dcrat | 44825fbcd6990e29a1a3c36fc9645978c17dfdde5f5355b3d5aa778e8b8fadec

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	bridgebrowserFont.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Idle.exe

Executes dropped EXE 13 IoCs

pid	Process
1704	DCRatBuild.exe
2076	SolaraBootstrapper.exe
1520	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
2148	bridgebrowserFont.exe
2100	Idle.exe
4400	Idle.exe
1424	Idle.exe
4040	Idle.exe
4232	Idle.exe
4656	Idle.exe
4664	Idle.exe
4044	Idle.exe
4312	Idle.exe

Loads dropped DLL 5 IoCs

pid	Process
1520	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
1520	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
1520	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
1520	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
1520	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000700000002342b-1554.dat	themida
behavioral2/memory/1520-1561-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral2/memory/1520-1581-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 13 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bridgebrowserFont.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bridgebrowserFont.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
20	raw.githubusercontent.com
36	pastebin.com
37	pastebin.com
19	raw.githubusercontent.com
31	raw.githubusercontent.com
33	raw.githubusercontent.com
41	pastebin.com
53	pastebin.com
54	pastebin.com

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1520	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\server\RuntimeBroker.exe	bridgebrowserFont.exe
File created	C:\Program Files\Windows Portable Devices\Registry.exe	bridgebrowserFont.exe
File created	C:\Program Files (x86)\WindowsPowerShell\lsass.exe	bridgebrowserFont.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\lsass.exe	bridgebrowserFont.exe
File created	C:\Program Files\VideoLAN\VLC\e6c9b481da804f	bridgebrowserFont.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\5b884080fd4f94	bridgebrowserFont.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\wininit.exe	bridgebrowserFont.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\56085415360792	bridgebrowserFont.exe
File created	C:\Program Files\VideoLAN\VLC\OfficeClickToRun.exe	bridgebrowserFont.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe	bridgebrowserFont.exe
File created	C:\Program Files (x86)\WindowsPowerShell\6203df4a6bafc7	bridgebrowserFont.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\9e8d7a4ca61bd9	bridgebrowserFont.exe
File created	C:\Program Files\Windows Portable Devices\ee2ad38f3d4382	bridgebrowserFont.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\addins\MoUsoCoreWorker.exe	bridgebrowserFont.exe
File created	C:\Windows\addins\1f93f77a7f4778	bridgebrowserFont.exe
File created	C:\Windows\RemotePackages\RemoteDesktops\explorer.exe	bridgebrowserFont.exe
File created	C:\Windows\RemotePackages\RemoteDesktops\7a0fd90576e088	bridgebrowserFont.exe
File created	C:\Windows\Migration\WTR\spoolsv.exe	bridgebrowserFont.exe
File created	C:\Windows\Migration\WTR\f3b6ecef712a24	bridgebrowserFont.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	bridgebrowserFont.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	DCRatBuild.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3312	schtasks.exe
4656	schtasks.exe
4632	schtasks.exe
1624	schtasks.exe
2956	schtasks.exe
5056	schtasks.exe
1484	schtasks.exe
1108	schtasks.exe
4736	schtasks.exe
2028	schtasks.exe
4688	schtasks.exe
1600	schtasks.exe
3224	schtasks.exe
4880	schtasks.exe
4740	schtasks.exe
3280	schtasks.exe
3100	schtasks.exe
3548	schtasks.exe
4488	schtasks.exe
3536	schtasks.exe
2032	schtasks.exe
2904	schtasks.exe
2240	schtasks.exe
4556	schtasks.exe
4504	schtasks.exe
1196	schtasks.exe
3152	schtasks.exe
4412	schtasks.exe
2832	schtasks.exe
4216	schtasks.exe
4028	schtasks.exe
4516	schtasks.exe
2652	schtasks.exe
3368	schtasks.exe
3228	schtasks.exe
3772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2076	SolaraBootstrapper.exe
2076	SolaraBootstrapper.exe
2148	bridgebrowserFont.exe
2148	bridgebrowserFont.exe
2148	bridgebrowserFont.exe
2148	bridgebrowserFont.exe
2148	bridgebrowserFont.exe
2148	bridgebrowserFont.exe
2148	bridgebrowserFont.exe
2148	bridgebrowserFont.exe
1520	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
1520	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
1520	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
2100	Idle.exe
1520	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
1520	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
1520	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
1520	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
4400	Idle.exe
1424	Idle.exe
4656	Idle.exe
1840	mspaint.exe
1840	mspaint.exe
4044	Idle.exe
4044	Idle.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2076	SolaraBootstrapper.exe
Token: SeDebugPrivilege	2148	bridgebrowserFont.exe
Token: SeDebugPrivilege	1520	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Token: SeDebugPrivilege	2100	Idle.exe
Token: SeDebugPrivilege	4400	Idle.exe
Token: SeDebugPrivilege	1424	Idle.exe
Token: SeDebugPrivilege	4232	Idle.exe
Token: SeDebugPrivilege	4040	Idle.exe
Token: SeDebugPrivilege	4656	Idle.exe
Token: SeDebugPrivilege	4664	Idle.exe
Token: SeDebugPrivilege	4044	Idle.exe
Token: SeDebugPrivilege	4312	Idle.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1840	mspaint.exe
4880	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 1704	2396	SolaraBootstrapper.exe	86
PID 2396 wrote to memory of 1704	2396	SolaraBootstrapper.exe	86
PID 2396 wrote to memory of 1704	2396	SolaraBootstrapper.exe	86
PID 2396 wrote to memory of 2076	2396	SolaraBootstrapper.exe	88
PID 2396 wrote to memory of 2076	2396	SolaraBootstrapper.exe	88
PID 2396 wrote to memory of 2076	2396	SolaraBootstrapper.exe	88
PID 1704 wrote to memory of 4316	1704	DCRatBuild.exe	91
PID 1704 wrote to memory of 4316	1704	DCRatBuild.exe	91
PID 1704 wrote to memory of 4316	1704	DCRatBuild.exe	91
PID 2076 wrote to memory of 1520	2076	SolaraBootstrapper.exe	94
PID 2076 wrote to memory of 1520	2076	SolaraBootstrapper.exe	94
PID 4316 wrote to memory of 2160	4316	WScript.exe	95
PID 4316 wrote to memory of 2160	4316	WScript.exe	95
PID 4316 wrote to memory of 2160	4316	WScript.exe	95
PID 2160 wrote to memory of 2148	2160	cmd.exe	97
PID 2160 wrote to memory of 2148	2160	cmd.exe	97
PID 2148 wrote to memory of 868	2148	bridgebrowserFont.exe	134
PID 2148 wrote to memory of 868	2148	bridgebrowserFont.exe	134
PID 868 wrote to memory of 4292	868	cmd.exe	136
PID 868 wrote to memory of 4292	868	cmd.exe	136
PID 868 wrote to memory of 2100	868	cmd.exe	137
PID 868 wrote to memory of 2100	868	cmd.exe	137
PID 2100 wrote to memory of 1080	2100	Idle.exe	138
PID 2100 wrote to memory of 1080	2100	Idle.exe	138
PID 2100 wrote to memory of 836	2100	Idle.exe	139
PID 2100 wrote to memory of 836	2100	Idle.exe	139
PID 2100 wrote to memory of 3736	2100	Idle.exe	143
PID 2100 wrote to memory of 3736	2100	Idle.exe	143
PID 3736 wrote to memory of 2416	3736	cmd.exe	145
PID 3736 wrote to memory of 2416	3736	cmd.exe	145
PID 1080 wrote to memory of 4400	1080	WScript.exe	146
PID 1080 wrote to memory of 4400	1080	WScript.exe	146
PID 4400 wrote to memory of 1472	4400	Idle.exe	148
PID 4400 wrote to memory of 1472	4400	Idle.exe	148
PID 4400 wrote to memory of 3580	4400	Idle.exe	149
PID 4400 wrote to memory of 3580	4400	Idle.exe	149
PID 4400 wrote to memory of 4312	4400	Idle.exe	150
PID 4400 wrote to memory of 4312	4400	Idle.exe	150
PID 4312 wrote to memory of 4556	4312	cmd.exe	152
PID 4312 wrote to memory of 4556	4312	cmd.exe	152
PID 3736 wrote to memory of 1424	3736	cmd.exe	153
PID 3736 wrote to memory of 1424	3736	cmd.exe	153
PID 1424 wrote to memory of 440	1424	Idle.exe	155
PID 1424 wrote to memory of 440	1424	Idle.exe	155
PID 1424 wrote to memory of 2912	1424	Idle.exe	156
PID 1424 wrote to memory of 2912	1424	Idle.exe	156
PID 4312 wrote to memory of 4040	4312	cmd.exe	157
PID 4312 wrote to memory of 4040	4312	cmd.exe	157
PID 1472 wrote to memory of 4232	1472	WScript.exe	158
PID 1472 wrote to memory of 4232	1472	WScript.exe	158
PID 1424 wrote to memory of 2496	1424	Idle.exe	159
PID 1424 wrote to memory of 2496	1424	Idle.exe	159
PID 2496 wrote to memory of 2076	2496	cmd.exe	161
PID 2496 wrote to memory of 2076	2496	cmd.exe	161
PID 440 wrote to memory of 4656	440	WScript.exe	163
PID 440 wrote to memory of 4656	440	WScript.exe	163
PID 4656 wrote to memory of 5084	4656	Idle.exe	165
PID 4656 wrote to memory of 5084	4656	Idle.exe	165
PID 4656 wrote to memory of 4688	4656	Idle.exe	166
PID 4656 wrote to memory of 4688	4656	Idle.exe	166
PID 2496 wrote to memory of 4664	2496	cmd.exe	167
PID 2496 wrote to memory of 4664	2496	cmd.exe	167
PID 4656 wrote to memory of 4632	4656	Idle.exe	171
PID 4656 wrote to memory of 4632	4656	Idle.exe	171

System policy modification 1 TTPs 18 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bridgebrowserFont.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bridgebrowserFont.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bridgebrowserFont.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SolaraB\Solara\SolaraBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraB\Solara\SolaraBootstrapper.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\bridgeChainsvc\ynBPrYHpb0rGVZHVTyIGwU9XZ.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\bridgeChainsvc\nDhZWkZlJyEO.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2160
    - - C:\bridgeChainsvc\bridgebrowserFont.exe
        
        "C:\bridgeChainsvc\bridgebrowserFont.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2148
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TQCIBmL527.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4292
        
        C:\Users\Admin\Saved Games\Idle.exe
        
        "C:\Users\Admin\Saved Games\Idle.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2100
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e13df84e-abd8-435a-80b2-067ec8c16492.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Users\Admin\Saved Games\Idle.exe
        
        "C:\Users\Admin\Saved Games\Idle.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4400
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8218a83b-2988-4f7e-b0a9-091c7c7601ce.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1472
        
        C:\Users\Admin\Saved Games\Idle.exe
        
        "C:\Users\Admin\Saved Games\Idle.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4232
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5457a3b6-11f7-4aff-9a1b-deeca8d7ccf4.vbs"
        10⤵
        
        PID:3580
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tA3KztjMoN.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:4556
        
        C:\Users\Admin\Saved Games\Idle.exe
        
        "C:\Users\Admin\Saved Games\Idle.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4040
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c35b61c7-f095-4b3a-98a8-3c3c907f02ed.vbs"
        8⤵
        
        PID:836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xAFUrPKKMy.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3736
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2416
        
        C:\Users\Admin\Saved Games\Idle.exe
        
        "C:\Users\Admin\Saved Games\Idle.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1424
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef732983-4cf3-44fb-ae2c-3f78f9d56828.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:440
        
        C:\Users\Admin\Saved Games\Idle.exe
        
        "C:\Users\Admin\Saved Games\Idle.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4656
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\83a8ff88-15e2-43a7-92a8-67387157f4ac.vbs"
        12⤵
        
        PID:5084
        
        C:\Users\Admin\Saved Games\Idle.exe
        
        "C:\Users\Admin\Saved Games\Idle.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a4fee81-79a5-47e3-bd4d-5f165f1e0f2e.vbs"
        14⤵
        
        PID:1720
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f9070fd1-e6e5-41cc-848e-45bae0ca6d78.vbs"
        14⤵
        
        PID:4844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6d8a7fe9-dbb2-48eb-a0f8-96911f97ad45.vbs"
        12⤵
        
        PID:4688
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hfpeQ4JfvC.bat"
        12⤵
        
        PID:4632
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1928
        
        C:\Users\Admin\Saved Games\Idle.exe
        
        "C:\Users\Admin\Saved Games\Idle.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4312
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b65bcc87-431a-4f9f-a16f-97537da1f799.vbs"
        10⤵
        
        PID:2912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fjnbjzFmbP.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2076
        
        C:\Users\Admin\Saved Games\Idle.exe
        
        "C:\Users\Admin\Saved Games\Idle.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4664
- C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
    "C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\WindowsPowerShell\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jre-1.8\bin\server\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\bin\server\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Java\jre-1.8\bin\server\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Saved Games\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Saved Games\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 7 /tr "'C:\Windows\addins\MoUsoCoreWorker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Windows\addins\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 10 /tr "'C:\Windows\addins\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\RemotePackages\RemoteDesktops\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteDesktops\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Windows\RemotePackages\RemoteDesktops\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Windows\Migration\WTR\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Windows\Migration\WTR\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3360

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\ConvertUpdate.jpeg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:3928

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

System Information Discovery