dcrat | c729d915ac96ff25722e76303e87e67c8ed51f776992724fa89fedbb77fc8a28

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 11:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
587e1d2473fea9284918bfbcf9897de2.exe
Size 2.5MB
Sample240630-nmpsdsxbla
SHA256 c729d915ac96ff25722e76303e87e67c8ed51f776992724fa89fedbb77fc8a28
MD5 587e1d2473fea9284918bfbcf9897de2
SHA1 25dc1703e07cc5cc890238cc18d0199effab86be
SHA512 1e7313c16f84e618b9d9cea644d95b34cdb339830c5354354f126b85e8772994302abe5d7a2554e62898fb36d38f03c90b012e4060b69f57ce35806e975522fc
SSDEEP 49152:4sg2eGAIciUHLJPXf0fo+goVM6EztdiHGEgE7YsOlTvtq9hzDzqv:4FLHLJPPI9ErnvaYzlAfDzq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion execution infostealer persistence rat spyware stealer trojan

Malware Config

Signatures

DcRat 46 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2976	schtasks.exe
		1332	schtasks.exe
		1340	schtasks.exe
		1436	schtasks.exe
		1592	schtasks.exe
		1488	schtasks.exe
		556	schtasks.exe
		2836	schtasks.exe
		2032	schtasks.exe
		2860	schtasks.exe
		352	schtasks.exe
		2872	schtasks.exe
		2020	schtasks.exe
		2488	schtasks.exe
		1348	schtasks.exe
		2536	schtasks.exe
		2712	schtasks.exe
		2288	schtasks.exe
		988	schtasks.exe
		1384	schtasks.exe
		2336	schtasks.exe
		1064	schtasks.exe
		1036	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		587e1d2473fea9284918bfbcf9897de2.exe
		2596	schtasks.exe
		2908	schtasks.exe
		1900	schtasks.exe
		2188	schtasks.exe
		2424	schtasks.exe
		708	schtasks.exe
		2680	schtasks.exe
		632	schtasks.exe
		2164	schtasks.exe
		2560	schtasks.exe
		1644	schtasks.exe
		308	schtasks.exe
		844	schtasks.exe
		2768	schtasks.exe
		2896	schtasks.exe
		2580	schtasks.exe
		1128	schtasks.exe
		2044	schtasks.exe
		1052	schtasks.exe
		2924	schtasks.exe
		532	schtasks.exe
		2760	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 15 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	632	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	352	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	988	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	308	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	2728	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	2728	schtasks.exe	28

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	587e1d2473fea9284918bfbcf9897de2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	587e1d2473fea9284918bfbcf9897de2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	587e1d2473fea9284918bfbcf9897de2.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2804-1-0x0000000000E00000-0x0000000001090000-memory.dmp	dcrat
behavioral1/files/0x0006000000014c22-28.dat	dcrat
behavioral1/memory/1164-139-0x0000000000CF0000-0x0000000000F80000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1972	powershell.exe
2476	powershell.exe
948	powershell.exe
760	powershell.exe
2040	powershell.exe
2456	powershell.exe
3008	powershell.exe
2996	powershell.exe
2900	powershell.exe
2148	powershell.exe
692	powershell.exe
2340	powershell.exe
836	powershell.exe
3004	powershell.exe
1960	powershell.exe
1952	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1164	Idle.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\587e1d2473fea9284918bfbcf9897de2 = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\587e1d2473fea9284918bfbcf9897de2.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\All Users\\Microsoft\\smss.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\Admin\\Application Data\\Idle.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\587e1d2473fea9284918bfbcf9897de2 = "\"C:\\Program Files\\Microsoft Office\\Office14\\1033\\587e1d2473fea9284918bfbcf9897de2.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Users\\Default User\\audiodg.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\DigitalLocker\\es-ES\\explorer.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\System.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\587e1d2473fea9284918bfbcf9897de2 = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\587e1d2473fea9284918bfbcf9897de2.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\587e1d2473fea9284918bfbcf9897de2 = "\"C:\\Program Files\\Microsoft Office\\Office14\\1033\\587e1d2473fea9284918bfbcf9897de2.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\Tasks\\smss.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\Tasks\\smss.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\services.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\Idle.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\Idle.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\explorer.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Public\\Desktop\\explorer.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\DigitalLocker\\es-ES\\explorer.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\Globalization\\ELS\\Transliteration\\services.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\1fdecb22-2889-11ef-9d63-46d84c032646\\wininit.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\All Users\\Microsoft\\smss.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\services.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\1fdecb22-2889-11ef-9d63-46d84c032646\\wininit.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\System.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\explorer.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Users\\Default User\\audiodg.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Public\\Desktop\\explorer.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\Globalization\\ELS\\Transliteration\\services.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\Admin\\Application Data\\Idle.exe\""	587e1d2473fea9284918bfbcf9897de2.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	587e1d2473fea9284918bfbcf9897de2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	587e1d2473fea9284918bfbcf9897de2.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\c5b4cb5e9653cc	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\Idle.exe	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\6ccacd8608530f	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\587e1d2473fea9284918bfbcf9897de2.exe	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\1e6bff0c8a2aa4	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\services.exe	587e1d2473fea9284918bfbcf9897de2.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Globalization\ELS\Transliteration\services.exe	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Windows\Globalization\ELS\Transliteration\c5b4cb5e9653cc	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Windows\Tasks\smss.exe	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Windows\Tasks\69ddcba757bf72	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Windows\DigitalLocker\es-ES\explorer.exe	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Windows\DigitalLocker\es-ES\7a0fd90576e088	587e1d2473fea9284918bfbcf9897de2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1436	schtasks.exe
1128	schtasks.exe
2020	schtasks.exe
532	schtasks.exe
2908	schtasks.exe
2768	schtasks.exe
2680	schtasks.exe
2976	schtasks.exe
2188	schtasks.exe
308	schtasks.exe
2860	schtasks.exe
708	schtasks.exe
2488	schtasks.exe
2896	schtasks.exe
2536	schtasks.exe
2596	schtasks.exe
2580	schtasks.exe
1340	schtasks.exe
1348	schtasks.exe
1036	schtasks.exe
1488	schtasks.exe
556	schtasks.exe
2424	schtasks.exe
2760	schtasks.exe
1332	schtasks.exe
1064	schtasks.exe
988	schtasks.exe
844	schtasks.exe
2336	schtasks.exe
2712	schtasks.exe
632	schtasks.exe
2560	schtasks.exe
2032	schtasks.exe
1052	schtasks.exe
2872	schtasks.exe
1644	schtasks.exe
1900	schtasks.exe
352	schtasks.exe
2288	schtasks.exe
1384	schtasks.exe
2836	schtasks.exe
2044	schtasks.exe
2164	schtasks.exe
1592	schtasks.exe
2924	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2804	587e1d2473fea9284918bfbcf9897de2.exe
2340	powershell.exe
2900	powershell.exe
2040	powershell.exe
692	powershell.exe
3004	powershell.exe
2456	powershell.exe
836	powershell.exe
1960	powershell.exe
2476	powershell.exe
1972	powershell.exe
2996	powershell.exe
760	powershell.exe
948	powershell.exe
1952	powershell.exe
2148	powershell.exe
3008	powershell.exe
1164	Idle.exe
1164	Idle.exe
1164	Idle.exe
1164	Idle.exe
1164	Idle.exe
1164	Idle.exe
1164	Idle.exe
1164	Idle.exe
1164	Idle.exe
1164	Idle.exe
1164	Idle.exe
1164	Idle.exe
1164	Idle.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1164	Idle.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	587e1d2473fea9284918bfbcf9897de2.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	836	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	760	powershell.exe
Token: SeDebugPrivilege	948	powershell.exe
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	1164	Idle.exe
Token: SeBackupPrivilege	1548	vssvc.exe
Token: SeRestorePrivilege	1548	vssvc.exe
Token: SeAuditPrivilege	1548	vssvc.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 1972	2804	587e1d2473fea9284918bfbcf9897de2.exe	74
PID 2804 wrote to memory of 1972	2804	587e1d2473fea9284918bfbcf9897de2.exe	74
PID 2804 wrote to memory of 1972	2804	587e1d2473fea9284918bfbcf9897de2.exe	74
PID 2804 wrote to memory of 836	2804	587e1d2473fea9284918bfbcf9897de2.exe	76
PID 2804 wrote to memory of 836	2804	587e1d2473fea9284918bfbcf9897de2.exe	76
PID 2804 wrote to memory of 836	2804	587e1d2473fea9284918bfbcf9897de2.exe	76
PID 2804 wrote to memory of 1952	2804	587e1d2473fea9284918bfbcf9897de2.exe	77
PID 2804 wrote to memory of 1952	2804	587e1d2473fea9284918bfbcf9897de2.exe	77
PID 2804 wrote to memory of 1952	2804	587e1d2473fea9284918bfbcf9897de2.exe	77
PID 2804 wrote to memory of 2456	2804	587e1d2473fea9284918bfbcf9897de2.exe	78
PID 2804 wrote to memory of 2456	2804	587e1d2473fea9284918bfbcf9897de2.exe	78
PID 2804 wrote to memory of 2456	2804	587e1d2473fea9284918bfbcf9897de2.exe	78
PID 2804 wrote to memory of 2040	2804	587e1d2473fea9284918bfbcf9897de2.exe	79
PID 2804 wrote to memory of 2040	2804	587e1d2473fea9284918bfbcf9897de2.exe	79
PID 2804 wrote to memory of 2040	2804	587e1d2473fea9284918bfbcf9897de2.exe	79
PID 2804 wrote to memory of 1960	2804	587e1d2473fea9284918bfbcf9897de2.exe	80
PID 2804 wrote to memory of 1960	2804	587e1d2473fea9284918bfbcf9897de2.exe	80
PID 2804 wrote to memory of 1960	2804	587e1d2473fea9284918bfbcf9897de2.exe	80
PID 2804 wrote to memory of 760	2804	587e1d2473fea9284918bfbcf9897de2.exe	81
PID 2804 wrote to memory of 760	2804	587e1d2473fea9284918bfbcf9897de2.exe	81
PID 2804 wrote to memory of 760	2804	587e1d2473fea9284918bfbcf9897de2.exe	81
PID 2804 wrote to memory of 948	2804	587e1d2473fea9284918bfbcf9897de2.exe	82
PID 2804 wrote to memory of 948	2804	587e1d2473fea9284918bfbcf9897de2.exe	82
PID 2804 wrote to memory of 948	2804	587e1d2473fea9284918bfbcf9897de2.exe	82
PID 2804 wrote to memory of 2340	2804	587e1d2473fea9284918bfbcf9897de2.exe	83
PID 2804 wrote to memory of 2340	2804	587e1d2473fea9284918bfbcf9897de2.exe	83
PID 2804 wrote to memory of 2340	2804	587e1d2473fea9284918bfbcf9897de2.exe	83
PID 2804 wrote to memory of 692	2804	587e1d2473fea9284918bfbcf9897de2.exe	84
PID 2804 wrote to memory of 692	2804	587e1d2473fea9284918bfbcf9897de2.exe	84
PID 2804 wrote to memory of 692	2804	587e1d2473fea9284918bfbcf9897de2.exe	84
PID 2804 wrote to memory of 2148	2804	587e1d2473fea9284918bfbcf9897de2.exe	85
PID 2804 wrote to memory of 2148	2804	587e1d2473fea9284918bfbcf9897de2.exe	85
PID 2804 wrote to memory of 2148	2804	587e1d2473fea9284918bfbcf9897de2.exe	85
PID 2804 wrote to memory of 2476	2804	587e1d2473fea9284918bfbcf9897de2.exe	86
PID 2804 wrote to memory of 2476	2804	587e1d2473fea9284918bfbcf9897de2.exe	86
PID 2804 wrote to memory of 2476	2804	587e1d2473fea9284918bfbcf9897de2.exe	86
PID 2804 wrote to memory of 2900	2804	587e1d2473fea9284918bfbcf9897de2.exe	87
PID 2804 wrote to memory of 2900	2804	587e1d2473fea9284918bfbcf9897de2.exe	87
PID 2804 wrote to memory of 2900	2804	587e1d2473fea9284918bfbcf9897de2.exe	87
PID 2804 wrote to memory of 3004	2804	587e1d2473fea9284918bfbcf9897de2.exe	88
PID 2804 wrote to memory of 3004	2804	587e1d2473fea9284918bfbcf9897de2.exe	88
PID 2804 wrote to memory of 3004	2804	587e1d2473fea9284918bfbcf9897de2.exe	88
PID 2804 wrote to memory of 3008	2804	587e1d2473fea9284918bfbcf9897de2.exe	89
PID 2804 wrote to memory of 3008	2804	587e1d2473fea9284918bfbcf9897de2.exe	89
PID 2804 wrote to memory of 3008	2804	587e1d2473fea9284918bfbcf9897de2.exe	89
PID 2804 wrote to memory of 2996	2804	587e1d2473fea9284918bfbcf9897de2.exe	90
PID 2804 wrote to memory of 2996	2804	587e1d2473fea9284918bfbcf9897de2.exe	90
PID 2804 wrote to memory of 2996	2804	587e1d2473fea9284918bfbcf9897de2.exe	90
PID 2804 wrote to memory of 2612	2804	587e1d2473fea9284918bfbcf9897de2.exe	106
PID 2804 wrote to memory of 2612	2804	587e1d2473fea9284918bfbcf9897de2.exe	106
PID 2804 wrote to memory of 2612	2804	587e1d2473fea9284918bfbcf9897de2.exe	106
PID 2612 wrote to memory of 2828	2612	cmd.exe	109
PID 2612 wrote to memory of 2828	2612	cmd.exe	109
PID 2612 wrote to memory of 2828	2612	cmd.exe	109
PID 2612 wrote to memory of 1164	2612	cmd.exe	110
PID 2612 wrote to memory of 1164	2612	cmd.exe	110
PID 2612 wrote to memory of 1164	2612	cmd.exe	110
PID 1164 wrote to memory of 1912	1164	Idle.exe	111
PID 1164 wrote to memory of 1912	1164	Idle.exe	111
PID 1164 wrote to memory of 1912	1164	Idle.exe	111
PID 1164 wrote to memory of 2560	1164	Idle.exe	112
PID 1164 wrote to memory of 2560	1164	Idle.exe	112
PID 1164 wrote to memory of 2560	1164	Idle.exe	112

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	587e1d2473fea9284918bfbcf9897de2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	587e1d2473fea9284918bfbcf9897de2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	587e1d2473fea9284918bfbcf9897de2.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\587e1d2473fea9284918bfbcf9897de2.exe
"C:\Users\Admin\AppData\Local\Temp\587e1d2473fea9284918bfbcf9897de2.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\587e1d2473fea9284918bfbcf9897de2.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\587e1d2473fea9284918bfbcf9897de2.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office14\1033\587e1d2473fea9284918bfbcf9897de2.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\audiodg.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\es-ES\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\es-ES\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Globalization\ELS\Transliteration\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Application Data\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1fdecb22-2889-11ef-9d63-46d84c032646\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\STXaToE69k.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2828
- - C:\Program Files (x86)\Windows Media Player\es-ES\Idle.exe
    "C:\Program Files (x86)\Windows Media Player\es-ES\Idle.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1164
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7b8980cb-f42f-466b-9025-38bbc57d0e60.vbs"
      4⤵
      PID:1912
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\57c81fe5-a9bb-41f4-bc03-171f6fd1dd0b.vbs"
      4⤵
      PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "587e1d2473fea9284918bfbcf9897de25" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\587e1d2473fea9284918bfbcf9897de2.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "587e1d2473fea9284918bfbcf9897de2" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\587e1d2473fea9284918bfbcf9897de2.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "587e1d2473fea9284918bfbcf9897de25" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\587e1d2473fea9284918bfbcf9897de2.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "587e1d2473fea9284918bfbcf9897de25" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\Office14\1033\587e1d2473fea9284918bfbcf9897de2.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "587e1d2473fea9284918bfbcf9897de2" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\587e1d2473fea9284918bfbcf9897de2.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "587e1d2473fea9284918bfbcf9897de25" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\Office14\1033\587e1d2473fea9284918bfbcf9897de2.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Microsoft\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Microsoft\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Desktop\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Public\Desktop\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Desktop\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Default User\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\Tasks\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Tasks\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\Tasks\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows\DigitalLocker\es-ES\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\es-ES\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows\DigitalLocker\es-ES\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Windows\Globalization\ELS\Transliteration\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Globalization\ELS\Transliteration\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Windows\Globalization\ELS\Transliteration\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Application Data\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Application Data\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Application Data\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\1fdecb22-2889-11ef-9d63-46d84c032646\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\1fdecb22-2889-11ef-9d63-46d84c032646\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\1fdecb22-2889-11ef-9d63-46d84c032646\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57c81fe5-a9bb-41f4-bc03-171f6fd1dd0b.vbs

Path C:\Users\Admin\AppData\Local\Temp\57c81fe5-a9bb-41f4-bc03-171f6fd1dd0b.vbs
Size 510B
SHA256 f99ea526e066b655c526c1459cb549a4cfc2926e4af6cf1c9df609d96421dfb0
MD5 fb93de7a1938bfdd01838d43b8abe038
SHA1 992157dfcc2295430f1fbdba19aa495a505eea2b
SHA512 b99d18a9e516906fb56ba56e9a6498fd9afdc906ae6159ad5373b431b2b0febb2b22ee5c87573e33f857786fc1f38597389218390677efc02497a547df7928a2
MD5 SHA1 SHA512

Submit Download

7b8980cb-f42f-466b-9025-38bbc57d0e60.vbs

Path C:\Users\Admin\AppData\Local\Temp\7b8980cb-f42f-466b-9025-38bbc57d0e60.vbs
Size 734B
SHA256 c17116dc70441b7fee190043114bfe59cf079f205182fb04b1e9d53061934a5f
MD5 adf9f34f6898964d4afec4aab79b7d0e
SHA1 66e0f7e449d16be46a618ca0945af4a5c18cd863
SHA512 3a8e2064f30d55280f0c2dd15507522b7d62618a3b3830e514c30f1ddb97939abf6b83b64d21dbfa6ab50d4f50ea2ae3e83b62c7bbe321e1ea1073bb580ae99c
MD5 SHA1 SHA512

Submit Download

STXaToE69k.bat

Path C:\Users\Admin\AppData\Local\Temp\STXaToE69k.bat
Size 223B
SHA256 17e65cf299b5d7aa13d0bcfcea59d778bd898211bfc90a74b27ac1bfbeaa48ed
MD5 3bf6910ab0ea521da2811b79302c38ff
SHA1 c0da9502f22e46fcfecc7d98112a02abe9b973a3
SHA512 ad2ce677ad3810a5dae497e560f6bbea22978cc45dde136e07dc49a63df6c0ff50e50dec7a4dbcce3cff80c9daf9ded843c0cc0267cac4d142dc13298a9c5acd
MD5 SHA1 SHA512

Submit Download

1YHZS3TSBTWYR1BMZ8CX.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1YHZS3TSBTWYR1BMZ8CX.temp
Size 7KB
SHA256 d57dcb4f025e54f8675571d10985c21273331897f3e56c48305c72167dcaaaea
MD5 d543c871f1bdc2a0c71d4b6db1f994e1
SHA1 4f60a7b955eb009a4a21d9b8ce4d2af2e81f1cf8
SHA512 86956356811f94a61db68d958c26c930f8c2ef15f11b89cea4ad451dd73a390153f7d38b07649a2349aa6b7c23725e833d602e9863a62e8ac87a238f78971a07
SSDEEP 96:QhaCNM8unqvsqvJCwomhaCNM8unqvsEHyqvJCworoOVNQHVF7NyXlUV5:wHqUo6HqAHnoroiYF7Ny6
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Users\Public\Desktop\explorer.exe
Size 2.5MB
SHA256 c729d915ac96ff25722e76303e87e67c8ed51f776992724fa89fedbb77fc8a28
MD5 587e1d2473fea9284918bfbcf9897de2
SHA1 25dc1703e07cc5cc890238cc18d0199effab86be
SHA512 1e7313c16f84e618b9d9cea644d95b34cdb339830c5354354f126b85e8772994302abe5d7a2554e62898fb36d38f03c90b012e4060b69f57ce35806e975522fc
SSDEEP 49152:4sg2eGAIciUHLJPXf0fo+goVM6EztdiHGEgE7YsOlTvtq9hzDzqv:4FLHLJPPI9ErnvaYzlAfDzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1164-139-0x0000000000CF0000-0x0000000000F80000-memory.dmp

Download

memory/2340-59-0x000000001B580000-0x000000001B862000-memory.dmp

Download

memory/2340-60-0x0000000002240000-0x0000000002248000-memory.dmp

Download

memory/2804-7-0x0000000000CE0000-0x0000000000CEA000-memory.dmp

Download

memory/2804-19-0x0000000002600000-0x000000000260C000-memory.dmp

Download

memory/2804-10-0x00000000024E0000-0x00000000024E8000-memory.dmp

Download

memory/2804-11-0x00000000024F0000-0x00000000024FC000-memory.dmp

Download

memory/2804-12-0x0000000002500000-0x0000000002508000-memory.dmp

Download

memory/2804-13-0x0000000002510000-0x0000000002518000-memory.dmp

Download

memory/2804-15-0x0000000002530000-0x000000000253E000-memory.dmp

Download

memory/2804-14-0x0000000002520000-0x000000000252A000-memory.dmp

Download

memory/2804-16-0x0000000002540000-0x0000000002548000-memory.dmp

Download

memory/2804-17-0x0000000002550000-0x0000000002558000-memory.dmp

Download

memory/2804-18-0x00000000025F0000-0x00000000025FA000-memory.dmp

Download

memory/2804-9-0x0000000000DF0000-0x0000000000DFC000-memory.dmp

Download

memory/2804-8-0x0000000002490000-0x00000000024E6000-memory.dmp

Download

memory/2804-0-0x000007FEF4D53000-0x000007FEF4D54000-memory.dmp

Download

memory/2804-6-0x0000000000CC0000-0x0000000000CD6000-memory.dmp

Download

memory/2804-58-0x000007FEF4D50000-0x000007FEF573C000-memory.dmp

Download

memory/2804-5-0x00000000003D0000-0x00000000003D8000-memory.dmp

Download

memory/2804-4-0x0000000000B20000-0x0000000000B3C000-memory.dmp

Download

memory/2804-3-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/2804-2-0x000007FEF4D50000-0x000007FEF573C000-memory.dmp

Download

memory/2804-1-0x0000000000E00000-0x0000000001090000-memory.dmp

Download

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\explorer.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\Users\\All Users\\Microsoft\\smss.exe\", \"C:\\Users\\Public\\Desktop\\explorer.exe\", \"C:\\Users\\Default User\\audiodg.exe\", \"C:\\Windows\\Tasks\\smss.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\services.exe\", \"C:\\Windows\\DigitalLocker\\es-ES\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\Idle.exe\", \"C:\\Windows\\Globalization\\ELS\\Transliteration\\services.exe\", \"C:\\Users\\Admin\\Application Data\\Idle.exe\", \"C:\\Recovery\\1fdecb22-2889-11ef-9d63-46d84c032646\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\System.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\explorer.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\587e1d2473fea9284918bfbcf9897de2.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\explorer.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\Users\\All Users\\Microsoft\\smss.exe\", \"C:\\Users\\Public\\Desktop\\explorer.exe\", \"C:\\Users\\Default User\\audiodg.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\explorer.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\Users\\All Users\\Microsoft\\smss.exe\", \"C:\\Users\\Public\\Desktop\\explorer.exe\", \"C:\\Users\\Default User\\audiodg.exe\", \"C:\\Windows\\Tasks\\smss.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\explorer.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\Users\\All Users\\Microsoft\\smss.exe\", \"C:\\Users\\Public\\Desktop\\explorer.exe\", \"C:\\Users\\Default User\\audiodg.exe\", \"C:\\Windows\\Tasks\\smss.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\services.exe\", \"C:\\Windows\\DigitalLocker\\es-ES\\explorer.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\explorer.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\Users\\All Users\\Microsoft\\smss.exe\", \"C:\\Users\\Public\\Desktop\\explorer.exe\", \"C:\\Users\\Default User\\audiodg.exe\", \"C:\\Windows\\Tasks\\smss.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\services.exe\", \"C:\\Windows\\DigitalLocker\\es-ES\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\Idle.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\explorer.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\Users\\All Users\\Microsoft\\smss.exe\", \"C:\\Users\\Public\\Desktop\\explorer.exe\", \"C:\\Users\\Default User\\audiodg.exe\", \"C:\\Windows\\Tasks\\smss.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\services.exe\", \"C:\\Windows\\DigitalLocker\\es-ES\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\Idle.exe\", \"C:\\Windows\\Globalization\\ELS\\Transliteration\\services.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\explorer.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\Users\\All Users\\Microsoft\\smss.exe\", \"C:\\Users\\Public\\Desktop\\explorer.exe\", \"C:\\Users\\Default User\\audiodg.exe\", \"C:\\Windows\\Tasks\\smss.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\services.exe\", \"C:\\Windows\\DigitalLocker\\es-ES\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\Idle.exe\", \"C:\\Windows\\Globalization\\ELS\\Transliteration\\services.exe\", \"C:\\Users\\Admin\\Application Data\\Idle.exe\", \"C:\\Recovery\\1fdecb22-2889-11ef-9d63-46d84c032646\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\System.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\winlogon.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\587e1d2473fea9284918bfbcf9897de2.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\explorer.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\Users\\All Users\\Microsoft\\smss.exe\", \"C:\\Users\\Public\\Desktop\\explorer.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\explorer.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\Users\\All Users\\Microsoft\\smss.exe\", \"C:\\Users\\Public\\Desktop\\explorer.exe\", \"C:\\Users\\Default User\\audiodg.exe\", \"C:\\Windows\\Tasks\\smss.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\services.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\explorer.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\explorer.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\Users\\All Users\\Microsoft\\smss.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\explorer.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\Users\\All Users\\Microsoft\\smss.exe\", \"C:\\Users\\Public\\Desktop\\explorer.exe\", \"C:\\Users\\Default User\\audiodg.exe\", \"C:\\Windows\\Tasks\\smss.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\services.exe\", \"C:\\Windows\\DigitalLocker\\es-ES\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\Idle.exe\", \"C:\\Windows\\Globalization\\ELS\\Transliteration\\services.exe\", \"C:\\Users\\Admin\\Application Data\\Idle.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\explorer.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\587e1d2473fea9284918bfbcf9897de2.exe\", \"C:\\Users\\All Users\\Microsoft\\smss.exe\", \"C:\\Users\\Public\\Desktop\\explorer.exe\", \"C:\\Users\\Default User\\audiodg.exe\", \"C:\\Windows\\Tasks\\smss.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\services.exe\", \"C:\\Windows\\DigitalLocker\\es-ES\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\Idle.exe\", \"C:\\Windows\\Globalization\\ELS\\Transliteration\\services.exe\", \"C:\\Users\\Admin\\Application Data\\Idle.exe\", \"C:\\Recovery\\1fdecb22-2889-11ef-9d63-46d84c032646\\wininit.exe\""	587e1d2473fea9284918bfbcf9897de2.exe