Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
28/06/2024, 01:05
Behavioral task
behavioral1
Sample
1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067.exe
Resource
win7-20240611-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
22 signatures
150 seconds
General
- Target 1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067.exe
- Size 3.7MB
- Sample240628-bf1vvssdrg
- SHA256 1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067
- MD5 22cc90f49c151e2b37d98947d4fc7390
- SHA1 2838b3e4d3d67bd9af50535130c017f3f0e03e61
- SHA512 12eae0f34661ed05742cd183dc4225949004a60d59487d9771b6789482a71821560b3ffd1c81cdb4d5cd2e289f3843b91bfdb65379810b4200c03778c9e44b22
- SSDEEP 98304:Ubtsvkrdch4OslTJ64XIQB3MjkbFw6kzGYn:UJs8rCrsp44XIq3qztn
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- DcRat 50 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process 3304 schtasks.exe 2624 schtasks.exe 4856 schtasks.exe 1508 schtasks.exe 1040 schtasks.exe 4748 schtasks.exe 4572 schtasks.exe 3844 schtasks.exe 3488 schtasks.exe 3432 schtasks.exe 4088 schtasks.exe 4396 schtasks.exe 4324 schtasks.exe 2384 schtasks.exe 2420 schtasks.exe 768 schtasks.exe 2764 schtasks.exe 8 schtasks.exe 2096 schtasks.exe 2800 schtasks.exe 4536 schtasks.exe 2468 schtasks.exe 4200 schtasks.exe 4188 schtasks.exe 3196 schtasks.exe 1252 schtasks.exe 3492 schtasks.exe 3132 schtasks.exe 3896 schtasks.exe 4404 schtasks.exe File created C:\Program Files (x86)\Windows Mail\6ccacd8608530f portruntimesvc.exe 4064 schtasks.exe 5036 schtasks.exe 816 schtasks.exe 2676 schtasks.exe 3916 schtasks.exe 3496 schtasks.exe 2900 schtasks.exe 5064 schtasks.exe 212 schtasks.exe 3904 schtasks.exe 4720 schtasks.exe 1152 schtasks.exe 3212 schtasks.exe 3892 schtasks.exe 4460 schtasks.exe 3776 schtasks.exe 3216 schtasks.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067.exe 3788 schtasks.exe - Modifies WinLogon for persistence 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\Program Files\\Windows Defender\\uk-UA\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\Program Files\\Windows Defender\\uk-UA\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\HyperSurrogateContaineragentWin\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Pictures\\RuntimeBroker.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\Program Files\\Windows Defender\\uk-UA\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\HyperSurrogateContaineragentWin\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Pictures\\RuntimeBroker.exe\", \"C:\\Windows\\Speech\\Engines\\Lexicon\\csrss.exe\", \"C:\\Users\\Default\\csrss.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\csrss.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\Idle.exe\", \"C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\WmiPrvSE.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\Program Files\\Windows Defender\\uk-UA\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\HyperSurrogateContaineragentWin\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Pictures\\RuntimeBroker.exe\", \"C:\\Windows\\Speech\\Engines\\Lexicon\\csrss.exe\", \"C:\\Users\\Default\\csrss.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\csrss.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\Idle.exe\", \"C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\Program Files\\Windows Defender\\uk-UA\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\HyperSurrogateContaineragentWin\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Pictures\\RuntimeBroker.exe\", \"C:\\Windows\\Speech\\Engines\\Lexicon\\csrss.exe\", \"C:\\Users\\Default\\csrss.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\csrss.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\Idle.exe\", \"C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\ja\\unsecapp.exe\", \"C:\\HyperSurrogateContaineragentWin\\dllhost.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\Program Files\\Windows Defender\\uk-UA\\fontdrvhost.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\Program Files\\Windows Defender\\uk-UA\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\HyperSurrogateContaineragentWin\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Pictures\\RuntimeBroker.exe\", \"C:\\Windows\\Speech\\Engines\\Lexicon\\csrss.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\Program Files\\Windows Defender\\uk-UA\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\HyperSurrogateContaineragentWin\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Pictures\\RuntimeBroker.exe\", \"C:\\Windows\\Speech\\Engines\\Lexicon\\csrss.exe\", \"C:\\Users\\Default\\csrss.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\Program Files\\Windows Defender\\uk-UA\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\HyperSurrogateContaineragentWin\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Pictures\\RuntimeBroker.exe\", \"C:\\Windows\\Speech\\Engines\\Lexicon\\csrss.exe\", \"C:\\Users\\Default\\csrss.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\csrss.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\Idle.exe\", \"C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\ja\\unsecapp.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\Program Files\\Windows Defender\\uk-UA\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\Program Files\\Windows Defender\\uk-UA\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\HyperSurrogateContaineragentWin\\backgroundTaskHost.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\Program Files\\Windows Defender\\uk-UA\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\HyperSurrogateContaineragentWin\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Pictures\\RuntimeBroker.exe\", \"C:\\Windows\\Speech\\Engines\\Lexicon\\csrss.exe\", \"C:\\Users\\Default\\csrss.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\csrss.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\Program Files\\Windows Defender\\uk-UA\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\HyperSurrogateContaineragentWin\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Pictures\\RuntimeBroker.exe\", \"C:\\Windows\\Speech\\Engines\\Lexicon\\csrss.exe\", \"C:\\Users\\Default\\csrss.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\csrss.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\Program Files\\Windows Defender\\uk-UA\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\HyperSurrogateContaineragentWin\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Pictures\\RuntimeBroker.exe\", \"C:\\Windows\\Speech\\Engines\\Lexicon\\csrss.exe\", \"C:\\Users\\Default\\csrss.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\csrss.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\Idle.exe\"" portruntimesvc.exe - Process spawned unexpected child process 48 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4088 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3892 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3492 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4064 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 212 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4188 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3896 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4856 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3844 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2384 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4460 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 768 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4200 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4572 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2764 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2420 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3212 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5064 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4404 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4396 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1152 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2096 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3496 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3196 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2800 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1508 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1040 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3304 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3788 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5036 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4324 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2900 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3132 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4536 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3904 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2468 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3776 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3488 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 816 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3216 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4748 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2624 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3432 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2676 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4720 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1252 4868 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3916 4868 schtasks.exe 94 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" portruntimesvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" portruntimesvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" portruntimesvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe -
resource yara_rule behavioral2/files/0x000700000002341c-15.dat dcrat behavioral2/memory/4740-17-0x00000000001F0000-0x000000000055A000-memory.dmp dcrat - Detects executables packed with SmartAssembly 9 IoCs
resource yara_rule behavioral2/memory/4740-24-0x000000001B7D0000-0x000000001B7E0000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4740-31-0x000000001B9A0000-0x000000001B9AA000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4740-39-0x000000001BA70000-0x000000001BA7C000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4740-40-0x000000001BA80000-0x000000001BA8C000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4740-43-0x000000001BAB0000-0x000000001BABC000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4740-45-0x000000001BBD0000-0x000000001BBDC000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4740-46-0x000000001BBE0000-0x000000001BBEA000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4740-51-0x000000001BD30000-0x000000001BD3C000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4740-53-0x000000001BD50000-0x000000001BD5A000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly - Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation portruntimesvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe - Executes dropped EXE 14 IoCs
pid Process 4740 portruntimesvc.exe 2360 OfficeClickToRun.exe 2556 OfficeClickToRun.exe 2748 OfficeClickToRun.exe 4572 OfficeClickToRun.exe 1772 OfficeClickToRun.exe 4052 OfficeClickToRun.exe 1060 OfficeClickToRun.exe 4536 OfficeClickToRun.exe 5084 OfficeClickToRun.exe 4988 OfficeClickToRun.exe 4944 OfficeClickToRun.exe 640 OfficeClickToRun.exe 4596 OfficeClickToRun.exe - Adds Run key to start application 2 TTPs 32 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\csrss.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\csrss.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\Idle.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\WmiPrvSE.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Recovery\\WindowsRE\\cmd.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\HyperSurrogateContaineragentWin\\backgroundTaskHost.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\Speech\\Engines\\Lexicon\\csrss.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Windows Defender\\uk-UA\\fontdrvhost.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\WmiPrvSE.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows Multimedia Platform\\csrss.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows Multimedia Platform\\csrss.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\ja\\unsecapp.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Public\\Pictures\\RuntimeBroker.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\Speech\\Engines\\Lexicon\\csrss.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\Idle.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\ja\\unsecapp.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Windows Defender\\uk-UA\\fontdrvhost.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Recovery\\WindowsRE\\cmd.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\HyperSurrogateContaineragentWin\\backgroundTaskHost.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\HyperSurrogateContaineragentWin\\dllhost.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\HyperSurrogateContaineragentWin\\dllhost.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Public\\Pictures\\RuntimeBroker.exe\"" portruntimesvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\"" portruntimesvc.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA portruntimesvc.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" portruntimesvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OfficeClickToRun.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Mail\6ccacd8608530f portruntimesvc.exe File created C:\Program Files\Windows Defender\uk-UA\fontdrvhost.exe portruntimesvc.exe File created C:\Program Files (x86)\Windows Portable Devices\cc11b995f2a76d portruntimesvc.exe File created C:\Program Files\Windows Multimedia Platform\886983d96e3d3e portruntimesvc.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\unsecapp.exe portruntimesvc.exe File created C:\Program Files (x86)\Windows Mail\Idle.exe portruntimesvc.exe File created C:\Program Files (x86)\Windows Portable Devices\winlogon.exe portruntimesvc.exe File created C:\Program Files\Windows Multimedia Platform\csrss.exe portruntimesvc.exe File created C:\Program Files (x86)\Common Files\Adobe\HelpCfg\WmiPrvSE.exe portruntimesvc.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\29c1c3cc0f7685 portruntimesvc.exe File opened for modification C:\Program Files (x86)\Windows Mail\Idle.exe portruntimesvc.exe File created C:\Program Files (x86)\Internet Explorer\de-DE\Idle.exe portruntimesvc.exe File created C:\Program Files (x86)\Internet Explorer\de-DE\6ccacd8608530f portruntimesvc.exe File created C:\Program Files\Windows Defender\uk-UA\5b884080fd4f94 portruntimesvc.exe File created C:\Program Files (x86)\Common Files\Adobe\HelpCfg\24dbde2999530e portruntimesvc.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Speech\Engines\Lexicon\csrss.exe portruntimesvc.exe File created C:\Windows\Speech\Engines\Lexicon\886983d96e3d3e portruntimesvc.exe File created C:\Windows\Boot\DVD\unsecapp.exe portruntimesvc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings 1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings OfficeClickToRun.exe - Modifies registry key 1 TTPs 1 IoCs
pid Process 4516 reg.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5064 schtasks.exe 4396 schtasks.exe 2676 schtasks.exe 1252 schtasks.exe 3492 schtasks.exe 3844 schtasks.exe 4856 schtasks.exe 768 schtasks.exe 3304 schtasks.exe 3904 schtasks.exe 3916 schtasks.exe 4088 schtasks.exe 212 schtasks.exe 4404 schtasks.exe 3788 schtasks.exe 5036 schtasks.exe 2900 schtasks.exe 3132 schtasks.exe 816 schtasks.exe 3892 schtasks.exe 2420 schtasks.exe 4200 schtasks.exe 3212 schtasks.exe 3496 schtasks.exe 1040 schtasks.exe 3216 schtasks.exe 2624 schtasks.exe 4064 schtasks.exe 4188 schtasks.exe 4720 schtasks.exe 2384 schtasks.exe 2800 schtasks.exe 4324 schtasks.exe 8 schtasks.exe 3896 schtasks.exe 3196 schtasks.exe 2468 schtasks.exe 3776 schtasks.exe 4460 schtasks.exe 1152 schtasks.exe 1508 schtasks.exe 3488 schtasks.exe 2764 schtasks.exe 2096 schtasks.exe 4748 schtasks.exe 3432 schtasks.exe 4572 schtasks.exe 4536 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 4740 portruntimesvc.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2360 OfficeClickToRun.exe 2556 OfficeClickToRun.exe 2556 OfficeClickToRun.exe 2556 OfficeClickToRun.exe 2556 OfficeClickToRun.exe 2556 OfficeClickToRun.exe 2556 OfficeClickToRun.exe 2556 OfficeClickToRun.exe 2556 OfficeClickToRun.exe 2556 OfficeClickToRun.exe 2556 OfficeClickToRun.exe 2556 OfficeClickToRun.exe 2556 OfficeClickToRun.exe 2556 OfficeClickToRun.exe 2556 OfficeClickToRun.exe - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 4740 portruntimesvc.exe Token: SeDebugPrivilege 2360 OfficeClickToRun.exe Token: SeDebugPrivilege 2556 OfficeClickToRun.exe Token: SeDebugPrivilege 2748 OfficeClickToRun.exe Token: SeDebugPrivilege 4572 OfficeClickToRun.exe Token: SeDebugPrivilege 1772 OfficeClickToRun.exe Token: SeDebugPrivilege 4052 OfficeClickToRun.exe Token: SeDebugPrivilege 1060 OfficeClickToRun.exe Token: SeDebugPrivilege 4536 OfficeClickToRun.exe Token: SeDebugPrivilege 5084 OfficeClickToRun.exe Token: SeDebugPrivilege 4988 OfficeClickToRun.exe Token: SeDebugPrivilege 4944 OfficeClickToRun.exe Token: SeDebugPrivilege 640 OfficeClickToRun.exe Token: SeDebugPrivilege 4596 OfficeClickToRun.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1508 wrote to memory of 3216 1508 1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067.exe 82 PID 1508 wrote to memory of 3216 1508 1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067.exe 82 PID 1508 wrote to memory of 3216 1508 1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067.exe 82 PID 1508 wrote to memory of 2668 1508 1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067.exe 83 PID 1508 wrote to memory of 2668 1508 1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067.exe 83 PID 1508 wrote to memory of 2668 1508 1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067.exe 83 PID 3216 wrote to memory of 4236 3216 WScript.exe 88 PID 3216 wrote to memory of 4236 3216 WScript.exe 88 PID 3216 wrote to memory of 4236 3216 WScript.exe 88 PID 4236 wrote to memory of 4740 4236 cmd.exe 92 PID 4236 wrote to memory of 4740 4236 cmd.exe 92 PID 4740 wrote to memory of 2360 4740 portruntimesvc.exe 143 PID 4740 wrote to memory of 2360 4740 portruntimesvc.exe 143 PID 4236 wrote to memory of 4516 4236 cmd.exe 144 PID 4236 wrote to memory of 4516 4236 cmd.exe 144 PID 4236 wrote to memory of 4516 4236 cmd.exe 144 PID 2360 wrote to memory of 4188 2360 OfficeClickToRun.exe 146 PID 2360 wrote to memory of 4188 2360 OfficeClickToRun.exe 146 PID 2360 wrote to memory of 3392 2360 OfficeClickToRun.exe 147 PID 2360 wrote to memory of 3392 2360 OfficeClickToRun.exe 147 PID 4188 wrote to memory of 2556 4188 WScript.exe 150 PID 4188 wrote to memory of 2556 4188 WScript.exe 150 PID 2556 wrote to memory of 3188 2556 OfficeClickToRun.exe 151 PID 2556 wrote to memory of 3188 2556 OfficeClickToRun.exe 151 PID 2556 wrote to memory of 4464 2556 OfficeClickToRun.exe 152 PID 2556 wrote to memory of 4464 2556 OfficeClickToRun.exe 152 PID 3188 wrote to memory of 2748 3188 WScript.exe 153 PID 3188 wrote to memory of 2748 3188 WScript.exe 153 PID 2748 wrote to memory of 2224 2748 OfficeClickToRun.exe 154 PID 2748 wrote to memory of 2224 2748 OfficeClickToRun.exe 154 PID 2748 wrote to memory of 4364 2748 OfficeClickToRun.exe 155 PID 2748 wrote to memory of 4364 2748 OfficeClickToRun.exe 155 PID 2224 wrote to memory of 4572 2224 WScript.exe 159 PID 2224 wrote to memory of 4572 2224 WScript.exe 159 PID 4572 wrote to memory of 1556 4572 OfficeClickToRun.exe 160 PID 4572 wrote to memory of 1556 4572 OfficeClickToRun.exe 160 PID 4572 wrote to memory of 1508 4572 OfficeClickToRun.exe 161 PID 4572 wrote to memory of 1508 4572 OfficeClickToRun.exe 161 PID 1556 wrote to memory of 1772 1556 WScript.exe 162 PID 1556 wrote to memory of 1772 1556 WScript.exe 162 PID 1772 wrote to memory of 3416 1772 OfficeClickToRun.exe 163 PID 1772 wrote to memory of 3416 1772 OfficeClickToRun.exe 163 PID 1772 wrote to memory of 1752 1772 OfficeClickToRun.exe 164 PID 1772 wrote to memory of 1752 1772 OfficeClickToRun.exe 164 PID 3416 wrote to memory of 4052 3416 WScript.exe 167 PID 3416 wrote to memory of 4052 3416 WScript.exe 167 PID 4052 wrote to memory of 5012 4052 OfficeClickToRun.exe 168 PID 4052 wrote to memory of 5012 4052 OfficeClickToRun.exe 168 PID 4052 wrote to memory of 1236 4052 OfficeClickToRun.exe 169 PID 4052 wrote to memory of 1236 4052 OfficeClickToRun.exe 169 PID 5012 wrote to memory of 1060 5012 WScript.exe 170 PID 5012 wrote to memory of 1060 5012 WScript.exe 170 PID 1060 wrote to memory of 2460 1060 OfficeClickToRun.exe 171 PID 1060 wrote to memory of 2460 1060 OfficeClickToRun.exe 171 PID 1060 wrote to memory of 4080 1060 OfficeClickToRun.exe 172 PID 1060 wrote to memory of 4080 1060 OfficeClickToRun.exe 172 PID 2460 wrote to memory of 4536 2460 WScript.exe 173 PID 2460 wrote to memory of 4536 2460 WScript.exe 173 PID 4536 wrote to memory of 4324 4536 OfficeClickToRun.exe 174 PID 4536 wrote to memory of 4324 4536 OfficeClickToRun.exe 174 PID 4536 wrote to memory of 2908 4536 OfficeClickToRun.exe 175 PID 4536 wrote to memory of 2908 4536 OfficeClickToRun.exe 175 PID 4324 wrote to memory of 5084 4324 WScript.exe 176 PID 4324 wrote to memory of 5084 4324 WScript.exe 176 - System policy modification 1 TTPs 42 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" portruntimesvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" portruntimesvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" portruntimesvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" OfficeClickToRun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" OfficeClickToRun.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067.exe"C:\Users\Admin\AppData\Local\Temp\1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067.exe"1⤵
- DcRat
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\HyperSurrogateContaineragentWin\bGPSMCCx73WsREqaBZfJC0ze9BBQbq.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\HyperSurrogateContaineragentWin\Trh5bm.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\HyperSurrogateContaineragentWin\portruntimesvc.exe"C:\HyperSurrogateContaineragentWin\portruntimesvc.exe"4⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4740 -
C:\Recovery\WindowsRE\OfficeClickToRun.exe"C:\Recovery\WindowsRE\OfficeClickToRun.exe"5⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2360 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d0a971b8-f6f7-4626-87d1-c7f5e47f9d39.vbs"6⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Recovery\WindowsRE\OfficeClickToRun.exeC:\Recovery\WindowsRE\OfficeClickToRun.exe7⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2556 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ab83ba5e-3d25-4059-93d3-1bdc44a11862.vbs"8⤵
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Recovery\WindowsRE\OfficeClickToRun.exeC:\Recovery\WindowsRE\OfficeClickToRun.exe9⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2748 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ffa1c5fe-9ed7-4801-8bbc-afb253e3e3e7.vbs"10⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Recovery\WindowsRE\OfficeClickToRun.exeC:\Recovery\WindowsRE\OfficeClickToRun.exe11⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4572 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64e94520-3e9a-4fce-92e8-30d221473ee0.vbs"12⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Recovery\WindowsRE\OfficeClickToRun.exeC:\Recovery\WindowsRE\OfficeClickToRun.exe13⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1772 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\524ad59f-65ba-45c4-8a49-7fb59236850c.vbs"14⤵
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Recovery\WindowsRE\OfficeClickToRun.exeC:\Recovery\WindowsRE\OfficeClickToRun.exe15⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4052 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1e7c1e8e-854e-4e45-b641-1aa6f9ed3369.vbs"16⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Recovery\WindowsRE\OfficeClickToRun.exeC:\Recovery\WindowsRE\OfficeClickToRun.exe17⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1060 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\41dee001-21bd-46a3-af97-761ca7237325.vbs"18⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Recovery\WindowsRE\OfficeClickToRun.exeC:\Recovery\WindowsRE\OfficeClickToRun.exe19⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4536 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\113190ac-7ddf-4d81-9636-7916397a24cb.vbs"20⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Recovery\WindowsRE\OfficeClickToRun.exeC:\Recovery\WindowsRE\OfficeClickToRun.exe21⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:5084 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\883f37eb-9568-47ee-af23-fbef96dc79ef.vbs"22⤵PID:4228
-
C:\Recovery\WindowsRE\OfficeClickToRun.exeC:\Recovery\WindowsRE\OfficeClickToRun.exe23⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4988 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f95092a7-69d8-42eb-a989-03770cebed28.vbs"24⤵PID:4196
-
C:\Recovery\WindowsRE\OfficeClickToRun.exeC:\Recovery\WindowsRE\OfficeClickToRun.exe25⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4944 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\57dac010-f509-4d1b-a238-ff5ff8f0ac3d.vbs"26⤵PID:4524
-
C:\Recovery\WindowsRE\OfficeClickToRun.exeC:\Recovery\WindowsRE\OfficeClickToRun.exe27⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:640 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\de8df7f7-9b8d-4039-a0cb-c6bd65d6ef02.vbs"28⤵PID:1684
-
C:\Recovery\WindowsRE\OfficeClickToRun.exeC:\Recovery\WindowsRE\OfficeClickToRun.exe29⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4596 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1137b1ca-7da8-4881-ade3-512a6fb58ad2.vbs"30⤵PID:2944
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8a3e3535-d350-45a5-8934-d304dafb9880.vbs"30⤵PID:3516
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e9ecbafb-cbbc-41e5-8199-5f548ffe7f7d.vbs"28⤵PID:4932
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\517add42-4f5f-4f18-9ae4-39a1e608d1a1.vbs"26⤵PID:4048
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\53780ca9-0514-4cae-aebd-f8bb18f70073.vbs"24⤵PID:3636
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\320cb9de-9460-48ff-ad4b-d10ea04505ce.vbs"22⤵PID:3676
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\791ecd12-095f-4f34-928d-6204db24c0c8.vbs"20⤵PID:2908
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7401f2f8-1d1f-4d30-8064-738e25dfa87f.vbs"18⤵PID:4080
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ad310f1-b7ee-4d7d-b340-cf48bd6413ab.vbs"16⤵PID:1236
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\69f7056f-336f-458c-ab1c-e91f27a12803.vbs"14⤵PID:1752
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6c998396-2db1-4187-8927-beb528a81a31.vbs"12⤵PID:1508
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce078c63-b3c5-430b-ae87-78646433ab13.vbs"10⤵PID:4364
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eaaee6f8-d6b8-4a98-9e89-7a6aeeb2aa0b.vbs"8⤵PID:4464
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e65b76c-0acd-41ba-8b59-7210f217bf06.vbs"6⤵PID:3392
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
- Modifies registry key
PID:4516
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\HyperSurrogateContaineragentWin\file.vbs"2⤵PID:2668
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\HyperSurrogateContaineragentWin\winlogon.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3492
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\HyperSurrogateContaineragentWin\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\HyperSurrogateContaineragentWin\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\uk-UA\fontdrvhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4188
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\uk-UA\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3896
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\uk-UA\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3844
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:768
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4200
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\HyperSurrogateContaineragentWin\backgroundTaskHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\HyperSurrogateContaineragentWin\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\HyperSurrogateContaineragentWin\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\Speech\Engines\Lexicon\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Speech\Engines\Lexicon\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\Speech\Engines\Lexicon\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Default\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3788
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Documents\My Music\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Documents\My Music\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4324
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Documents\My Music\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\Idle.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3132
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3904
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Adobe\HelpCfg\WmiPrvSE.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\HelpCfg\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3776
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Adobe\HelpCfg\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:816
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\unsecapp.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\HyperSurrogateContaineragentWin\dllhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\HyperSurrogateContaineragentWin\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1252
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\HyperSurrogateContaineragentWin\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3916
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\HyperSurrogateContaineragentWin\Trh5bm.bat
- Size 167B
- SHA256 d4ecf707a041c14ab6e6719b4c0bcdea96c159865ff6ef80fd73de0b26b695c8
- MD5 44e4cd0532339b7e22611a09c8220999
- SHA1 8f742acb720ef17baa41ef700c29a3af5582bef9
- SHA512 f10dfda0fc0021f642fc0689a8d217052e50c9e58d1057c2f26005df0433e3af54ac77331d9059746804ddb72589f0e4ec3f50c53b1576efb09134e2aa691809
- MD5 SHA1 SHA512
- Path C:\HyperSurrogateContaineragentWin\bGPSMCCx73WsREqaBZfJC0ze9BBQbq.vbe
- Size 214B
- SHA256 e6a2ee525011550a1508f69a603a3b485e35ec89b9783171cff58a4adccb1fee
- MD5 bbd4951dfa4c586309c29313a1acc7b9
- SHA1 b16961014ff484fee5c5548506fa9f8786ead667
- SHA512 5a7985a58c283240a7c999521a14a8befe71db33d9023f06a78870c663fefbfeac5b9acafc114937ea44ddffb97bad88c448a0c2d025aa21f73d7941b3aaa50e
- MD5 SHA1 SHA512
- Path C:\HyperSurrogateContaineragentWin\file.vbs
- Size 34B
- SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
- MD5 677cc4360477c72cb0ce00406a949c61
- SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
- SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
- MD5 SHA1 SHA512
- Path C:\HyperSurrogateContaineragentWin\portruntimesvc.exe
- Size 3.4MB
- SHA256 1a38cd5a9e8fb8086a6f84ac2bbac0ded061766fcdf3a25a1e6147a400cb8b39
- MD5 3ae60214e5dd15829d6380f5dcaac75c
- SHA1 c4ff1e0ef5b97b467b28039b3b902b088107ebae
- SHA512 816f2e195827abe524d3ffe3c87ee6a5e02289c2fad1a5ed5b5751ecc356998b61b9638c65b7db7f231a3bc50c002995823755650a703cae12aa9decf4c995ac
- SSDEEP 98304:jsvkrdch4OslTJ64XIQB3MjkbFw6kzGY:js8rCrsp44XIq3qzt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OfficeClickToRun.exe.log
- Size 1KB
- SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
- MD5 49b64127208271d8f797256057d0b006
- SHA1 b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
- SHA512 f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\113190ac-7ddf-4d81-9636-7916397a24cb.vbs
- Size 718B
- SHA256 0a4f343e8b8a6d80c7a71ab3f15501d0412e653ea8c7216125349c30250942ab
- MD5 a97921345d7b2bedf2047da169332832
- SHA1 acb1d8a46c36826f53eb03e8b276b882e4cc8aa5
- SHA512 a83e8224a3e958541178ec15a3361d9d64dec06d0afdc170866eb38d1051a51b2e340659dbdb8314ca47aaf5b4bc5b328b7cef613c5eef5635d69e19753c1803
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\1137b1ca-7da8-4881-ade3-512a6fb58ad2.vbs
- Size 718B
- SHA256 43a71385d5d6493f0a849b197f944ba67f1ee94d281ed7d51a084e97baeab637
- MD5 7668e1c1df9e6dc0a5913bf0bb86d150
- SHA1 cd3a2343bd7a5e626b862c99ad0c7fc8c33d11eb
- SHA512 63bdc85edb0f3b85d9cfe1b925d19e70885488bb28c9134022c492f1fff72f2f379f2a12f5738ef141247b7fbc436eeba1d1dd3aea37ddcb2afb875f048b1e7b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\1e7c1e8e-854e-4e45-b641-1aa6f9ed3369.vbs
- Size 718B
- SHA256 0ebb1f66eb621d6d419eec474dff69f5a3fe91970fc9199f2351e63b05ac7191
- MD5 faa48a64e95fab4bf3243ae738b61896
- SHA1 b5de1caaf168fbfc5622816049bfc38910b69122
- SHA512 15c99321ec97b087dff02b1fb01c4487477fd72b3022766d24837d5ef70e04e648d36963c4ae2a944433a5ac4be3aac6541f6f799d0ab0c8a4116e81f5fe4746
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\3e65b76c-0acd-41ba-8b59-7210f217bf06.vbs
- Size 494B
- SHA256 8bc6e7ef9ddba9bbd67fba16668b07a89353824c89a35cb0bc5164ca26330c02
- MD5 8d4125cce4abce259d34374c7ccb643b
- SHA1 029df17d9efa396a4933956410194a467d94af7b
- SHA512 460ec3d72051784d7310f2afa5af9726ccc85e2533443ac997f5d72847c77d525c0d161a9dec2134e70bdc05e6614fbf01d399123ebf01bd3714592977527a4a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\41dee001-21bd-46a3-af97-761ca7237325.vbs
- Size 718B
- SHA256 b831125e10634a41867f79746b828b0087395be3dde632555e797777527c1271
- MD5 755cd4bd0056137c331f0d85cd6c145c
- SHA1 bdd958ed8cc8bdcdf083533ddbedbc368c91d933
- SHA512 b31e3cb5f3f43989a4b87ad5cc4c09c2aad75e321688589dd1936ab58f2e245a2a856d92034aff781d098f55355c7c77eee3d2fca39cd7e9aa374c71319c650c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\524ad59f-65ba-45c4-8a49-7fb59236850c.vbs
- Size 718B
- SHA256 fa6b45921bdea19c24911a6f2b274bf5622c468ad097442112e51e387690d130
- MD5 1a5fe78a9c418dcdf0b48e06fa61f29b
- SHA1 5e2cd42c6bba2d9a1b86f1babe6d1e5d249f15d7
- SHA512 a526b951be2cd7cdf6652e14e42f760fb6b9244eb4de7a6f6ed7a6a46c5f855574caa072c442ea2d7a37a943fe52abe534ef5e69d219c8e7154d5539a2d8cb63
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\57dac010-f509-4d1b-a238-ff5ff8f0ac3d.vbs
- Size 718B
- SHA256 adb06248cdd92457458e2225556cd7d8ccb999f4d2d03fb33a3307f5b2dd38b0
- MD5 02c78e7a92722487edd2875fd2ed4234
- SHA1 a038fccf478a3ca374ac1cb95f82b8c49edcb5f4
- SHA512 13204957c80bfa6ff9b034741c6e3886e9c2f9b9690f47192de1cb252470392e8e68ac8fd064426c80904f8957f8007dd2e13b67fff430cd741d04f4fa6a00de
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\64e94520-3e9a-4fce-92e8-30d221473ee0.vbs
- Size 718B
- SHA256 24fef89537b3f4e13bbff63b86965b87351699ac2476b9062ed744f07f713438
- MD5 018a312d75a2f99766a377c8cbac3d82
- SHA1 c8d5983171ff05dde089dd4e0ab875cefe6abe65
- SHA512 c28c763cd51230e1fa2074af7a111b54279c1692857d3089cbeb982b45a26cda6d55ac898dd38077ea26de5e80b47ac6fd2bf76b402fe5e13b112b39c69f012d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\883f37eb-9568-47ee-af23-fbef96dc79ef.vbs
- Size 718B
- SHA256 192c83db9f42c24a42c97caa5fe80b363c6cd349ed5b4b86cbc5f9a91e093b96
- MD5 f26ca8f9da8f17d59fe7631089aa12b6
- SHA1 94428c1e41f59c8a773a1b7285b6e47caba571ce
- SHA512 402ca7edb6e0f889f40091909f5219b149903e413ef6e9c2a42a00c67bcfc82943de4c1b1e74dc243afb036a4508f93ba19241a22a1bfa8c44f4d82935166dfc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\ab83ba5e-3d25-4059-93d3-1bdc44a11862.vbs
- Size 718B
- SHA256 5a0600af328e6961de09f0779d12ce725668d953aa06846cf1b218566b8ed160
- MD5 19c0c2e953e9c8b4013f8051d1649dd4
- SHA1 2da09b69471e91ccffcbab079f37074ed6a24c3d
- SHA512 a7701d3cc41a23eeb2e18d52b9e47ce08d2c644706c07e6f89ca3d59a447e4592a0a8a4dcb6a5f4423816618c388b017fa86046f044285c1685c93ecaff66daf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\d0a971b8-f6f7-4626-87d1-c7f5e47f9d39.vbs
- Size 718B
- SHA256 07f41bd169da9ed5457bb012e8bfba4a4bd8036e1da88c041601d72c14a3f502
- MD5 ba8eca4a3599f566e5423cb1f91c5a1b
- SHA1 7dead25926b1b0c527b7eadf2fd37a50cd9d9007
- SHA512 4097a43757f04674abf579510d8ebc472ad3c0f8492599f52dc7c288f344871186e47f506e152a7ec4aded255da6621a41f463fd6addc321e3f55143e46c9786
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\de8df7f7-9b8d-4039-a0cb-c6bd65d6ef02.vbs
- Size 717B
- SHA256 3594864f9e2b592f461e91c10b308e0f063258f64a0e89aed6c73c79d482e31c
- MD5 9ff39ec39f392767c1ebe153fdcfb87b
- SHA1 8f010142c0f1fea177140028afc29a1f90d64521
- SHA512 8eff6f16468490bae95247807a2d2f979bee49d8c8314825aae844ecca7ac86c4a0417a4a0f4ba4a90d55a4a3ac606feeca93c2e39278de63d86e4ed9c2a7678
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\f95092a7-69d8-42eb-a989-03770cebed28.vbs
- Size 718B
- SHA256 74ff210d5bc1d5548d49979e719b882ac1dc9f99492fc677f70b8d28cd118f91
- MD5 69c72c30a34bac8622072a233dfc9e95
- SHA1 f51f54d312e9a49b2017e3e3b1c0c543874ea2a5
- SHA512 097ea9cd6421deb3402b9c6061cb9876c6750a104c0b942d6fb43574d5d6a2e6eee41ae7e955707a9a4366c26245ee656071a5d4975eea8a482d11fb92c0c7ad
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\ffa1c5fe-9ed7-4801-8bbc-afb253e3e3e7.vbs
- Size 718B
- SHA256 0c858cb49172e55c2b8db52c6515ecbf05007105a069600941100898e8a0864e
- MD5 219cb49c10b1359125263d7a606a9f5c
- SHA1 85ca987ba6fcd2e2ce4d43cced9c71c0b7fce519
- SHA512 14baf2d88fd023b49b73a50a488f0b69df9cff1aefcceaf05b69d8fbaf7f69f6700c9ffc5a4958096bcbc7750c817defc6036357bb8aa7c07a4731039b38e272
- MD5 SHA1 SHA512