01a3ae2d87320c3a4e4d5d9a57c598f95ed734d3c56fe54018e61ac363c3420ecb8d17e9b71327ed94f30b9e42dfdb704c10b93b7a472
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\b787543b-d051-45b5-bb73-10ba3b84eaa1.vbs
- Size 734B
- SHA256 f22359a24b0bec904e12a70c6889ac710e49b906f3ce3ff2811769481dcb0c47
- MD5 bac2fbe98a903e73259b60cc8c646f79
- SHA1 9891dd06704a97797564db0d1ef59423fd4f3f51
- SHA512 7e7918d198739bab7eeb53ccf98acfb61a69e06c0344f7188ae8a015023db195bad195113ae0f08516cd624c8bd958557f057e60760a02de61dea404e17f66da
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\c08fb444-5dbd-43d1-badb-00143510f2bd.vbs
- Size 734B
- SHA256 94226d1e83a620c2a281d1252837cc88d2d9d74192cd4897ecec88732611eb21
- MD5 67a7e76a468e5e18e5b82e809ba75804
- SHA1 c28b3470dc5bd4f4b9770f2596c690e9578bb762
- SHA512 e63ec342f09db617c0a6dfb32d50b58c4be6f6eacad6c445e331232cd68367b228aa3b762571e7f1f5ed3217697a0af96ac337193023ad238af0d9d0dbec49a6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\db34a1a9-db88-40d5-bae5-00dfd2b24507.vbs
- Size 733B
- SHA256 73e39e9ed3df379b1ba645726ce4fb93aa3d709a8c5696233478609eb7029dd2
- MD5 947fadd10d4934982b149cca5b31a2b8
- SHA1 ff22b3032003a93003e9170254c152b40876cdbf
- SHA512 176501cc0af6cab1bafcf7f53b4614195c66676bcde8c5e84f2182342f515d2e68b486f79cc4b5676f070796fe486a98d42e7038eb96879ed6d3b360ad064a89
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\ewSk9McFKz.bat
- Size 223B
- SHA256 e91868f291d391d3542229d52c64b7a135256d40e4b9e67a2d182b72a13d2bdc
- MD5 69eb87bb61e6da1d26e8278fa11e4acc
- SHA1 76cd4e61e4516d08338d0b9678a782770c8dc0f4
- SHA512 e2d6b8a831018bf15d69d3eda0d66230261f1062144bd57de9b173149f62052091159576a5a41777ecd9510e94ec9d80636f09a507b0f8f2a142297119546357
- MD5 SHA1 SHA512
- Path C:\agentreviewinto\WzFtekmUii64UgTyfu.vbe
- Size 220B
- SHA256 ac1b6cedfb687d113c8532430c506b4a69bf6ae687c5a0a9be594e6393ef367b
- MD5 ca9932e3dc2092e6a9027a2c8be3347f
- SHA1 d25e9ce23e55f4c26ed239b56a89c002c73ca8b7
- SHA512 c2636f09c0acaaceac79810ecf97cbdc5afc0cc0b561008a540b618d548a3e8f3a4685757d2299160941da79f22ee5429cdc3c98735f8c3a16fc7f79ec6dc971
- MD5 SHA1 SHA512
- Path C:\agentreviewinto\bridgewinref.exe
- Size 3.4MB
- SHA256 3fa6ddcabcb03763ef1887117e16ebdf0553a1cc2a16b58bdecaba0735d4e60a
- MD5 0c1b8d8d00d578c844a14875fb7599d3
- SHA1 863f7b4b56908cb442ca705be7df48f3c96bf46b
- SHA512 2f58e2f549a34c8b7dd00d709c244b9b767d148922a74ae1762cad72c01be9564cab30efc5bf6c7dc138df7124eb81ee6ed83acac737a202ad81f0de57a3b559
- SSDEEP 49152:TNYaZhQT1Wrf+VEo0k/3t/A/6jrX1zi4lernnF4iY5tTw/L/JZMAXHmOm:5YaZhQJWrWqA/3t/pD15eTv/JmAXm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\agentreviewinto\file.vbs
- Size 34B
- SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
- MD5 677cc4360477c72cb0ce00406a949c61
- SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
- SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
- MD5 SHA1 SHA512
- Path C:\agentreviewinto\nWl1OEQ6Nk6rkCf4DeE9UBDJxBYy.bat
- Size 149B
- SHA256 5249fb1b1131f9a0d51ee41c8543bdc75c1564024766574d1796f61fd00a1376
- MD5 4a0d4edb4bc9824f0d8337f9ebfd2de9
- SHA1 a3dfa9a1c1a753207a1f498934763a735a4738a7
- SHA512 e3eca53a8f04d638b6a8b570c9e2a93d6566eff6c23ebbfafca5891d7a7e23869b9abb64c41c9ec226fdb347c2b9f5227a1e6832139b4b79c9c479963e66cbcb
- MD5 SHA1 SHA512