dcrat | 00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Size 2.7MB
Sample240629-bcs1vazerm
SHA256 00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9
MD5 3b3499bf522f78f62b3f719f7078cbaa
SHA1 faccf8c8c028b3fef6678632766c19c271b99ed4
SHA512 54951168609e925ecd20982b598de527079bee7f44c22b664ff45bd8f384d90f0733c36394ab020bcd25b0bbd75f760e4a6b5c916f04ac5084535c63063d4971
SSDEEP 49152:msWc2Z+L7pWCf65hydIoJOniHoLck1isle2FstJt9NTEKp58MAw:nWl+vpWS6r49GcTcFsjNn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion execution infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\", \"C:\\Windows\\security\\sysmon.exe\", \"C:\\Program Files\\Windows Defender\\de-DE\\sppsvc.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\", \"C:\\Windows\\security\\sysmon.exe\", \"C:\\Program Files\\Windows Defender\\de-DE\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\", \"C:\\Windows\\security\\sysmon.exe\", \"C:\\Program Files\\Windows Defender\\de-DE\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\", \"C:\\Windows\\security\\sysmon.exe\", \"C:\\Program Files\\Windows Defender\\de-DE\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\wininit.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\", \"C:\\Windows\\security\\sysmon.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3296	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3920	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	516	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4312	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3924	5112	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	5112	schtasks.exe	82

UAC bypass 3 TTPs 9 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/744-1-0x0000000000F50000-0x0000000001202000-memory.dmp	dcrat
behavioral2/files/0x0007000000023407-39.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5008	powershell.exe
2144	powershell.exe
4384	powershell.exe
4528	powershell.exe
3668	powershell.exe
4624	powershell.exe
4464	powershell.exe
2808	powershell.exe
1448	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	System.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	System.exe

Executes dropped EXE 5 IoCs

pid	Process
5116	System.exe
4616	System.exe
3908	System.exe
4272	System.exe
792	System.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Windows\\security\\sysmon.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Windows\\security\\sysmon.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\WindowsRE\\System.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Default User\\winlogon.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Default User\\winlogon.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Windows Defender\\de-DE\\sppsvc.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\WindowsRE\\System.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\WindowsPowerShell\\wininit.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Windows Defender\\de-DE\\sppsvc.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\WindowsPowerShell\\wininit.exe\""	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com
5	ip-api.com
9	ip-api.com
13	ip-api.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WindowsPowerShell\56085415360792	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\winlogon.exe	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\cc11b995f2a76d	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
File created	C:\Program Files\Windows Defender\de-DE\sppsvc.exe	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
File created	C:\Program Files\Windows Defender\de-DE\0a1fd5f707cd16	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
File created	C:\Program Files (x86)\WindowsPowerShell\wininit.exe	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\security\sysmon.exe	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
File created	C:\Windows\security\121e5b5079f7c0	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	System.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1312	schtasks.exe
2948	schtasks.exe
3296	schtasks.exe
3376	schtasks.exe
4008	schtasks.exe
996	schtasks.exe
3920	schtasks.exe
516	schtasks.exe
1556	schtasks.exe
1380	schtasks.exe
1800	schtasks.exe
2320	schtasks.exe
3924	schtasks.exe
3512	schtasks.exe
4964	schtasks.exe
1384	schtasks.exe
4836	schtasks.exe
4960	schtasks.exe
4612	schtasks.exe
4896	schtasks.exe
2300	schtasks.exe
2024	schtasks.exe
4312	schtasks.exe
5048	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
3668	powershell.exe
4464	powershell.exe
5008	powershell.exe
4384	powershell.exe
4624	powershell.exe
4624	powershell.exe
4528	powershell.exe
4528	powershell.exe
2808	powershell.exe
1448	powershell.exe
2144	powershell.exe
2144	powershell.exe
4624	powershell.exe
3668	powershell.exe
3668	powershell.exe
5008	powershell.exe
5008	powershell.exe
4384	powershell.exe
4384	powershell.exe
2808	powershell.exe
2808	powershell.exe
4464	powershell.exe
4464	powershell.exe
4528	powershell.exe
1448	powershell.exe
1448	powershell.exe
2144	powershell.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe
5116	System.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Token: SeDebugPrivilege	3668	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	5116	System.exe
Token: SeDebugPrivilege	4616	System.exe
Token: SeDebugPrivilege	3908	System.exe
Token: SeDebugPrivilege	4272	System.exe
Token: SeDebugPrivilege	792	System.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 4384	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	107
PID 744 wrote to memory of 4384	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	107
PID 744 wrote to memory of 3668	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	108
PID 744 wrote to memory of 3668	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	108
PID 744 wrote to memory of 4528	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	109
PID 744 wrote to memory of 4528	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	109
PID 744 wrote to memory of 1448	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	111
PID 744 wrote to memory of 1448	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	111
PID 744 wrote to memory of 2808	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	112
PID 744 wrote to memory of 2808	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	112
PID 744 wrote to memory of 2144	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	114
PID 744 wrote to memory of 2144	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	114
PID 744 wrote to memory of 5008	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	115
PID 744 wrote to memory of 5008	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	115
PID 744 wrote to memory of 4464	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	116
PID 744 wrote to memory of 4464	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	116
PID 744 wrote to memory of 4624	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	117
PID 744 wrote to memory of 4624	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	117
PID 744 wrote to memory of 5116	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	125
PID 744 wrote to memory of 5116	744	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe	125
PID 5116 wrote to memory of 4736	5116	System.exe	126
PID 5116 wrote to memory of 4736	5116	System.exe	126
PID 5116 wrote to memory of 832	5116	System.exe	127
PID 5116 wrote to memory of 832	5116	System.exe	127
PID 5116 wrote to memory of 2228	5116	System.exe	129
PID 5116 wrote to memory of 2228	5116	System.exe	129
PID 2228 wrote to memory of 740	2228	cmd.exe	131
PID 2228 wrote to memory of 740	2228	cmd.exe	131
PID 4736 wrote to memory of 4616	4736	WScript.exe	132
PID 4736 wrote to memory of 4616	4736	WScript.exe	132
PID 2228 wrote to memory of 3908	2228	cmd.exe	133
PID 2228 wrote to memory of 3908	2228	cmd.exe	133
PID 4616 wrote to memory of 3752	4616	System.exe	134
PID 4616 wrote to memory of 3752	4616	System.exe	134
PID 4616 wrote to memory of 3560	4616	System.exe	135
PID 4616 wrote to memory of 3560	4616	System.exe	135
PID 4616 wrote to memory of 2136	4616	System.exe	136
PID 4616 wrote to memory of 2136	4616	System.exe	136
PID 2136 wrote to memory of 4424	2136	cmd.exe	138
PID 2136 wrote to memory of 4424	2136	cmd.exe	138
PID 3752 wrote to memory of 4272	3752	WScript.exe	142
PID 3752 wrote to memory of 4272	3752	WScript.exe	142
PID 2136 wrote to memory of 792	2136	cmd.exe	143
PID 2136 wrote to memory of 792	2136	cmd.exe	143

System policy modification 1 TTPs 9 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe
"C:\Users\Admin\AppData\Local\Temp\00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\sysmon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\de-DE\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4624
- C:\Recovery\WindowsRE\System.exe
  "C:\Recovery\WindowsRE\System.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5116
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8613de41-79d5-4ea9-8227-69afe923feb8.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Recovery\WindowsRE\System.exe
      C:\Recovery\WindowsRE\System.exe
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4616
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2dc1c0ea-bd9a-4c66-b86c-848101df7d63.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3752
      - C:\Recovery\WindowsRE\System.exe
        
        C:\Recovery\WindowsRE\System.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4272
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\213061c8-7a96-41fb-9396-75363d18438e.vbs"
        5⤵
        
        PID:3560
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iRE9Vp3kbL.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2136
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4424
      - C:\Recovery\WindowsRE\System.exe
        
        "C:\Recovery\WindowsRE\System.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:792
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\71a2d95e-4799-4670-bd61-3c05150be8ee.vbs"
    3⤵
    PID:832
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\daA37ewxym.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:740
  - - C:\Recovery\WindowsRE\System.exe
      "C:\Recovery\WindowsRE\System.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\WindowsPowerShell\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Windows\security\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\security\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Windows\security\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\de-DE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\de-DE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sppsvc.exe

Path C:\Program Files\Windows Defender\de-DE\sppsvc.exe
Size 2.7MB
SHA256 00db2c26608e0e750b9262587d68d19dfd37e45b185a22b9438fb309ceb15cd9
MD5 3b3499bf522f78f62b3f719f7078cbaa
SHA1 faccf8c8c028b3fef6678632766c19c271b99ed4
SHA512 54951168609e925ecd20982b598de527079bee7f44c22b664ff45bd8f384d90f0733c36394ab020bcd25b0bbd75f760e4a6b5c916f04ac5084535c63063d4971
SSDEEP 49152:msWc2Z+L7pWCf65hydIoJOniHoLck1isle2FstJt9NTEKp58MAw:nWl+vpWS6r49GcTcFsjNn
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System.exe.log
Size 1KB
SHA256 b5c2348671b5ad62cc02ded41adcf1855341bd6d20706bf45d9d68e4cddd4bbd
MD5 caa9da90d9bfc2c0fbadbf7eb57d1aae
SHA1 b0237d1cdb8c7fdb6f89e72475dbfb639c025ed7
SHA512 da20485cf87f6e9b95141dea062188b5a2299ff1e1a7f83446afac0d8b70a2d18d02b60b232b2c9e6af5071906dd08f41cf4637379165c1823a9fa9b82d155d8
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
MD5 2e907f77659a6601fcc408274894da2e
SHA1 9f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA512 34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
MD5 SHA1 SHA512

Submit Download

2dc1c0ea-bd9a-4c66-b86c-848101df7d63.vbs

Path C:\Users\Admin\AppData\Local\Temp\2dc1c0ea-bd9a-4c66-b86c-848101df7d63.vbs
Size 708B
SHA256 f23fc4b3a08b3b6a7ee2a6404d6cfe082ce93cafdb5c9fd0f9103f05d5ac5634
MD5 8f5c7ad2598ad2b040e99dcc28525a14
SHA1 294799e6fc6873f6dbde0404622943a3c903dc57
SHA512 50f7dffa5bd931cbbffab6a2163be44b5646d24453dd50604490192b576ec834ca7769b36d54554e9d4208f55ee1a80fb785bec702a6c0736181709a39d9fc4b
MD5 SHA1 SHA512

Submit Download

71a2d95e-4799-4670-bd61-3c05150be8ee.vbs

Path C:\Users\Admin\AppData\Local\Temp\71a2d95e-4799-4670-bd61-3c05150be8ee.vbs
Size 484B
SHA256 186984c8b605317f8079287e12042b6d1059cd9364fa49a7d7816c9b0855ecfe
MD5 7b424ed307fcddcbc3e55e34d3ab179d
SHA1 70e397674c382114fbdd29f6736270289c850c5b
SHA512 e6fe85b30a4264283eef6005491db8d94692f88d56c0e585f0166deda44f011c6aab02829c3c98f1e0d39c3d31f1ed89ad11691e9aa5f202fd953ba5ecfa3be6
MD5 SHA1 SHA512

Submit Download

8613de41-79d5-4ea9-8227-69afe923feb8.vbs

Path C:\Users\Admin\AppData\Local\Temp\8613de41-79d5-4ea9-8227-69afe923feb8.vbs
Size 708B
SHA256 17a4d0c6452b95ab206d01ac8e510c5358bcc1015f709b43d71f8edef4ac0899
MD5 33bb175616715ecd76f13d826dd99d97
SHA1 db94030b505ffac0312e7ab453e989f7321f9f9a
SHA512 676f550ee5cd29a4c8042cab297dd15d5abbe884a6cea637f8ee60b1944efbff43b0e9a70c87f88102f05851bfb227d9b89061236e8cd34cd72263fce4f7441c
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_dx4ih1x4.2zf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dx4ih1x4.2zf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

daA37ewxym.bat

Path C:\Users\Admin\AppData\Local\Temp\daA37ewxym.bat
Size 197B
SHA256 3bbde2fc1f6cffb3642c9b4261e2ffef53bdcb33654436751f2c5d2169f87f87
MD5 4c5936136f406fc9c0d695bec9f43f7d
SHA1 67f97a38e400b349dab804aecf38db58efdc5d0c
SHA512 00709058dbbb736d45545b2c6cbc3309155cfe02ee98f79ad83545dd50407e4dbcfcaadabde2ef2ad2de56e1f768f031295e20e0b60936deb75484aebbfc4829
MD5 SHA1 SHA512

Submit Download

iRE9Vp3kbL.bat

Path C:\Users\Admin\AppData\Local\Temp\iRE9Vp3kbL.bat
Size 197B
SHA256 b4f3776726421f12fe2c2b589f70efa11bbdbdde79d66ea21e1f9cb98e016a49
MD5 79f3a82483a16ed68f372b699074e963
SHA1 3780f1ef192eae7f24ddf08f63892037c28429a3
SHA512 50903ccacfe7adbca785f8ba011aec42e2b34b6978e9009eca5d3b14ebafa0ce61ac30bec60bb551e95464b3fdb0efe0d54c6d9a0a446548077c7b7e51811246
MD5 SHA1 SHA512

Submit Download

memory/744-11-0x00000000034A0000-0x00000000034A8000-memory.dmp

Download

memory/744-29-0x000000001C000000-0x000000001C00A000-memory.dmp

Download

memory/744-15-0x000000001BDE0000-0x000000001BE36000-memory.dmp

Download

memory/744-16-0x000000001BE30000-0x000000001BE3C000-memory.dmp

Download

memory/744-18-0x000000001BE50000-0x000000001BE5C000-memory.dmp

Download

memory/744-19-0x000000001BE60000-0x000000001BE72000-memory.dmp

Download

memory/744-17-0x000000001BE40000-0x000000001BE48000-memory.dmp

Download

memory/744-20-0x000000001D090000-0x000000001D5B8000-memory.dmp

Download

memory/744-21-0x000000001BF80000-0x000000001BF88000-memory.dmp

Download

memory/744-22-0x000000001BF90000-0x000000001BF9C000-memory.dmp

Download

memory/744-23-0x000000001BFA0000-0x000000001BFAC000-memory.dmp

Download

memory/744-24-0x000000001BFB0000-0x000000001BFB8000-memory.dmp

Download

memory/744-28-0x000000001BFF0000-0x000000001BFF8000-memory.dmp

Download

memory/744-27-0x000000001BFE0000-0x000000001BFE8000-memory.dmp

Download

memory/744-26-0x000000001BFD0000-0x000000001BFDE000-memory.dmp

Download

memory/744-25-0x000000001BFC0000-0x000000001BFCA000-memory.dmp

Download

memory/744-30-0x000000001CBD0000-0x000000001CBDC000-memory.dmp

Download

memory/744-12-0x000000001BDB0000-0x000000001BDC6000-memory.dmp

Download

memory/744-13-0x00000000034B0000-0x00000000034B8000-memory.dmp

Download

memory/744-1-0x0000000000F50000-0x0000000001202000-memory.dmp

Download

memory/744-14-0x000000001BDD0000-0x000000001BDDA000-memory.dmp

Download

memory/744-58-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

Download

memory/744-0-0x00007FFA4C3A3000-0x00007FFA4C3A5000-memory.dmp

Download

memory/744-10-0x0000000001BE0000-0x0000000001BE8000-memory.dmp

Download

memory/744-2-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

Download

memory/744-9-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

Download

memory/744-8-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

Download

memory/744-7-0x00007FFA4C3A3000-0x00007FFA4C3A5000-memory.dmp

Download

memory/744-6-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

Download

memory/744-5-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

Download

memory/744-4-0x0000000001A20000-0x0000000001A2E000-memory.dmp

Download

memory/744-3-0x0000000001A10000-0x0000000001A1E000-memory.dmp

Download

memory/4624-73-0x0000022FD1F40000-0x0000022FD1F62000-memory.dmp

Download

memory/5116-141-0x000000001C3F0000-0x000000001C402000-memory.dmp

Download