dcrat | c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Size 3.3MB
Sample240619-db116ssejc
SHA256 c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad
MD5 bfa95bec512a100511e4f1e90189594c
SHA1 5491655abcbe56963ff489b8181bacebd2873e07
SHA512 be1f4da54c40d874cd47687e6578b978c2ea45f0ffe31c171db4e8cf67a84aa172844333bb028bd0e042f38f75bafa22522ce6572b6b53472d817a208258212b
SSDEEP 49152:6PAT5v5Ilvgss/W+dvuTIfw0LgaTNzvl95mLDQbMa4wT47Zu+lIK7sYPkoIX:6G5es/HUT0MahzlnZ4wT4VBIZYPko
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 14 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\wininit.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Windows\\security\\database\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\Setup\\State\\smss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\wininit.exe\", \"C:\\Users\\Default\\csrss.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\unsecapp.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\wininit.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Windows\\security\\database\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\Setup\\State\\smss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\wininit.exe\", \"C:\\Users\\Default\\csrss.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\unsecapp.exe\", \"C:\\Users\\Admin\\Links\\lsass.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\wininit.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Windows\\security\\database\\taskhostw.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\wininit.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Windows\\security\\database\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\Setup\\State\\smss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\wininit.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Windows\\security\\database\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\Setup\\State\\smss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\wininit.exe\", \"C:\\Users\\Default\\csrss.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\wininit.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Windows\\security\\database\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\wininit.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Windows\\security\\database\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\Setup\\State\\smss.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\wininit.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Windows\\security\\database\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\Setup\\State\\smss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\explorer.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\wininit.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Windows\\security\\database\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\Setup\\State\\smss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\wininit.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\wininit.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Windows\\security\\database\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\Setup\\State\\smss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\wininit.exe\", \"C:\\Users\\Default\\csrss.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\unsecapp.exe\", \"C:\\Users\\Admin\\Links\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Windows\\Registration\\CRMLog\\unsecapp.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\wininit.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Windows\\security\\database\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\Setup\\State\\smss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\wininit.exe\", \"C:\\Users\\Default\\csrss.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\unsecapp.exe\", \"C:\\Users\\Admin\\Links\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\wininit.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\wininit.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3208	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3676	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3408	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	712	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3168	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	1872	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	1872	schtasks.exe	84

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3112-1-0x0000000000B20000-0x0000000000E7A000-memory.dmp	dcrat
behavioral2/files/0x000700000002343c-47.dat	dcrat

Detects executables packed with SmartAssembly 9 IoCs

resource	yara_rule
behavioral2/memory/3112-8-0x000000001B9D0000-0x000000001B9E0000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3112-15-0x000000001C2B0000-0x000000001C2BA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3112-24-0x000000001C390000-0x000000001C39C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3112-23-0x000000001C380000-0x000000001C38C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3112-27-0x000000001C3C0000-0x000000001C3CC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3112-29-0x000000001C4D0000-0x000000001C4DC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3112-30-0x000000001C4E0000-0x000000001C4EA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3112-35-0x000000001C630000-0x000000001C63C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3112-37-0x000000001C660000-0x000000001C66A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	taskhostw.exe

Executes dropped EXE 11 IoCs

pid	Process
3600	taskhostw.exe
3648	taskhostw.exe
4060	taskhostw.exe
4688	taskhostw.exe
3500	taskhostw.exe
3700	taskhostw.exe
2412	taskhostw.exe
3020	taskhostw.exe
2628	taskhostw.exe
1992	taskhostw.exe
3604	taskhostw.exe

Adds Run key to start application 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\Registration\\CRMLog\\unsecapp.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default User\\fontdrvhost.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\Setup\\State\\smss.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\WindowsPowerShell\\Modules\\explorer.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\DigitalLocker\\en-US\\unsecapp.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\Registration\\CRMLog\\unsecapp.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\Setup\\State\\smss.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Public\\Pictures\\wininit.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Public\\Pictures\\wininit.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\csrss.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\wininit.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\security\\database\\taskhostw.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\DigitalLocker\\en-US\\unsecapp.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Admin\\Links\\lsass.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\wininit.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\WindowsPowerShell\\Modules\\explorer.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\csrss.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default User\\fontdrvhost.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\security\\database\\taskhostw.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Admin\\Links\\lsass.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\wininit.exe	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\56085415360792	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
File created	C:\Program Files\WindowsPowerShell\Modules\explorer.exe	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
File created	C:\Program Files\WindowsPowerShell\Modules\7a0fd90576e088	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\security\database\ea9f0e6c9e2dcd	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
File created	C:\Windows\Setup\State\69ddcba757bf72	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
File created	C:\Windows\ImmersiveControlPanel\ja-JP\StartMenuExperienceHost.exe	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
File created	C:\Windows\DigitalLocker\en-US\29c1c3cc0f7685	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
File created	C:\Windows\security\database\taskhostw.exe	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
File created	C:\Windows\Setup\State\smss.exe	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
File created	C:\Windows\Boot\dllhost.exe	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
File created	C:\Windows\DigitalLocker\en-US\unsecapp.exe	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
File created	C:\Windows\Registration\CRMLog\unsecapp.exe	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
File created	C:\Windows\Registration\CRMLog\29c1c3cc0f7685	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	taskhostw.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2976	schtasks.exe
2588	schtasks.exe
824	schtasks.exe
3268	schtasks.exe
1668	schtasks.exe
4632	schtasks.exe
4452	schtasks.exe
2080	schtasks.exe
2532	schtasks.exe
2412	schtasks.exe
3168	schtasks.exe
2472	schtasks.exe
4080	schtasks.exe
624	schtasks.exe
4980	schtasks.exe
548	schtasks.exe
4872	schtasks.exe
3208	schtasks.exe
4544	schtasks.exe
3132	schtasks.exe
2200	schtasks.exe
1648	schtasks.exe
3408	schtasks.exe
4904	schtasks.exe
2784	schtasks.exe
1760	schtasks.exe
3452	schtasks.exe
4052	schtasks.exe
1716	schtasks.exe
3056	schtasks.exe
4480	schtasks.exe
5116	schtasks.exe
3676	schtasks.exe
8	schtasks.exe
2280	schtasks.exe
3616	schtasks.exe
1796	schtasks.exe
2476	schtasks.exe
2396	schtasks.exe
3704	schtasks.exe
712	schtasks.exe
1920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe
3600	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Token: SeDebugPrivilege	3600	taskhostw.exe
Token: SeDebugPrivilege	3648	taskhostw.exe
Token: SeDebugPrivilege	4060	taskhostw.exe
Token: SeDebugPrivilege	4688	taskhostw.exe
Token: SeDebugPrivilege	3500	taskhostw.exe
Token: SeDebugPrivilege	3700	taskhostw.exe
Token: SeDebugPrivilege	2412	taskhostw.exe
Token: SeDebugPrivilege	3020	taskhostw.exe
Token: SeDebugPrivilege	2628	taskhostw.exe
Token: SeDebugPrivilege	1992	taskhostw.exe
Token: SeDebugPrivilege	3604	taskhostw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 1396	3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe	127
PID 3112 wrote to memory of 1396	3112	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe	127
PID 1396 wrote to memory of 5108	1396	cmd.exe	129
PID 1396 wrote to memory of 5108	1396	cmd.exe	129
PID 1396 wrote to memory of 3600	1396	cmd.exe	130
PID 1396 wrote to memory of 3600	1396	cmd.exe	130
PID 3600 wrote to memory of 1612	3600	taskhostw.exe	131
PID 3600 wrote to memory of 1612	3600	taskhostw.exe	131
PID 3600 wrote to memory of 3900	3600	taskhostw.exe	132
PID 3600 wrote to memory of 3900	3600	taskhostw.exe	132
PID 1612 wrote to memory of 3648	1612	WScript.exe	134
PID 1612 wrote to memory of 3648	1612	WScript.exe	134
PID 3648 wrote to memory of 3000	3648	taskhostw.exe	135
PID 3648 wrote to memory of 3000	3648	taskhostw.exe	135
PID 3648 wrote to memory of 2160	3648	taskhostw.exe	136
PID 3648 wrote to memory of 2160	3648	taskhostw.exe	136
PID 3000 wrote to memory of 4060	3000	WScript.exe	137
PID 3000 wrote to memory of 4060	3000	WScript.exe	137
PID 4060 wrote to memory of 3408	4060	taskhostw.exe	138
PID 4060 wrote to memory of 3408	4060	taskhostw.exe	138
PID 4060 wrote to memory of 4696	4060	taskhostw.exe	139
PID 4060 wrote to memory of 4696	4060	taskhostw.exe	139
PID 3408 wrote to memory of 4688	3408	WScript.exe	142
PID 3408 wrote to memory of 4688	3408	WScript.exe	142
PID 4688 wrote to memory of 2232	4688	taskhostw.exe	144
PID 4688 wrote to memory of 2232	4688	taskhostw.exe	144
PID 4688 wrote to memory of 2928	4688	taskhostw.exe	145
PID 4688 wrote to memory of 2928	4688	taskhostw.exe	145
PID 2232 wrote to memory of 3500	2232	WScript.exe	148
PID 2232 wrote to memory of 3500	2232	WScript.exe	148
PID 3500 wrote to memory of 5016	3500	taskhostw.exe	149
PID 3500 wrote to memory of 5016	3500	taskhostw.exe	149
PID 3500 wrote to memory of 640	3500	taskhostw.exe	150
PID 3500 wrote to memory of 640	3500	taskhostw.exe	150
PID 5016 wrote to memory of 3700	5016	WScript.exe	151
PID 5016 wrote to memory of 3700	5016	WScript.exe	151
PID 3700 wrote to memory of 1836	3700	taskhostw.exe	152
PID 3700 wrote to memory of 1836	3700	taskhostw.exe	152
PID 3700 wrote to memory of 1776	3700	taskhostw.exe	153
PID 3700 wrote to memory of 1776	3700	taskhostw.exe	153
PID 1836 wrote to memory of 2412	1836	WScript.exe	154
PID 1836 wrote to memory of 2412	1836	WScript.exe	154
PID 2412 wrote to memory of 824	2412	taskhostw.exe	155
PID 2412 wrote to memory of 824	2412	taskhostw.exe	155
PID 2412 wrote to memory of 4604	2412	taskhostw.exe	156
PID 2412 wrote to memory of 4604	2412	taskhostw.exe	156
PID 824 wrote to memory of 3020	824	WScript.exe	157
PID 824 wrote to memory of 3020	824	WScript.exe	157
PID 3020 wrote to memory of 3984	3020	taskhostw.exe	158
PID 3020 wrote to memory of 3984	3020	taskhostw.exe	158
PID 3020 wrote to memory of 2296	3020	taskhostw.exe	159
PID 3020 wrote to memory of 2296	3020	taskhostw.exe	159
PID 3984 wrote to memory of 2628	3984	WScript.exe	160
PID 3984 wrote to memory of 2628	3984	WScript.exe	160
PID 2628 wrote to memory of 1528	2628	taskhostw.exe	161
PID 2628 wrote to memory of 1528	2628	taskhostw.exe	161
PID 2628 wrote to memory of 2120	2628	taskhostw.exe	162
PID 2628 wrote to memory of 2120	2628	taskhostw.exe	162
PID 1528 wrote to memory of 1992	1528	WScript.exe	163
PID 1528 wrote to memory of 1992	1528	WScript.exe	163
PID 1992 wrote to memory of 2880	1992	taskhostw.exe	164
PID 1992 wrote to memory of 2880	1992	taskhostw.exe	164
PID 1992 wrote to memory of 228	1992	taskhostw.exe	165
PID 1992 wrote to memory of 228	1992	taskhostw.exe	165

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe
"C:\Users\Admin\AppData\Local\Temp\c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wxfkt16eiv.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:5108
- - C:\Windows\security\database\taskhostw.exe
    "C:\Windows\security\database\taskhostw.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3600
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8d5e12a-796e-4406-b3d9-f06a403bf8e1.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1612
    - - C:\Windows\security\database\taskhostw.exe
        
        C:\Windows\security\database\taskhostw.exe
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3648
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a4c01f3d-98f3-49b7-9f6c-e52d14483e29.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Windows\security\database\taskhostw.exe
        
        C:\Windows\security\database\taskhostw.exe
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef0abced-bd95-4a7e-8562-2b54301c94e3.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Windows\security\database\taskhostw.exe
        
        C:\Windows\security\database\taskhostw.exe
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\11897b35-95a5-42bd-aeaa-1c6cf3ec3b99.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\security\database\taskhostw.exe
        
        C:\Windows\security\database\taskhostw.exe
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3500
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b1b7fd66-bd99-48c6-9ec8-8bc4ec01bd05.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\security\database\taskhostw.exe
        
        C:\Windows\security\database\taskhostw.exe
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3700
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6707ed04-e409-4e4a-8fbc-661e1986b39e.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\security\database\taskhostw.exe
        
        C:\Windows\security\database\taskhostw.exe
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2412
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\955e9c58-d4a5-4dc7-a2fb-50f931789f53.vbs"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:824
        
        C:\Windows\security\database\taskhostw.exe
        
        C:\Windows\security\database\taskhostw.exe
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e919269-c496-4dfa-be9b-eea8044ae70b.vbs"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:3984
        
        C:\Windows\security\database\taskhostw.exe
        
        C:\Windows\security\database\taskhostw.exe
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2628
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c7e0b029-2c95-4f93-a436-e40b50d20218.vbs"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:1528
        
        C:\Windows\security\database\taskhostw.exe
        
        C:\Windows\security\database\taskhostw.exe
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1992
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b252635a-cd2b-45fd-9412-8dd686aa7f2d.vbs"
        22⤵
        
        PID:2880
        
        C:\Windows\security\database\taskhostw.exe
        
        C:\Windows\security\database\taskhostw.exe
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3604
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\366e2fdf-b9f4-41fb-af42-1d01930f5e99.vbs"
        24⤵
        
        PID:3204
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b5b02ff-eb87-4568-8517-397dd2861ab3.vbs"
        24⤵
        
        PID:3768
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\585b42c8-cb3f-4f91-888c-a906edf79824.vbs"
        22⤵
        
        PID:228
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b525fa78-f34c-443e-a6e5-b66004fb4683.vbs"
        20⤵
        
        PID:2120
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bebf8e93-d3fd-40f0-ad34-b908e41414b0.vbs"
        18⤵
        
        PID:2296
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\898d4e55-af10-4c01-9c9b-1dddec2b71fe.vbs"
        16⤵
        
        PID:4604
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\92b906f0-16ea-40c3-be82-d6a4192e4f8e.vbs"
        14⤵
        
        PID:1776
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ef33c67-2195-4287-9bf6-9cee00ab77f4.vbs"
        12⤵
        
        PID:640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8519dcf3-8422-4738-89d3-0213fba9c6ed.vbs"
        10⤵
        
        PID:2928
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\803fd824-f5ea-4c81-b509-bbf9dd7d48bd.vbs"
        8⤵
        
        PID:4696
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f9fe6346-2447-456e-9f29-4b4bfc666814.vbs"
        6⤵
        
        PID:2160
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7c946e32-b5d4-48d0-ba49-5226c4d0ad7f.vbs"
      4⤵
      PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Windows\security\database\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\security\database\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Windows\security\database\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\Setup\State\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Setup\State\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\Setup\State\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\Modules\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\WindowsPowerShell\Modules\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Pictures\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Pictures\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Pictures\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Default\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Windows\DigitalLocker\en-US\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Windows\DigitalLocker\en-US\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Links\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\Links\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Links\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Windows\Registration\CRMLog\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Windows\Registration\CRMLog\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fontdrvhost.exe

Path C:\Recovery\WindowsRE\fontdrvhost.exe
Size 3.3MB
SHA256 c052c666088c246a5e15c88190b68cb1a3d70974396bfbe5e075d7e12d4522ad
MD5 bfa95bec512a100511e4f1e90189594c
SHA1 5491655abcbe56963ff489b8181bacebd2873e07
SHA512 be1f4da54c40d874cd47687e6578b978c2ea45f0ffe31c171db4e8cf67a84aa172844333bb028bd0e042f38f75bafa22522ce6572b6b53472d817a208258212b
SSDEEP 49152:6PAT5v5Ilvgss/W+dvuTIfw0LgaTNzvl95mLDQbMa4wT47Zu+lIK7sYPkoIX:6G5es/HUT0MahzlnZ4wT4VBIZYPko
MD5 SHA1 SHA512 SSDEEP

Submit Download

taskhostw.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\taskhostw.exe.log
Size 1KB
SHA256 414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
MD5 4a667f150a4d1d02f53a9f24d89d53d1
SHA1 306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA512 4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
MD5 SHA1 SHA512

Submit Download

11897b35-95a5-42bd-aeaa-1c6cf3ec3b99.vbs

Path C:\Users\Admin\AppData\Local\Temp\11897b35-95a5-42bd-aeaa-1c6cf3ec3b99.vbs
Size 718B
SHA256 2c752a49218826567cfb7beee747c27a4401d0ae972a695a43eebc31da78ddbd
MD5 b253cedf97bc1a8f1954d4097745e44e
SHA1 d73f21f344469cde4f66018f03283f7376fbbafe
SHA512 37f0122605ef00a911c6441e2a4bf5529b7e214a2f77a328af6a87b87f4cb2384298cdd87b6473011dbc0e03b35a51a93fe1af9a37136bee96b6c7c012236112
MD5 SHA1 SHA512

Submit Download

366e2fdf-b9f4-41fb-af42-1d01930f5e99.vbs

Path C:\Users\Admin\AppData\Local\Temp\366e2fdf-b9f4-41fb-af42-1d01930f5e99.vbs
Size 718B
SHA256 83abccbc4f357c0bc551d0b108f658f75ee0518f5f46256f32ff0943bcab7252
MD5 171ea2821808162f38d60776caba90d4
SHA1 482a8dec37d689edf09140bf4e7cb0806033b631
SHA512 a24289e88915a9551c4055ad74ed657536c36cd74b481f55da8d10a5d14515a31cdbcf219d4ec36c13c49c8199306c01013dcc6ee8264ee3f1126ac827de0133
MD5 SHA1 SHA512

Submit Download

6707ed04-e409-4e4a-8fbc-661e1986b39e.vbs

Path C:\Users\Admin\AppData\Local\Temp\6707ed04-e409-4e4a-8fbc-661e1986b39e.vbs
Size 718B
SHA256 c578615c16f80df7cd992f70d14c3e7a11f88ca30c371cf03228334a1f590093
MD5 02d6a754c84b6b85d6ba3969661e0e3a
SHA1 eb36fc7de96f627c2ec2ca19996b54ed794f0731
SHA512 b2d2a95ee434269897abfdc6c0e2d8c1f11741362873d92eaf265e981c7ce7321123a47307e4e0b4f7184f7be94e2334ef2e4ea3482ba7c76c394220e5a01591
MD5 SHA1 SHA512

Submit Download

7c946e32-b5d4-48d0-ba49-5226c4d0ad7f.vbs

Path C:\Users\Admin\AppData\Local\Temp\7c946e32-b5d4-48d0-ba49-5226c4d0ad7f.vbs
Size 494B
SHA256 8067e3de1043531e065195ddadc44ecbbe0dc100f28932b137b9d8ba3988489e
MD5 7775d642b08e9d4c791367cc49d09701
SHA1 b2b01b641f9947ba115dcea709f0b0ca04c5b9df
SHA512 4d17ae3a1c71d09c2ff58b756bdbe2e059cfd01866a5feadb13bbaf802f0e096ec5ea9e9a7302fe25a157f8a33b400b5852b4921b35fcf2939c1fa9630bef557
MD5 SHA1 SHA512

Submit Download

7e919269-c496-4dfa-be9b-eea8044ae70b.vbs

Path C:\Users\Admin\AppData\Local\Temp\7e919269-c496-4dfa-be9b-eea8044ae70b.vbs
Size 718B
SHA256 14352920d35cc8fcf951786d904eab275f2387f9d309b29e905b2340b0943165
MD5 dc8e33925b48497fcd18e9a5d2b6aa36
SHA1 2f9913b33d3fcae2bf65f657f6e48d9cdc805c5d
SHA512 f2b123a399c1013464b76242a19de7168fa3f7c5af853c2a2bc54ca8a8a4b2080e5017f9c505e345c6aff30fe8d84da25eb4b22f59fc77d24a7d1a8b27165eba
MD5 SHA1 SHA512

Submit Download

955e9c58-d4a5-4dc7-a2fb-50f931789f53.vbs

Path C:\Users\Admin\AppData\Local\Temp\955e9c58-d4a5-4dc7-a2fb-50f931789f53.vbs
Size 718B
SHA256 129bed6d13ab67a6d90c653c6373488e1f8fc68ac6c83004061dda67f77b08a5
MD5 cba21385a710f90e4c6b6ab5d2eae1cf
SHA1 02eb8c099345d02982c8c495cade82418059583b
SHA512 14685e981a2e36366409e96ed5dbf7fdaea049577534dd2fdaf0864d3dac7c0d055a079826b624b4313fb2c52117e7958b4d3e8fa789253ddbc95664ec6175ef
MD5 SHA1 SHA512

Submit Download

a4c01f3d-98f3-49b7-9f6c-e52d14483e29.vbs

Path C:\Users\Admin\AppData\Local\Temp\a4c01f3d-98f3-49b7-9f6c-e52d14483e29.vbs
Size 718B
SHA256 b3381a93f7f6287cf6a1e3c801489a46ea71f49dedf35d270b07e3ebe86279d4
MD5 56a6e7f544487bb7efe3581a081287ad
SHA1 d908ad42111c2bb78c113a6af31a7019ebb4049e
SHA512 521349d6c4233927fa1cdc944d6f228d2aeb27662fdb5ec4475f39cd6302323f2d073983c0967ff3e5ebefa404fa6c1fa206781da41b1b3a331a121a0d6c78c2
MD5 SHA1 SHA512

Submit Download

b1b7fd66-bd99-48c6-9ec8-8bc4ec01bd05.vbs

Path C:\Users\Admin\AppData\Local\Temp\b1b7fd66-bd99-48c6-9ec8-8bc4ec01bd05.vbs
Size 718B
SHA256 26e8348a4b4f97b7a15788eec8d055d4f45268fc584497ebcfe951c35c49c72a
MD5 5d589f9dc1739c2fcd5365f910b1192d
SHA1 dd276c75469a94ed85b76ed6ca8906184f1fa4b3
SHA512 af8d91948dc5a6bd3efc82c56b281a31aa6ee36d54ff47a5ba20d396cda00024403f59cc984ed2d3ccaa70ab112fbf1226aefceab7fee2115e776ed0d1e2f6ad
MD5 SHA1 SHA512

Submit Download

b252635a-cd2b-45fd-9412-8dd686aa7f2d.vbs

Path C:\Users\Admin\AppData\Local\Temp\b252635a-cd2b-45fd-9412-8dd686aa7f2d.vbs
Size 718B
SHA256 e9bd14fd30f233d03e5e5781c7d17273a36080ccc6c8ffd2f9d9fc2c59450012
MD5 f02d9f83342ae8da855b7f12a7398693
SHA1 58983ca611641483fbb3871baa7028b407810ca0
SHA512 d3b69f531391037d97af4890aef4eb5ed9715400c7392888830a230740af9dc34dff5bf472e0ad33ec1e16d543487f145a8b84f08f68a5a2807524cbe19d98d1
MD5 SHA1 SHA512

Submit Download

b8d5e12a-796e-4406-b3d9-f06a403bf8e1.vbs

Path C:\Users\Admin\AppData\Local\Temp\b8d5e12a-796e-4406-b3d9-f06a403bf8e1.vbs
Size 718B
SHA256 ecaebe8e62ad215c4e4ff34f3aa147686f9fec875d8f9da30510ee9e1f06e7c8
MD5 38768bfaec9acc6ce10a72f1d408307a
SHA1 6ec17ceed5e474b7dc3fecff1bad78197afaabc2
SHA512 0cab39125921126f821848eb36941503a81d4161ddb9acad56f7895d4ca5372e04395529549a8200e51a0430afb6a985d93d2d0ac7038bde7eb589f8d48f387b
MD5 SHA1 SHA512

Submit Download

c7e0b029-2c95-4f93-a436-e40b50d20218.vbs

Path C:\Users\Admin\AppData\Local\Temp\c7e0b029-2c95-4f93-a436-e40b50d20218.vbs
Size 718B
SHA256 29a4146d82e632381389022a5ede13659b45338caef138ce37188cc414e79d7f
MD5 2bb9adf6e50c1c7878e83475686e0469
SHA1 0e64c85552613a48e8e1a822ea4396f2fc8e7f8e
SHA512 3ea1aac9b686a512af9283d4971917ab181451864358efc44011c4630f43c0923be8cfc421b17bf047b6a7a7e60fb4fb1eadb50837792d54729b6b290267826b
MD5 SHA1 SHA512

Submit Download

ef0abced-bd95-4a7e-8562-2b54301c94e3.vbs

Path C:\Users\Admin\AppData\Local\Temp\ef0abced-bd95-4a7e-8562-2b54301c94e3.vbs
Size 718B
SHA256 44070737dc695b951900009c023863d4e69ea7f4a4168f57f68caf01a0d61daa
MD5 b1bdea1ac3eeb576810da2c5e69851d8
SHA1 8e370afc3f90644bcd533100ca89f4f51cda1cd0
SHA512 aafa47710837127678e55fb4c0b6647957e6a26c6ae13c73c8179b042994a355d4995debf8a22a6ea2f8bd86669d56566820cc187c8b464a0f517cf940c0dedb
MD5 SHA1 SHA512

Submit Download

wxfkt16eiv.bat

Path C:\Users\Admin\AppData\Local\Temp\wxfkt16eiv.bat
Size 207B
SHA256 8195b576d06273d160f7450e57460b48e4ce1cb0e6620cc8898b758ead6d4760
MD5 b7058489c5dd141f48e6358800b2966e
SHA1 699da5268f06671d1c28b9f1be955bd5addc9755
SHA512 eece9af7efcab2cb6890edfd4662933ec96b22e3171e0175797bca30cda8511204ce3440cdb8e7de20827d2d9061ec49fde6151ea1e98cc4386098097ce9aa1c
MD5 SHA1 SHA512

Submit Download

memory/2412-149-0x0000000002E00000-0x0000000002E12000-memory.dmp

Download

memory/3020-161-0x000000001BB30000-0x000000001BB86000-memory.dmp

Download

memory/3112-15-0x000000001C2B0000-0x000000001C2BA000-memory.dmp

Download

memory/3112-16-0x000000001C2C0000-0x000000001C316000-memory.dmp

Download

memory/3112-19-0x000000001C330000-0x000000001C33C000-memory.dmp

Download

memory/3112-20-0x000000001C340000-0x000000001C348000-memory.dmp

Download

memory/3112-21-0x000000001C350000-0x000000001C362000-memory.dmp

Download

memory/3112-22-0x000000001C8B0000-0x000000001CDD8000-memory.dmp

Download

memory/3112-24-0x000000001C390000-0x000000001C39C000-memory.dmp

Download

memory/3112-23-0x000000001C380000-0x000000001C38C000-memory.dmp

Download

memory/3112-26-0x000000001C3B0000-0x000000001C3BC000-memory.dmp

Download

memory/3112-25-0x000000001C3A0000-0x000000001C3A8000-memory.dmp

Download

memory/3112-27-0x000000001C3C0000-0x000000001C3CC000-memory.dmp

Download

memory/3112-28-0x000000001C640000-0x000000001C648000-memory.dmp

Download

memory/3112-29-0x000000001C4D0000-0x000000001C4DC000-memory.dmp

Download

memory/3112-30-0x000000001C4E0000-0x000000001C4EA000-memory.dmp

Download

memory/3112-31-0x000000001C4F0000-0x000000001C4FE000-memory.dmp

Download

memory/3112-33-0x000000001C610000-0x000000001C61E000-memory.dmp

Download

memory/3112-32-0x000000001C600000-0x000000001C608000-memory.dmp

Download

memory/3112-35-0x000000001C630000-0x000000001C63C000-memory.dmp

Download

memory/3112-34-0x000000001C620000-0x000000001C628000-memory.dmp

Download

memory/3112-37-0x000000001C660000-0x000000001C66A000-memory.dmp

Download

memory/3112-38-0x000000001C670000-0x000000001C67C000-memory.dmp

Download

memory/3112-36-0x000000001C650000-0x000000001C658000-memory.dmp

Download

memory/3112-17-0x000000001C310000-0x000000001C31C000-memory.dmp

Download

memory/3112-18-0x000000001C320000-0x000000001C328000-memory.dmp

Download

memory/3112-73-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp

Download

memory/3112-1-0x0000000000B20000-0x0000000000E7A000-memory.dmp

Download

memory/3112-0-0x00007FFCCB8F3000-0x00007FFCCB8F5000-memory.dmp

Download

memory/3112-14-0x000000001C140000-0x000000001C150000-memory.dmp

Download

memory/3112-13-0x000000001C130000-0x000000001C138000-memory.dmp

Download

memory/3112-2-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp

Download

memory/3112-12-0x000000001C2A0000-0x000000001C2AC000-memory.dmp

Download

memory/3112-3-0x0000000003060000-0x000000000306E000-memory.dmp

Download

memory/3112-11-0x000000001C120000-0x000000001C132000-memory.dmp

Download

memory/3112-4-0x0000000003070000-0x0000000003078000-memory.dmp

Download

memory/3112-9-0x000000001C100000-0x000000001C116000-memory.dmp

Download

memory/3112-10-0x000000001B9E0000-0x000000001B9E8000-memory.dmp

Download

memory/3112-5-0x000000001B9A0000-0x000000001B9BC000-memory.dmp

Download

memory/3112-7-0x000000001B9C0000-0x000000001B9C8000-memory.dmp

Download

memory/3112-8-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Download

memory/3112-6-0x000000001C150000-0x000000001C1A0000-memory.dmp

Download

memory/3600-77-0x000000001B690000-0x000000001B6A2000-memory.dmp

Download

memory/3648-90-0x000000001B790000-0x000000001B7A2000-memory.dmp

Download

memory/3700-137-0x000000001C3A0000-0x000000001C3B2000-memory.dmp

Download

memory/4060-102-0x000000001BAB0000-0x000000001BAC2000-memory.dmp

Download

memory/4688-114-0x000000001B0A0000-0x000000001B0B2000-memory.dmp

Download