Malware Analysis Report

2024-11-13 13:46

Sample ID 240719-nh4qrasald
Target DCrat.exe
SHA256 1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067
Tags
rat dcrat evasion infostealer persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067

Threat Level: Known bad

The file DCrat.exe was found to be: Known bad.

Malicious Activity Summary

rat dcrat evasion infostealer persistence trojan

UAC bypass

Dcrat family

DcRat

Modifies WinLogon for persistence

DCRat payload

Process spawned unexpected child process

DCRat payload

Disables Task Manager via registry modification

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Checks whether UAC is enabled

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Modifies registry key

Scheduled Task/Job: Scheduled Task

Uses Task Scheduler COM API

System policy modification

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-19 11:24

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-19 11:24

Reported

2024-07-19 11:28

Platform

win7-20240704-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DCrat.exe"

Signatures

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\winlogon.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\winlogon.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\HyperSurrogateContaineragentWin\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\wscript.exe\", \"C:\\Program Files\\Windows Portable Devices\\dllhost.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\wscript.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\winlogon.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\HyperSurrogateContaineragentWin\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\wscript.exe\", \"C:\\Program Files\\Windows Portable Devices\\dllhost.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\wscript.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\services.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\winlogon.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\HyperSurrogateContaineragentWin\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\wscript.exe\", \"C:\\Program Files\\Windows Portable Devices\\dllhost.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\wscript.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Users\\Default\\Downloads\\taskhost.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\winlogon.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\winlogon.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\HyperSurrogateContaineragentWin\\WmiPrvSE.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\winlogon.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\HyperSurrogateContaineragentWin\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\winlogon.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\HyperSurrogateContaineragentWin\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\cmd.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\winlogon.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\HyperSurrogateContaineragentWin\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\wscript.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\winlogon.exe\", \"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\", \"C:\\HyperSurrogateContaineragentWin\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\wscript.exe\", \"C:\\Program Files\\Windows Portable Devices\\dllhost.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Disables Task Manager via registry modification

evasion

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Windows Portable Devices\\dllhost.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\wscript = "\"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\wscript.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\services.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\cmd.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\cmd.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Windows Portable Devices\\dllhost.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\HyperSurrogateContaineragentWin\\winlogon.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\HyperSurrogateContaineragentWin\\WmiPrvSE.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\HyperSurrogateContaineragentWin\\WmiPrvSE.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Default\\Downloads\\taskhost.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\winlogon.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\wscript = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\wscript.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscript = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\wscript.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscript = "\"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\wscript.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\services.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Default\\Downloads\\taskhost.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\winlogon.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\csrss.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Portable Devices\dllhost.exe C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
File created C:\Program Files\Windows Portable Devices\5940a34987c991 C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
N/A N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2712 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\DCrat.exe C:\Windows\SysWOW64\WScript.exe
PID 2712 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\DCrat.exe C:\Windows\SysWOW64\WScript.exe
PID 2712 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\DCrat.exe C:\Windows\SysWOW64\WScript.exe
PID 2712 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\DCrat.exe C:\Windows\SysWOW64\WScript.exe
PID 2712 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\DCrat.exe C:\Windows\SysWOW64\WScript.exe
PID 2712 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\DCrat.exe C:\Windows\SysWOW64\WScript.exe
PID 2712 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\DCrat.exe C:\Windows\SysWOW64\WScript.exe
PID 2712 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\DCrat.exe C:\Windows\SysWOW64\WScript.exe
PID 2956 wrote to memory of 2696 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2696 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2696 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2696 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2696 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\HyperSurrogateContaineragentWin\portruntimesvc.exe
PID 2696 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\HyperSurrogateContaineragentWin\portruntimesvc.exe
PID 2696 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\HyperSurrogateContaineragentWin\portruntimesvc.exe
PID 2696 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\HyperSurrogateContaineragentWin\portruntimesvc.exe
PID 2580 wrote to memory of 692 N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe C:\Windows\System32\cmd.exe
PID 2580 wrote to memory of 692 N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe C:\Windows\System32\cmd.exe
PID 2580 wrote to memory of 692 N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe C:\Windows\System32\cmd.exe
PID 692 wrote to memory of 924 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 692 wrote to memory of 924 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 692 wrote to memory of 924 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2696 wrote to memory of 1016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2696 wrote to memory of 1016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2696 wrote to memory of 1016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2696 wrote to memory of 1016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 692 wrote to memory of 1112 N/A C:\Windows\System32\cmd.exe C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe
PID 692 wrote to memory of 1112 N/A C:\Windows\System32\cmd.exe C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe
PID 692 wrote to memory of 1112 N/A C:\Windows\System32\cmd.exe C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe
PID 1112 wrote to memory of 1908 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 1112 wrote to memory of 1908 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 1112 wrote to memory of 1908 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 1112 wrote to memory of 2956 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 1112 wrote to memory of 2956 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 1112 wrote to memory of 2956 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 1908 wrote to memory of 652 N/A C:\Windows\System32\WScript.exe C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe
PID 1908 wrote to memory of 652 N/A C:\Windows\System32\WScript.exe C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe
PID 1908 wrote to memory of 652 N/A C:\Windows\System32\WScript.exe C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe
PID 652 wrote to memory of 1196 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 652 wrote to memory of 1196 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 652 wrote to memory of 1196 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 652 wrote to memory of 1492 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 652 wrote to memory of 1492 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 652 wrote to memory of 1492 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 1196 wrote to memory of 2256 N/A C:\Windows\System32\WScript.exe C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe
PID 1196 wrote to memory of 2256 N/A C:\Windows\System32\WScript.exe C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe
PID 1196 wrote to memory of 2256 N/A C:\Windows\System32\WScript.exe C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe
PID 2256 wrote to memory of 1760 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 2256 wrote to memory of 1760 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 2256 wrote to memory of 1760 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 2256 wrote to memory of 668 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 2256 wrote to memory of 668 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 2256 wrote to memory of 668 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 1760 wrote to memory of 2524 N/A C:\Windows\System32\WScript.exe C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe
PID 1760 wrote to memory of 2524 N/A C:\Windows\System32\WScript.exe C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe
PID 1760 wrote to memory of 2524 N/A C:\Windows\System32\WScript.exe C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe
PID 2524 wrote to memory of 1932 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 2524 wrote to memory of 1932 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 2524 wrote to memory of 1932 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 2524 wrote to memory of 1016 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 2524 wrote to memory of 1016 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 2524 wrote to memory of 1016 N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe C:\Windows\System32\WScript.exe
PID 1932 wrote to memory of 2668 N/A C:\Windows\System32\WScript.exe C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe
PID 1932 wrote to memory of 2668 N/A C:\Windows\System32\WScript.exe C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\DCrat.exe

"C:\Users\Admin\AppData\Local\Temp\DCrat.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\HyperSurrogateContaineragentWin\bGPSMCCx73WsREqaBZfJC0ze9BBQbq.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\HyperSurrogateContaineragentWin\file.vbs"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\HyperSurrogateContaineragentWin\Trh5bm.bat" "

C:\HyperSurrogateContaineragentWin\portruntimesvc.exe

"C:\HyperSurrogateContaineragentWin\portruntimesvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\HyperSurrogateContaineragentWin\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\HyperSurrogateContaineragentWin\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\HyperSurrogateContaineragentWin\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\HyperSurrogateContaineragentWin\WmiPrvSE.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\HyperSurrogateContaineragentWin\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\HyperSurrogateContaineragentWin\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 8 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\wscript.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 10 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Downloads\taskhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default\Downloads\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Downloads\taskhost.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XuKa62DI0l.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe

"C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48d04892-a3cf-4ca5-82b3-6f932380e804.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\49fc3cb3-6b85-4d6f-80a1-aaef0fad8954.vbs"

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe

"C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d6e6a87f-6ead-4114-9d9b-bbe2df5a2cf0.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84c9f1cb-ca87-4d0b-9a54-d6ad648e5257.vbs"

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe

"C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\96410553-6d5d-477c-a835-db803e91f8e3.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4275a316-a08c-4244-ba51-0bcd3e2b0200.vbs"

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe

"C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15d1e7de-0093-4918-a3ef-6d7dc342c204.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f789bacc-9843-442a-8bb0-ed8c384b8890.vbs"

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe

"C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\833958fd-ae7c-4c63-8431-3c6e2f8c1eec.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea01abc8-dfd6-4f25-9b30-56f4291a8c25.vbs"

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe

"C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0169f93b-8112-43ff-aead-313c69d8efab.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b84ffa6-f791-43fd-bf44-7ac2d82a8451.vbs"

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe

"C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ebe45706-d2c8-4d96-a437-a69ad62542dd.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2916988c-3199-4cc0-b53b-cdb1a886867c.vbs"

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe

"C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd872ec3-cd30-4ecf-8699-1b2b3b7a8de5.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a0ae3d1a-07ec-46c5-9a4f-3d220644da4e.vbs"

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe

"C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84656bd3-bdf1-4d14-ab39-fbe4374bd092.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b9f2b4e-0187-4572-bef1-4f4b1679bda8.vbs"

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe

"C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ead3c224-1cfe-4fee-b25c-48b10cce21f8.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3951f787-844e-441d-bf8f-dcce7fe3e8e0.vbs"

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe

"C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cf1abfda-a1df-48eb-9764-3ecd88b91804.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c180b9d5-2b83-4517-8dc2-73ed8a4b6df6.vbs"

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe

"C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wscript.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ccd7564f-3d5a-4cfa-acba-72e59a949530.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 a0999396.xsph.ru udp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
RU 141.8.192.58:80 a0999396.xsph.ru tcp

Files

C:\HyperSurrogateContaineragentWin\file.vbs

MD5 677cc4360477c72cb0ce00406a949c61
SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

C:\HyperSurrogateContaineragentWin\bGPSMCCx73WsREqaBZfJC0ze9BBQbq.vbe

MD5 bbd4951dfa4c586309c29313a1acc7b9
SHA1 b16961014ff484fee5c5548506fa9f8786ead667
SHA256 e6a2ee525011550a1508f69a603a3b485e35ec89b9783171cff58a4adccb1fee
SHA512 5a7985a58c283240a7c999521a14a8befe71db33d9023f06a78870c663fefbfeac5b9acafc114937ea44ddffb97bad88c448a0c2d025aa21f73d7941b3aaa50e

C:\HyperSurrogateContaineragentWin\Trh5bm.bat

MD5 44e4cd0532339b7e22611a09c8220999
SHA1 8f742acb720ef17baa41ef700c29a3af5582bef9
SHA256 d4ecf707a041c14ab6e6719b4c0bcdea96c159865ff6ef80fd73de0b26b695c8
SHA512 f10dfda0fc0021f642fc0689a8d217052e50c9e58d1057c2f26005df0433e3af54ac77331d9059746804ddb72589f0e4ec3f50c53b1576efb09134e2aa691809

\HyperSurrogateContaineragentWin\portruntimesvc.exe

MD5 3ae60214e5dd15829d6380f5dcaac75c
SHA1 c4ff1e0ef5b97b467b28039b3b902b088107ebae
SHA256 1a38cd5a9e8fb8086a6f84ac2bbac0ded061766fcdf3a25a1e6147a400cb8b39
SHA512 816f2e195827abe524d3ffe3c87ee6a5e02289c2fad1a5ed5b5751ecc356998b61b9638c65b7db7f231a3bc50c002995823755650a703cae12aa9decf4c995ac

memory/2580-18-0x0000000000FF0000-0x000000000135A000-memory.dmp

memory/2580-19-0x0000000000440000-0x000000000044E000-memory.dmp

memory/2580-20-0x00000000004D0000-0x00000000004DE000-memory.dmp

memory/2580-21-0x0000000000560000-0x0000000000568000-memory.dmp

memory/2580-22-0x0000000000570000-0x000000000058C000-memory.dmp

memory/2580-23-0x0000000000AC0000-0x0000000000AC8000-memory.dmp

memory/2580-24-0x0000000000AD0000-0x0000000000AE0000-memory.dmp

memory/2580-25-0x0000000000AE0000-0x0000000000AF6000-memory.dmp

memory/2580-26-0x0000000000B80000-0x0000000000B88000-memory.dmp

memory/2580-27-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

memory/2580-28-0x0000000000B90000-0x0000000000B9C000-memory.dmp

memory/2580-29-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

memory/2580-30-0x0000000000C40000-0x0000000000C50000-memory.dmp

memory/2580-31-0x0000000000C50000-0x0000000000C5A000-memory.dmp

memory/2580-32-0x0000000000C60000-0x0000000000CB6000-memory.dmp

memory/2580-33-0x0000000000CB0000-0x0000000000CBC000-memory.dmp

memory/2580-34-0x0000000000CC0000-0x0000000000CC8000-memory.dmp

memory/2580-35-0x0000000000CD0000-0x0000000000CDC000-memory.dmp

memory/2580-36-0x0000000000CE0000-0x0000000000CE8000-memory.dmp

memory/2580-37-0x0000000000CF0000-0x0000000000D02000-memory.dmp

memory/2580-38-0x000000001AB00000-0x000000001AB0C000-memory.dmp

memory/2580-39-0x000000001AB10000-0x000000001AB1C000-memory.dmp

memory/2580-40-0x000000001AD20000-0x000000001AD28000-memory.dmp

memory/2580-41-0x000000001AD30000-0x000000001AD3C000-memory.dmp

memory/2580-42-0x000000001AD40000-0x000000001AD4C000-memory.dmp

memory/2580-43-0x000000001AD50000-0x000000001AD58000-memory.dmp

memory/2580-44-0x000000001AD60000-0x000000001AD6C000-memory.dmp

memory/2580-45-0x000000001AD70000-0x000000001AD7A000-memory.dmp

memory/2580-46-0x000000001AD80000-0x000000001AD8E000-memory.dmp

memory/2580-47-0x000000001AD90000-0x000000001AD98000-memory.dmp

memory/2580-48-0x000000001ADA0000-0x000000001ADAE000-memory.dmp

memory/2580-49-0x000000001ADB0000-0x000000001ADB8000-memory.dmp

memory/2580-50-0x000000001ADC0000-0x000000001ADCC000-memory.dmp

memory/2580-51-0x000000001ADD0000-0x000000001ADD8000-memory.dmp

memory/2580-52-0x000000001ADE0000-0x000000001ADEA000-memory.dmp

memory/2580-53-0x000000001B1C0000-0x000000001B1CC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XuKa62DI0l.bat

MD5 b1d989e9c11b1f3e3859987a0696cbaa
SHA1 cdfa7340821a57337ea3e5f681a5683ca8b2e6c3
SHA256 1ef3c0ef22b0f7c39e78898d8886fd76cf5f7dbf61397611adad4701f5a67f06
SHA512 811c21595c6786803f8d4ab1f63c373430fa805d5525604392e9d5bfeba6dd6250cdf44e8c427c6c5e4178c9187c06b98043525c2e612f56795478c0282b0d7a

memory/1112-83-0x0000000000830000-0x0000000000B9A000-memory.dmp

memory/1112-84-0x0000000002350000-0x0000000002362000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\48d04892-a3cf-4ca5-82b3-6f932380e804.vbs

MD5 6d3be6c7f1bd4743469eec7906e11631
SHA1 c0aa9813de28c7502b9c908bb5dccac5eedc3343
SHA256 dba993ed3150c7677f9f6e07deea099c4bbb558842d2076657269920af46354e
SHA512 e1d5794c47e0e3e74f09fabc1f9f824b40de8694de7ea180928d70136e324927148135bc51e5586cdd370157617bbce409b4150fdf64382cd04fc840638fde35

C:\Users\Admin\AppData\Local\Temp\49fc3cb3-6b85-4d6f-80a1-aaef0fad8954.vbs

MD5 543ef82b4c75e7c93e165ccf0b2ce9bd
SHA1 47bf3c7dcaa4396e7373594a8993455f75d25245
SHA256 3773c8c5f6df445c1405d2437642209da2c378ba5f1c598e6cfdd137fadff378
SHA512 89798362ddcc95213a5e5d9c13332b000a5691eded97d7c48548d7cce9da077a609633381a40e9451864d1b712c59a064a9d180c6883984eeead477ee160e97b

memory/652-95-0x00000000010E0000-0x000000000144A000-memory.dmp

memory/652-96-0x0000000000D30000-0x0000000000D86000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\d6e6a87f-6ead-4114-9d9b-bbe2df5a2cf0.vbs

MD5 833b3c846b13ee840ba5e49c66fd33f3
SHA1 1233c4280077e82b14acc71d1fcaaf91d036048c
SHA256 2ccf1e6499cf00c932da4e6c3b312497229ad0dc3fd15d2febca9eac68828800
SHA512 9863cbe139c58baece5d645c8eecf24bf0d7cbc57d37b09cc614ef9ea06cdfce6ebe0496d6c3ba0f3ae9f06f875125fc7a5026e9ac65c4eb39322a9ed774e4a1

memory/2256-108-0x0000000000610000-0x0000000000622000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\96410553-6d5d-477c-a835-db803e91f8e3.vbs

MD5 b5a24a28cb230950fe5d1c48d59da522
SHA1 ec633297dcb824571f6515c3cd926204e49e9fa6
SHA256 9afb1e8f14a56c91056b79f2b5daddff25977a0b4e14cadf2c9375e594b10701
SHA512 64bf9aa29a018a22a918ff9a14efa3077b360fac1e9bcdead8f1ca2fe7c2a0444c0b1b6d0fa8c87dada2e7fa411e62068e85189f260f50f05951f4dd0853b68a

memory/2524-120-0x0000000000040000-0x00000000003AA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\15d1e7de-0093-4918-a3ef-6d7dc342c204.vbs

MD5 d85c78936c5e8cca91bf0bb7af9b2c06
SHA1 b34077cc9926ad690281a6c25723f82db8005115
SHA256 f9a09398ffcc6c2a684e6ca3d601a898d90750d167c8dbc057e25148b2ee68b3
SHA512 83fbd6d49370a92298f5943c9721c0309f983a4515f18a995bbe25c89cbe90e6248bc75da844dfb1ee6a41b0d3ba97bb84b0937775840b1babc384020380c090

memory/2668-132-0x0000000000390000-0x00000000006FA000-memory.dmp

memory/2668-133-0x0000000002290000-0x00000000022A2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\833958fd-ae7c-4c63-8431-3c6e2f8c1eec.vbs

MD5 37fd340796610b5572ce8922f5e1cd0e
SHA1 168b9fee896bd633bb0ba21f2ce8a453783618d7
SHA256 7d5509a449f7ad43b6ba0ee1eceff8893f2fbecff8a1dcde94ce70e715dccaea
SHA512 abf9113abf360ac08f18a94b91014dbf141e081556e82e7cccd536a615b722a5253a2b16d3d3ca5e5e44d4cd371c14dcc0914c8212a77c0c3d9c81e429444308

memory/572-145-0x0000000000030000-0x000000000039A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0169f93b-8112-43ff-aead-313c69d8efab.vbs

MD5 65b3b4aa49b4a0c4a0410055538c7bbc
SHA1 e8347ca00048fae68a26375d4309625cade3a666
SHA256 2b636aae5d1738676c6a22375b23868fcf870eec84b3d77779fd23a19a296582
SHA512 509d5ead7392bcfc8f62e8a8bd4d87769f02d5bb7b82ebb285803f1609de87a32b6071e24b5a01852323a760ad9b6e1088a3b028c62510a47ec1258735d700a2

memory/2116-157-0x0000000000AF0000-0x0000000000E5A000-memory.dmp

memory/2116-158-0x0000000000540000-0x0000000000552000-memory.dmp

memory/2116-159-0x000000001A970000-0x000000001A982000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ebe45706-d2c8-4d96-a437-a69ad62542dd.vbs

MD5 787a1efd4f21a9c8ffd61ea156cc69d1
SHA1 f38f3aad75291f58f2c5108532be32560ea4ab7d
SHA256 f5227df90f087f50795a9dca1e2a3a816c1858305b9f760fe659bca2d960c71b
SHA512 4f014d2c91b02d139200e63326a80dfdfd04a815d6f2c688a06cf2d114c63ebcbaaf39d8c691fe9feb358ad5f601772102b1e1887100fdd3ff1ebc83adcec516

memory/2648-171-0x0000000000D70000-0x00000000010DA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dd872ec3-cd30-4ecf-8699-1b2b3b7a8de5.vbs

MD5 ad9e133e10582d3c9f2fbb71f8e78418
SHA1 172a6f27fba6e37e2eb6437cdb4901ca58304e79
SHA256 0439f8e4e68a01cfd210beb32f627ac4b2217d05f3c660ea8fec5ccb7a0b0076
SHA512 40ce8820f665cd6e180303f28fd8a8a393cec78e0cd15fb3f032fd7c8e3026d085416ce37786c8a17498f67f018fca1c61e3d391a5e8c99ab83088615b3bc5d9

C:\Users\Admin\AppData\Local\Temp\84656bd3-bdf1-4d14-ab39-fbe4374bd092.vbs

MD5 9f96ddddfef265c387d71542d9900b31
SHA1 fa581913fea04ec7d46b7a3b67a833f7523df01a
SHA256 561cc98c5ace3e628d4b54e06302bcf6607c384c6c788dbf269c773edd236f01
SHA512 8f3fdba0a29c09b1ce58306a5ed3c1936a41f0d6ea585d6421819b276d62db2d1a1175f3352d0b7cbacf9d1e872367ae0db488e3ca125d94c7a3aebcddf8b9a0

memory/2412-194-0x0000000000CB0000-0x0000000000CC2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ead3c224-1cfe-4fee-b25c-48b10cce21f8.vbs

MD5 b0fd572fc21f986e2c9792b9a5fe0908
SHA1 47a2fde4c9c65981ee6e1c79c14a6d428b4a349a
SHA256 e4593c695159ca856ec4b8a13523be6dc00f3f2e82597f91e32e6fb5569164c9
SHA512 6928dad3dcbed0e13efe3559fbbdc9f8a1e9fc0d16d3b0dca216c6463ce39d1f2ed8b2328bad923b25f4adc75c8ae11a1312dddb202a44df89a3c50d2cb75cc2

memory/832-206-0x00000000004F0000-0x0000000000502000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\cf1abfda-a1df-48eb-9764-3ecd88b91804.vbs

MD5 a1b12939762088fded3d179f153bb2b9
SHA1 8fcf054aff4f8b57b49b5cb770168dcee661e256
SHA256 0339e31c0dc1d3c1a311096defaef306c96b6ceb2bcf2d82fca0d0d6c266c90f
SHA512 e9de3087da7432c09931b2ec304da0697c18cb9460cfe7c1a8eabccb431a671026ac62a6f33267bd3c977e9cfc27769411d6a92dc7c7aaff409c11ff55860282

memory/2136-218-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-19 11:24

Reported

2024-07-19 11:28

Platform

win10v2004-20240709-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DCrat.exe"

Signatures

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\24dbde2999530e C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\DCrat.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\Registry.exe\", \"C:\\Windows\\SKB\\LanguageModels\\winlogon.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\Registry.exe\", \"C:\\Windows\\SKB\\LanguageModels\\winlogon.exe\", \"C:\\Users\\All Users\\ssh\\OfficeClickToRun.exe\", \"C:\\Windows\\Tasks\\spoolsv.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\SearchApp.exe\", \"C:\\Windows\\CbsTemp\\winlogon.exe\", \"C:\\Users\\All Users\\Package Cache\\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Users\\Default\\Saved Games\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\upfc.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\Registry.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\Registry.exe\", \"C:\\Windows\\SKB\\LanguageModels\\winlogon.exe\", \"C:\\Users\\All Users\\ssh\\OfficeClickToRun.exe\", \"C:\\Windows\\Tasks\\spoolsv.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\WmiPrvSE.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\Registry.exe\", \"C:\\Windows\\SKB\\LanguageModels\\winlogon.exe\", \"C:\\Users\\All Users\\ssh\\OfficeClickToRun.exe\", \"C:\\Windows\\Tasks\\spoolsv.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\SearchApp.exe\", \"C:\\Windows\\CbsTemp\\winlogon.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\Registry.exe\", \"C:\\Windows\\SKB\\LanguageModels\\winlogon.exe\", \"C:\\Users\\All Users\\ssh\\OfficeClickToRun.exe\", \"C:\\Windows\\Tasks\\spoolsv.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\SearchApp.exe\", \"C:\\Windows\\CbsTemp\\winlogon.exe\", \"C:\\Users\\All Users\\Package Cache\\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\Registry.exe\", \"C:\\Windows\\SKB\\LanguageModels\\winlogon.exe\", \"C:\\Users\\All Users\\ssh\\OfficeClickToRun.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\Registry.exe\", \"C:\\Windows\\SKB\\LanguageModels\\winlogon.exe\", \"C:\\Users\\All Users\\ssh\\OfficeClickToRun.exe\", \"C:\\Windows\\Tasks\\spoolsv.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\SearchApp.exe\", \"C:\\Windows\\CbsTemp\\winlogon.exe\", \"C:\\Users\\All Users\\Package Cache\\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\\taskhostw.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\Registry.exe\", \"C:\\Windows\\SKB\\LanguageModels\\winlogon.exe\", \"C:\\Users\\All Users\\ssh\\OfficeClickToRun.exe\", \"C:\\Windows\\Tasks\\spoolsv.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\SearchApp.exe\", \"C:\\Windows\\CbsTemp\\winlogon.exe\", \"C:\\Users\\All Users\\Package Cache\\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Users\\Default\\Saved Games\\fontdrvhost.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\fontdrvhost.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\Registry.exe\", \"C:\\Windows\\SKB\\LanguageModels\\winlogon.exe\", \"C:\\Users\\All Users\\ssh\\OfficeClickToRun.exe\", \"C:\\Windows\\Tasks\\spoolsv.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\Registry.exe\", \"C:\\Windows\\SKB\\LanguageModels\\winlogon.exe\", \"C:\\Users\\All Users\\ssh\\OfficeClickToRun.exe\", \"C:\\Windows\\Tasks\\spoolsv.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\SearchApp.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\Registry.exe\", \"C:\\Windows\\SKB\\LanguageModels\\winlogon.exe\", \"C:\\Users\\All Users\\ssh\\OfficeClickToRun.exe\", \"C:\\Windows\\Tasks\\spoolsv.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\WmiPrvSE.exe\", \"C:\\HyperSurrogateContaineragentWin\\SearchApp.exe\", \"C:\\Windows\\CbsTemp\\winlogon.exe\", \"C:\\Users\\All Users\\Package Cache\\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Disables Task Manager via registry modification

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\DCrat.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Users\\All Users\\ssh\\OfficeClickToRun.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\Performance\\WinSAT\\DataStore\\Registry.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\WmiPrvSE.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\upfc.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\HyperSurrogateContaineragentWin\\SearchApp.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\CbsTemp\\winlogon.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\HyperSurrogateContaineragentWin\\fontdrvhost.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\SKB\\LanguageModels\\winlogon.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\WmiPrvSE.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\HyperSurrogateContaineragentWin\\fontdrvhost.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\CbsTemp\\winlogon.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Users\\All Users\\ssh\\OfficeClickToRun.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Users\\All Users\\Package Cache\\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\\taskhostw.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\Performance\\WinSAT\\DataStore\\Registry.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Users\\All Users\\Package Cache\\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\\taskhostw.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default\\Saved Games\\fontdrvhost.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\upfc.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\WmiPrvSE.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\Tasks\\spoolsv.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\HyperSurrogateContaineragentWin\\SearchApp.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\SKB\\LanguageModels\\winlogon.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\Tasks\\spoolsv.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default\\Saved Games\\fontdrvhost.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\ModifiableWindowsApps\Registry.exe C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\ea1d8f6d871115 C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\WmiPrvSE.exe C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\WmiPrvSE.exe C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\24dbde2999530e C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Performance\WinSAT\DataStore\Registry.exe C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
File created C:\Windows\Performance\WinSAT\DataStore\ee2ad38f3d4382 C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
File created C:\Windows\SKB\LanguageModels\cc11b995f2a76d C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
File created C:\Windows\Tasks\f3b6ecef712a24 C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
File created C:\Windows\security\ApplicationId\PolicyManagement\24dbde2999530e C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
File created C:\Windows\CbsTemp\cc11b995f2a76d C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
File created C:\Windows\SKB\LanguageModels\winlogon.exe C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
File created C:\Windows\Tasks\spoolsv.exe C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
File created C:\Windows\security\ApplicationId\PolicyManagement\WmiPrvSE.exe C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
File created C:\Windows\CbsTemp\winlogon.exe C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\DCrat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5100 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\DCrat.exe C:\Windows\SysWOW64\WScript.exe
PID 5100 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\DCrat.exe C:\Windows\SysWOW64\WScript.exe
PID 5100 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\DCrat.exe C:\Windows\SysWOW64\WScript.exe
PID 5100 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\DCrat.exe C:\Windows\SysWOW64\WScript.exe
PID 5100 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\DCrat.exe C:\Windows\SysWOW64\WScript.exe
PID 5100 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\DCrat.exe C:\Windows\SysWOW64\WScript.exe
PID 2868 wrote to memory of 5016 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2868 wrote to memory of 5016 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2868 wrote to memory of 5016 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 5016 wrote to memory of 3872 N/A C:\Windows\SysWOW64\cmd.exe C:\HyperSurrogateContaineragentWin\portruntimesvc.exe
PID 5016 wrote to memory of 3872 N/A C:\Windows\SysWOW64\cmd.exe C:\HyperSurrogateContaineragentWin\portruntimesvc.exe
PID 3872 wrote to memory of 1972 N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe C:\Windows\System32\cmd.exe
PID 3872 wrote to memory of 1972 N/A C:\HyperSurrogateContaineragentWin\portruntimesvc.exe C:\Windows\System32\cmd.exe
PID 5016 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5016 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5016 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1972 wrote to memory of 4988 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1972 wrote to memory of 4988 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1972 wrote to memory of 1456 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
PID 1972 wrote to memory of 1456 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
PID 1456 wrote to memory of 2780 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 1456 wrote to memory of 2780 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 1456 wrote to memory of 4192 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 1456 wrote to memory of 4192 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 2780 wrote to memory of 3156 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
PID 2780 wrote to memory of 3156 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
PID 3156 wrote to memory of 388 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 3156 wrote to memory of 388 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 3156 wrote to memory of 4856 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 3156 wrote to memory of 4856 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 388 wrote to memory of 4968 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
PID 388 wrote to memory of 4968 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
PID 4968 wrote to memory of 644 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 4968 wrote to memory of 644 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 4968 wrote to memory of 544 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 4968 wrote to memory of 544 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 644 wrote to memory of 4992 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
PID 644 wrote to memory of 4992 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
PID 4992 wrote to memory of 4888 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 4992 wrote to memory of 4888 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 4992 wrote to memory of 4372 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 4992 wrote to memory of 4372 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 4888 wrote to memory of 3112 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
PID 4888 wrote to memory of 3112 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
PID 3112 wrote to memory of 4188 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 3112 wrote to memory of 4188 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 3112 wrote to memory of 1936 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 3112 wrote to memory of 1936 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 4188 wrote to memory of 3932 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
PID 4188 wrote to memory of 3932 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
PID 3932 wrote to memory of 3184 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 3932 wrote to memory of 3184 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 3932 wrote to memory of 1480 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 3932 wrote to memory of 1480 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 3184 wrote to memory of 1344 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
PID 3184 wrote to memory of 1344 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
PID 1344 wrote to memory of 4588 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 1344 wrote to memory of 4588 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 1344 wrote to memory of 1036 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 1344 wrote to memory of 1036 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 4588 wrote to memory of 1288 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
PID 4588 wrote to memory of 1288 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
PID 1288 wrote to memory of 904 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe
PID 1288 wrote to memory of 904 N/A C:\Program Files (x86)\Windows Photo Viewer\upfc.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\HyperSurrogateContaineragentWin\portruntimesvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Photo Viewer\upfc.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\DCrat.exe

"C:\Users\Admin\AppData\Local\Temp\DCrat.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\HyperSurrogateContaineragentWin\bGPSMCCx73WsREqaBZfJC0ze9BBQbq.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\HyperSurrogateContaineragentWin\file.vbs"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\HyperSurrogateContaineragentWin\Trh5bm.bat" "

C:\HyperSurrogateContaineragentWin\portruntimesvc.exe

"C:\HyperSurrogateContaineragentWin\portruntimesvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\WmiPrvSE.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\HyperSurrogateContaineragentWin\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\HyperSurrogateContaineragentWin\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\HyperSurrogateContaineragentWin\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Windows\Performance\WinSAT\DataStore\Registry.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Windows\Performance\WinSAT\DataStore\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Windows\SKB\LanguageModels\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Windows\SKB\LanguageModels\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\ssh\OfficeClickToRun.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\All Users\ssh\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\ssh\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Windows\Tasks\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Tasks\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Windows\Tasks\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Windows\security\ApplicationId\PolicyManagement\WmiPrvSE.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\security\ApplicationId\PolicyManagement\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Windows\security\ApplicationId\PolicyManagement\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\HyperSurrogateContaineragentWin\SearchApp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\HyperSurrogateContaineragentWin\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\HyperSurrogateContaineragentWin\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\CbsTemp\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\CbsTemp\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Windows\CbsTemp\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\taskhostw.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\taskhostw.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\taskhostw.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Saved Games\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Saved Games\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\upfc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\upfc.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WRtY9wpW6j.bat"

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files (x86)\Windows Photo Viewer\upfc.exe

"C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8d5cb4f-9efc-4f88-87b6-46796977d9b4.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8be32ed3-3b83-4c03-b1ca-71e8281ba38a.vbs"

C:\Program Files (x86)\Windows Photo Viewer\upfc.exe

"C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\120dac9a-9cda-45a1-ba36-042b724843f0.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a516a436-2875-4b50-8f15-76f5198c5114.vbs"

C:\Program Files (x86)\Windows Photo Viewer\upfc.exe

"C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\318c2959-5c16-4e93-b67c-85286f54088f.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b7f5bb4-2b9c-4846-ad71-354a18b5b1f8.vbs"

C:\Program Files (x86)\Windows Photo Viewer\upfc.exe

"C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a9744ec-9a5f-4ef9-b4d0-c79b56ffda0e.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a0f1e476-88f3-4039-bead-8cb9568a9f36.vbs"

C:\Program Files (x86)\Windows Photo Viewer\upfc.exe

"C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4edd6f4-7b07-442f-aaa9-a2b55429e04a.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76619d05-4f98-407f-afb8-6d6247569d14.vbs"

C:\Program Files (x86)\Windows Photo Viewer\upfc.exe

"C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1309b9cf-bb51-4126-b68d-1642f6b84afd.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72049e0b-b7a3-4e7f-bf7c-159ee1bbebc6.vbs"

C:\Program Files (x86)\Windows Photo Viewer\upfc.exe

"C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d8416a4-b30f-45b4-a1a9-83220ff18585.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f7fbfb2a-97c4-4a4d-a4b7-49702ee2c26e.vbs"

C:\Program Files (x86)\Windows Photo Viewer\upfc.exe

"C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0eb132b5-5b5e-469f-a479-f9910b07d596.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f37bb64-582c-4fca-8081-aa4c6fe6eae8.vbs"

C:\Program Files (x86)\Windows Photo Viewer\upfc.exe

"C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c689aec-21b4-4296-9f27-ca3a74911f75.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\789b7756-ecd2-4317-b7c4-8a54cb367d5c.vbs"

C:\Program Files (x86)\Windows Photo Viewer\upfc.exe

"C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a67580c5-5202-47d5-b795-e8e007e87a1b.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\876ec5de-4f5c-47fa-9560-35115f6f981e.vbs"

C:\Program Files (x86)\Windows Photo Viewer\upfc.exe

"C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\957de2df-1d09-4cb0-8953-597d3e35ef16.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\075a22a4-fa72-4aea-a6f0-6916081c91c6.vbs"

C:\Program Files (x86)\Windows Photo Viewer\upfc.exe

"C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8ec65637-3e22-4336-8c1e-1a4a10e6e311.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2019ef24-428d-4bda-9921-b9ebb238ae0e.vbs"

C:\Program Files (x86)\Windows Photo Viewer\upfc.exe

"C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 a0999396.xsph.ru udp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
US 8.8.8.8:53 58.192.8.141.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
RU 141.8.192.58:80 a0999396.xsph.ru tcp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp

Files

C:\HyperSurrogateContaineragentWin\bGPSMCCx73WsREqaBZfJC0ze9BBQbq.vbe

MD5 bbd4951dfa4c586309c29313a1acc7b9
SHA1 b16961014ff484fee5c5548506fa9f8786ead667
SHA256 e6a2ee525011550a1508f69a603a3b485e35ec89b9783171cff58a4adccb1fee
SHA512 5a7985a58c283240a7c999521a14a8befe71db33d9023f06a78870c663fefbfeac5b9acafc114937ea44ddffb97bad88c448a0c2d025aa21f73d7941b3aaa50e

C:\HyperSurrogateContaineragentWin\file.vbs

MD5 677cc4360477c72cb0ce00406a949c61
SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

C:\HyperSurrogateContaineragentWin\Trh5bm.bat

MD5 44e4cd0532339b7e22611a09c8220999
SHA1 8f742acb720ef17baa41ef700c29a3af5582bef9
SHA256 d4ecf707a041c14ab6e6719b4c0bcdea96c159865ff6ef80fd73de0b26b695c8
SHA512 f10dfda0fc0021f642fc0689a8d217052e50c9e58d1057c2f26005df0433e3af54ac77331d9059746804ddb72589f0e4ec3f50c53b1576efb09134e2aa691809

C:\HyperSurrogateContaineragentWin\portruntimesvc.exe

MD5 3ae60214e5dd15829d6380f5dcaac75c
SHA1 c4ff1e0ef5b97b467b28039b3b902b088107ebae
SHA256 1a38cd5a9e8fb8086a6f84ac2bbac0ded061766fcdf3a25a1e6147a400cb8b39
SHA512 816f2e195827abe524d3ffe3c87ee6a5e02289c2fad1a5ed5b5751ecc356998b61b9638c65b7db7f231a3bc50c002995823755650a703cae12aa9decf4c995ac

memory/3872-17-0x0000000000B90000-0x0000000000EFA000-memory.dmp

memory/3872-18-0x00000000016F0000-0x00000000016FE000-memory.dmp

memory/3872-19-0x0000000001710000-0x000000000171E000-memory.dmp

memory/3872-20-0x0000000001720000-0x0000000001728000-memory.dmp

memory/3872-21-0x000000001C150000-0x000000001C16C000-memory.dmp

memory/3872-22-0x000000001C1C0000-0x000000001C210000-memory.dmp

memory/3872-24-0x000000001C170000-0x000000001C180000-memory.dmp

memory/3872-23-0x0000000001730000-0x0000000001738000-memory.dmp

memory/3872-26-0x000000001C1A0000-0x000000001C1A8000-memory.dmp

memory/3872-25-0x000000001C180000-0x000000001C196000-memory.dmp

memory/3872-27-0x000000001C310000-0x000000001C322000-memory.dmp

memory/3872-28-0x000000001C1B0000-0x000000001C1BC000-memory.dmp

memory/3872-29-0x000000001C320000-0x000000001C328000-memory.dmp

memory/3872-30-0x000000001C330000-0x000000001C340000-memory.dmp

memory/3872-31-0x000000001C340000-0x000000001C34A000-memory.dmp

memory/3872-32-0x000000001C350000-0x000000001C3A6000-memory.dmp

memory/3872-33-0x000000001C3A0000-0x000000001C3AC000-memory.dmp

memory/3872-34-0x000000001C3B0000-0x000000001C3B8000-memory.dmp

memory/3872-35-0x000000001C3C0000-0x000000001C3CC000-memory.dmp

memory/3872-36-0x000000001C3D0000-0x000000001C3D8000-memory.dmp

memory/3872-37-0x000000001C3E0000-0x000000001C3F2000-memory.dmp

memory/3872-38-0x000000001C940000-0x000000001CE68000-memory.dmp

memory/3872-39-0x000000001C410000-0x000000001C41C000-memory.dmp

memory/3872-40-0x000000001C420000-0x000000001C42C000-memory.dmp

memory/3872-41-0x000000001C430000-0x000000001C438000-memory.dmp

memory/3872-42-0x000000001C440000-0x000000001C44C000-memory.dmp

memory/3872-43-0x000000001C450000-0x000000001C45C000-memory.dmp

memory/3872-45-0x000000001C570000-0x000000001C57C000-memory.dmp

memory/3872-44-0x000000001C560000-0x000000001C568000-memory.dmp

memory/3872-46-0x000000001C580000-0x000000001C58A000-memory.dmp

memory/3872-48-0x000000001C6A0000-0x000000001C6A8000-memory.dmp

memory/3872-47-0x000000001C690000-0x000000001C69E000-memory.dmp

memory/3872-49-0x000000001C6B0000-0x000000001C6BE000-memory.dmp

memory/3872-50-0x000000001C6C0000-0x000000001C6C8000-memory.dmp

memory/3872-51-0x000000001C6D0000-0x000000001C6DC000-memory.dmp

memory/3872-52-0x000000001C6E0000-0x000000001C6E8000-memory.dmp

memory/3872-53-0x000000001C7F0000-0x000000001C7FA000-memory.dmp

memory/3872-54-0x000000001C6F0000-0x000000001C6FC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\WRtY9wpW6j.bat

MD5 82a86846eb8523f4f37292e3c7c0f9f6
SHA1 1771dbc6e548c600c8fbddb61354f5c998e43ce8
SHA256 ef2322e329f7041d5260790a75da74da38a4e9bc48b572a45882ff70be33c3db
SHA512 29ffeb6ae7a558acdf187360e29c00f7c84b1bcd7d97f525ce8828dc21d16926bbf82d635e6ba96f7280247560fd5f0dbe1c573852198428e8d4cab4198e9a73

memory/1456-92-0x0000000003430000-0x0000000003442000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\c8d5cb4f-9efc-4f88-87b6-46796977d9b4.vbs

MD5 d19694d1f9c826e642b228c00a9b2674
SHA1 4dce71c316915d6047c2fd781b35866512fcc728
SHA256 8d68d0bc3558ae69742735958c2f1eeeef0282afb5640d28d8723daad6e8ef80
SHA512 624b31b8e84daf556cc9af09bf9b0e10506450c5a5694cc5581efd53a182efab03b01a3e43789e57554c8762d42f7d843a718737faaa2f1b3136107e436ebb04

C:\Users\Admin\AppData\Local\Temp\8be32ed3-3b83-4c03-b1ca-71e8281ba38a.vbs

MD5 f0320a30969af3b683c7262e19a7115f
SHA1 9b426d68eaa57fa52c51754a973b5b131433e119
SHA256 de590c30611a03c2c0d26d84ca13519e3a0bafd9eca2b09666728c17e4e6705d
SHA512 2a6d9917a3e390427f17b3f5baed5f95b77ffb84277f8f26f6953d13a15cfb05ec27d5e7d8eb8c9eea4d11cb15c4e89ec7689ab1d62d790d4c0ddfc4b38aa99b

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\upfc.exe.log

MD5 49b64127208271d8f797256057d0b006
SHA1 b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
SHA512 f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

C:\Users\Admin\AppData\Local\Temp\120dac9a-9cda-45a1-ba36-042b724843f0.vbs

MD5 1b872949dd2d9ff5a4f0adcb2f11bc27
SHA1 b3279fa5f40fa0f8a415a7dd7fef38d862f86d1d
SHA256 a3b4d39a8090dac9b9f71ce239f8ec108a0f213c815021acefd3a54dd7697a92
SHA512 cf62dc0e1e350d19d8b57590244b11e0e8bff98044fe17a11c1731253f0d0a6e7216eecd0815a698e7bb8bd74d6c4ce653e9e4f0d98ba893e06fba34818261f7

memory/4968-116-0x000000001BE00000-0x000000001BE12000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\318c2959-5c16-4e93-b67c-85286f54088f.vbs

MD5 e0940d40d1b89af8d3c664bc19370f06
SHA1 a011d5b785d3ea25fe0ac336a8f7a5f8f17479bc
SHA256 e6b9d457f20b843a8395b87a3f140a99a4233e969f8e448bab2056b7f58123ea
SHA512 a6bbc50fb76b5d2c0ab381a0c6494c3975bf6d3b6ebb5c6b64b1e8675f09c35ffb4ecf2082697e82cb6bd8b2c89cd72e660ad4477da3c066623ee0811d178537

memory/4992-128-0x000000001BD70000-0x000000001BD82000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1a9744ec-9a5f-4ef9-b4d0-c79b56ffda0e.vbs

MD5 9e19ec6f833c3ae9faa7607cec992761
SHA1 d87d9c7584d58c5e37e83fa0a274341ad3741ebc
SHA256 3dde36db8a2534e7717b8fe05d3e6eb6add31d9dcf0905bd3392f9da1c2c9df3
SHA512 a4158b12610b42fdc18d52651f4a791825ec0d762a99df8df87ac9db5c09c0ebbcc3fadd26f5486b7a2ef9d8c7eb1d9825fb9641c8073cfce31004c7bb0d5e39

memory/3112-140-0x000000001B800000-0x000000001B812000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b4edd6f4-7b07-442f-aaa9-a2b55429e04a.vbs

MD5 80bd1b89e8f269e70743d597d7183f17
SHA1 19e72eb4693de7413dc6b26e189ee42b16a2a437
SHA256 51909ffd0b64b8e9a4b2deb45d118b3739be8b5ab123b066874fb098dc467800
SHA512 b7337e30474b6f73829ee56632106a5cf6abe4b69367f49f28bfaddaa92ff8a87a3cfaa8be5d3b23bdf694d216091b13005017b14b53f592628b5cfbbfdb52d2

memory/3932-152-0x000000001C430000-0x000000001C442000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1309b9cf-bb51-4126-b68d-1642f6b84afd.vbs

MD5 3909f808947e65204fc12989175c19c6
SHA1 c76c42f169b2a190b8bb49e9c38e3511bb204b0e
SHA256 24c365a72372279cee278ed74eca248cc3486d2eca4858e304618a45547ef7b4
SHA512 beadc72e6e865b05310129f39af985265765a43f2128b5789757f8aa8f18848d84c90d47a3e1112a909e3f166ad5bb884fe5c684b3fe7b8d1185bb164dd2c8aa

C:\Users\Admin\AppData\Local\Temp\8d8416a4-b30f-45b4-a1a9-83220ff18585.vbs

MD5 b19b592f90bc4b74f4aead55bebdbd7f
SHA1 a75f520b56a3c48c5b70f1f67fd7d289c4d9ce3d
SHA256 78eb8c259e1bdd53baab04809a25558410c7f48aa1b55197990b5dd8fafd5c8c
SHA512 d5411ee7fd9b1831918099817c31f9340d76d199e650d25d401fa48848d5416ec318318caa013a36c42cc5906db52569e5af930a735012b10713b0cdd5cf397e

C:\Users\Admin\AppData\Local\Temp\0eb132b5-5b5e-469f-a479-f9910b07d596.vbs

MD5 ad689f9372536ed639d5d00310a8e19d
SHA1 6ef641e1128de14c33107b3e4269edfd6b012abf
SHA256 9fffa5c72f5b416179503a40c33dc8006d6c1f088cdffb6ba338f065dbcfd289
SHA512 41088f4236cd12d18709e328ebffaf96c01020bf6accf0f64373e842e04162de65abeb1f2d1858c868d234ed27f986b7f3c85682a566ff5e8881828b42c63807

C:\Users\Admin\AppData\Local\Temp\8c689aec-21b4-4296-9f27-ca3a74911f75.vbs

MD5 14ab4afd861c2a79fadfb81aee666579
SHA1 448e480f85bbcee026b5e5549a9692633ba89ed2
SHA256 499d4a694b5d2dc468cc274b90bbf9972b9cbcb94eecd1ddee0ffb4ee5ee88c6
SHA512 5022cd7e972f022abd332aed0e1809e2927e4262306d027ffda891e3d1cf33c1b547d764fd1bf0134246ca5c2ca7dabeba7d10786dc7a612c5cce6447b85e27a

C:\Users\Admin\AppData\Local\Temp\a67580c5-5202-47d5-b795-e8e007e87a1b.vbs

MD5 c0ecf564af3ac6a60a1d26cd150d282c
SHA1 b429f96e9ce4fbb4ec9d2d217a0ce9ae78716565
SHA256 942b7901112487466dfa70fd67f28b0a33f2c74e072506dade82fca842ef8147
SHA512 e7d6ac0b469be13219012972a6e4cbf602c11ef79b6346836b4fd122800bc1fe62f68c8fac31b11348aff8e7997db1749cf84ce4b2dd64a2432bf80ad1bc3ee6

memory/1416-208-0x000000001BC60000-0x000000001BC72000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\957de2df-1d09-4cb0-8953-597d3e35ef16.vbs

MD5 6f295660feaae92f6bb42ca14663f1cf
SHA1 5ee098ce9a23c2738b5508f5ca5eccec4b9d1c86
SHA256 a37a88268862b1eeb817243b84a74d002ac57889ff33e28158fb16557df6495e
SHA512 19ef2bfa5fa7981fdd60265f7c1a17cdc4dee6653e14a000b135842e0fd92b35380c4d69dc326436e897218115a455f30fa0c190b1c2150399162ae21674f8a0

C:\Users\Admin\AppData\Local\Temp\8ec65637-3e22-4336-8c1e-1a4a10e6e311.vbs

MD5 618ea592bd25186343dbec2a8108afcc
SHA1 efa0b65984336f938e727547464932132a36f1c3
SHA256 673e47676dbf890781762d89e78608108d478a17f6bdfdb4d47303e56ca7ee84
SHA512 d9d3bca45f973917eef5f901b60cceec4538809f0d5b5bd5c08528ab810377369fb1284ab31c522af080a0fa3c4575f4832b75b3cad50f188eb0f9e1bbf2981e