asyncrat | 43138adeff58347b55fbb2d28d7ff2b5a240767ddbd15cb6c0e1f9e0bf72a2ec

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AsyncClient.exe
Size

66KB
MD5

63ea16bb999507c430e7133950d157d7
SHA1

e20dcfcf0c92a64a86bc48902c77d871aad52e15
SHA256

43138adeff58347b55fbb2d28d7ff2b5a240767ddbd15cb6c0e1f9e0bf72a2ec
SHA512

07f39923f30e09dfffb8d4b0e2507cbef3424c34cf8fae51ead6318c792f74c82c710fec376eebb20ad8fddd0f0cc1ccee6acabb8f865bc3898263010e26f986
SSDEEP

1536:D2wukvF1ak9gcKu5UYF4jieQCk2bHM+9ga+22d9rmTGBx:D2dkvF1ak9Ku5UYF4jihN2bH7d+F9Eyx

Score

10^/10

asyncrat dcrat default evasion infostealer persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

asyncrat

Version

| Edit by Vinom Rat

Botnet

Default

saturday-surely.gl.at.ply.gg:30089

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/1856-118-0x00000000070F0000-0x0000000007112000-memory.dmp	disable_win_def

DcRat 41 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		1768	schtasks.exe
		3580	schtasks.exe
		1672	schtasks.exe
		1756	schtasks.exe
		2752	schtasks.exe
		2516	schtasks.exe
		832	schtasks.exe
		1084	schtasks.exe
		756	schtasks.exe
		4160	schtasks.exe
		4480	schtasks.exe
		2500	schtasks.exe
		4868	schtasks.exe
		4924	schtasks.exe
		3328	schtasks.exe
		864	schtasks.exe
		5072	schtasks.exe
		1528	schtasks.exe
		2004	schtasks.exe
		3840	schtasks.exe
		396	schtasks.exe
		5064	schtasks.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Software\Microsoft\SystemCertificates\CA		AsyncClient.exe
		3728	schtasks.exe
		1156	schtasks.exe
		2900	schtasks.exe
		1684	schtasks.exe
		1924	schtasks.exe
		116	schtasks.exe
		2480	schtasks.exe
		3528	schtasks.exe
		4144	schtasks.exe
		3916	schtasks.exe
File created	C:\Program Files (x86)\Windows Portable Devices\eddb19405b7ce1		Hypercommon.exe
		3664	schtasks.exe
		3144	schtasks.exe
		2840	schtasks.exe
		4120	schtasks.exe
		1872	schtasks.exe
		1964	schtasks.exe
		2316	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 13 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\backgroundTaskHost.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Program Files\\Windows Photo Viewer\\dwm.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Portable Devices\\TiWorker.exe\", \"C:\\Program Files\\WindowsPowerShell\\TextInputHost.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\WmiPrvSE.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Program Files\\Windows Photo Viewer\\dwm.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Portable Devices\\TiWorker.exe\", \"C:\\Program Files\\WindowsPowerShell\\TextInputHost.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\WmiPrvSE.exe\", \"C:\\Users\\Default User\\spoolsv.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Program Files\\Windows Photo Viewer\\dwm.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Program Files\\Windows Photo Viewer\\dwm.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\backgroundTaskHost.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Program Files\\Windows Photo Viewer\\dwm.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Program Files\\Windows Photo Viewer\\dwm.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Portable Devices\\TiWorker.exe\", \"C:\\Program Files\\WindowsPowerShell\\TextInputHost.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Program Files\\Windows Photo Viewer\\dwm.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Portable Devices\\TiWorker.exe\", \"C:\\Program Files\\WindowsPowerShell\\TextInputHost.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\WmiPrvSE.exe\", \"C:\\Users\\Default User\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\sppsvc.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\dllhost.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Program Files\\Windows Photo Viewer\\dwm.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Portable Devices\\TiWorker.exe\", \"C:\\Program Files\\WindowsPowerShell\\TextInputHost.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\WmiPrvSE.exe\", \"C:\\Users\\Default User\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\sppsvc.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Program Files\\Windows Photo Viewer\\dwm.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Portable Devices\\TiWorker.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Program Files\\Windows Photo Viewer\\dwm.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Portable Devices\\TiWorker.exe\", \"C:\\Program Files\\WindowsPowerShell\\TextInputHost.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\WmiPrvSE.exe\", \"C:\\Users\\Default User\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Program Files\\Windows Photo Viewer\\dwm.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Portable Devices\\TiWorker.exe\", \"C:\\Program Files\\WindowsPowerShell\\TextInputHost.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\WmiPrvSE.exe\", \"C:\\Users\\Default User\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\sppsvc.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\""	Hypercommon.exe

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	1580	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	1580	schtasks.exe	88

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Hypercommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Hypercommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Hypercommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000700000002342d-19.dat	dcrat
behavioral2/files/0x0007000000023431-34.dat	dcrat
behavioral2/memory/1420-35-0x0000000000FF0000-0x0000000001160000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 18 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	Hypercommon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	AsyncClient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	hovtpw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe

Executes dropped EXE 18 IoCs

pid	Process
4396	hovtpw.exe
1420	Hypercommon.exe
4396	backgroundTaskHost.exe
400	backgroundTaskHost.exe
1336	backgroundTaskHost.exe
456	backgroundTaskHost.exe
4508	backgroundTaskHost.exe
2696	backgroundTaskHost.exe
3104	backgroundTaskHost.exe
1336	backgroundTaskHost.exe
536	backgroundTaskHost.exe
3660	Getscreen.exe
1536	Getscreen.exe
744	Getscreen.exe
1516	Getscreen.exe
3812	backgroundTaskHost.exe
1132	backgroundTaskHost.exe
4836	backgroundTaskHost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023386-190.dat	upx
behavioral2/memory/3660-194-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp	upx
behavioral2/memory/1536-196-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp	upx
behavioral2/memory/744-205-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp	upx
behavioral2/memory/744-204-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp	upx
behavioral2/memory/1516-248-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp	upx
behavioral2/memory/3660-249-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp	upx
behavioral2/memory/1536-250-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp	upx
behavioral2/memory/3660-263-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp	upx
behavioral2/memory/1536-264-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp	upx
behavioral2/memory/3660-275-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp	upx

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Java\\jre-1.8\\lib\\WmiPrvSE.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\sppsvc.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\sppsvc.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files\\WindowsPowerShell\\TextInputHost.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\VideoLAN\\VLC\\dllhost.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\Windows Portable Devices\\backgroundTaskHost.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Default User\\spoolsv.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\VideoLAN\\VLC\\dllhost.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\Windows Portable Devices\\backgroundTaskHost.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files\\WindowsPowerShell\\TextInputHost.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Java\\jre-1.8\\lib\\WmiPrvSE.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Windows Photo Viewer\\dwm.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Windows Photo Viewer\\dwm.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TiWorker = "\"C:\\Program Files\\Windows Portable Devices\\TiWorker.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\backgroundTaskHost.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\backgroundTaskHost.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TiWorker = "\"C:\\Program Files\\Windows Portable Devices\\TiWorker.exe\""	Hypercommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Default User\\spoolsv.exe\""	Hypercommon.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Hypercommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Hypercommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	backgroundTaskHost.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsPowerShell\22eafd247d37c3	Hypercommon.exe
File created	C:\Program Files\Java\jre-1.8\lib\24dbde2999530e	Hypercommon.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\0a1fd5f707cd16	Hypercommon.exe
File created	C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe	Hypercommon.exe
File created	C:\Program Files\Windows Multimedia Platform\9e8d7a4ca61bd9	Hypercommon.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe	Hypercommon.exe
File created	C:\Program Files\Windows Portable Devices\cd89ddd3d81b06	Hypercommon.exe
File created	C:\Program Files\WindowsPowerShell\TextInputHost.exe	Hypercommon.exe
File created	C:\Program Files (x86)\Windows Portable Devices\ee2ad38f3d4382	Hypercommon.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\eddb19405b7ce1	Hypercommon.exe
File created	C:\Program Files\Java\jre-1.8\lib\WmiPrvSE.exe	Hypercommon.exe
File created	C:\Program Files\Windows Photo Viewer\dwm.exe	Hypercommon.exe
File created	C:\Program Files\Windows Portable Devices\TiWorker.exe	Hypercommon.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\sppsvc.exe	Hypercommon.exe
File created	C:\Program Files\VideoLAN\VLC\5940a34987c991	Hypercommon.exe
File created	C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe	Hypercommon.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe	Hypercommon.exe
File created	C:\Program Files (x86)\Windows Portable Devices\eddb19405b7ce1	Hypercommon.exe
File created	C:\Program Files (x86)\Windows Portable Devices\Registry.exe	Hypercommon.exe
File created	C:\Program Files\Windows Photo Viewer\6cb0b6c459d5d3	Hypercommon.exe
File created	C:\Program Files\VideoLAN\VLC\dllhost.exe	Hypercommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
4376	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Getscreen.exe = "11001"	Getscreen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Getscreen.exe = "11001"	Getscreen.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	hovtpw.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	backgroundTaskHost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1156	schtasks.exe
4868	schtasks.exe
3664	schtasks.exe
3728	schtasks.exe
864	schtasks.exe
1684	schtasks.exe
116	schtasks.exe
1872	schtasks.exe
3328	schtasks.exe
756	schtasks.exe
1964	schtasks.exe
2480	schtasks.exe
1672	schtasks.exe
2316	schtasks.exe
4480	schtasks.exe
2004	schtasks.exe
1084	schtasks.exe
4924	schtasks.exe
2840	schtasks.exe
1528	schtasks.exe
2752	schtasks.exe
3144	schtasks.exe
1768	schtasks.exe
3580	schtasks.exe
1924	schtasks.exe
4120	schtasks.exe
3916	schtasks.exe
3840	schtasks.exe
396	schtasks.exe
2900	schtasks.exe
2516	schtasks.exe
5064	schtasks.exe
4144	schtasks.exe
5072	schtasks.exe
2500	schtasks.exe
3528	schtasks.exe
832	schtasks.exe
4160	schtasks.exe
1756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1856	AsyncClient.exe
1856	AsyncClient.exe
1420	Hypercommon.exe
4396	backgroundTaskHost.exe
1856	AsyncClient.exe
1856	AsyncClient.exe
1856	AsyncClient.exe
1856	AsyncClient.exe
400	backgroundTaskHost.exe
1336	backgroundTaskHost.exe
456	backgroundTaskHost.exe
4508	backgroundTaskHost.exe
2696	backgroundTaskHost.exe
3104	backgroundTaskHost.exe
1336	backgroundTaskHost.exe
536	backgroundTaskHost.exe
1856	AsyncClient.exe
1856	AsyncClient.exe
4800	powershell.exe
4800	powershell.exe
1516	Getscreen.exe
1516	Getscreen.exe
4800	powershell.exe
3812	backgroundTaskHost.exe
3812	backgroundTaskHost.exe
4800	powershell.exe
1132	backgroundTaskHost.exe
1132	backgroundTaskHost.exe
4836	backgroundTaskHost.exe
4836	backgroundTaskHost.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	AsyncClient.exe
Token: SeDebugPrivilege	1420	Hypercommon.exe
Token: SeDebugPrivilege	4396	backgroundTaskHost.exe
Token: SeDebugPrivilege	400	backgroundTaskHost.exe
Token: SeDebugPrivilege	1336	backgroundTaskHost.exe
Token: SeDebugPrivilege	456	backgroundTaskHost.exe
Token: SeDebugPrivilege	4508	backgroundTaskHost.exe
Token: SeDebugPrivilege	2696	backgroundTaskHost.exe
Token: SeDebugPrivilege	3104	backgroundTaskHost.exe
Token: SeDebugPrivilege	1336	backgroundTaskHost.exe
Token: SeDebugPrivilege	536	backgroundTaskHost.exe
Token: SeDebugPrivilege	4376	taskkill.exe
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeIncBasePriorityPrivilege	3660	Getscreen.exe
Token: SeDebugPrivilege	3812	backgroundTaskHost.exe
Token: SeDebugPrivilege	1132	backgroundTaskHost.exe
Token: SeDebugPrivilege	4836	backgroundTaskHost.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1536	Getscreen.exe
1536	Getscreen.exe
1536	Getscreen.exe
1536	Getscreen.exe
1536	Getscreen.exe
1536	Getscreen.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1536	Getscreen.exe
1536	Getscreen.exe
1536	Getscreen.exe
1536	Getscreen.exe
1536	Getscreen.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1856	AsyncClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 4396	1856	AsyncClient.exe	96
PID 1856 wrote to memory of 4396	1856	AsyncClient.exe	96
PID 1856 wrote to memory of 4396	1856	AsyncClient.exe	96
PID 4396 wrote to memory of 2648	4396	hovtpw.exe	97
PID 4396 wrote to memory of 2648	4396	hovtpw.exe	97
PID 4396 wrote to memory of 2648	4396	hovtpw.exe	97
PID 2648 wrote to memory of 4492	2648	WScript.exe	99
PID 2648 wrote to memory of 4492	2648	WScript.exe	99
PID 2648 wrote to memory of 4492	2648	WScript.exe	99
PID 4492 wrote to memory of 1420	4492	cmd.exe	101
PID 4492 wrote to memory of 1420	4492	cmd.exe	101
PID 1420 wrote to memory of 4396	1420	Hypercommon.exe	142
PID 1420 wrote to memory of 4396	1420	Hypercommon.exe	142
PID 4396 wrote to memory of 1832	4396	backgroundTaskHost.exe	143
PID 4396 wrote to memory of 1832	4396	backgroundTaskHost.exe	143
PID 4396 wrote to memory of 4316	4396	backgroundTaskHost.exe	144
PID 4396 wrote to memory of 4316	4396	backgroundTaskHost.exe	144
PID 1856 wrote to memory of 1944	1856	AsyncClient.exe	145
PID 1856 wrote to memory of 1944	1856	AsyncClient.exe	145
PID 1856 wrote to memory of 1944	1856	AsyncClient.exe	145
PID 1832 wrote to memory of 400	1832	WScript.exe	147
PID 1832 wrote to memory of 400	1832	WScript.exe	147
PID 400 wrote to memory of 4584	400	backgroundTaskHost.exe	148
PID 400 wrote to memory of 4584	400	backgroundTaskHost.exe	148
PID 400 wrote to memory of 3648	400	backgroundTaskHost.exe	149
PID 400 wrote to memory of 3648	400	backgroundTaskHost.exe	149
PID 4584 wrote to memory of 1336	4584	WScript.exe	150
PID 4584 wrote to memory of 1336	4584	WScript.exe	150
PID 1336 wrote to memory of 3528	1336	backgroundTaskHost.exe	151
PID 1336 wrote to memory of 3528	1336	backgroundTaskHost.exe	151
PID 1336 wrote to memory of 832	1336	backgroundTaskHost.exe	152
PID 1336 wrote to memory of 832	1336	backgroundTaskHost.exe	152
PID 3528 wrote to memory of 456	3528	WScript.exe	153
PID 3528 wrote to memory of 456	3528	WScript.exe	153
PID 456 wrote to memory of 4384	456	backgroundTaskHost.exe	155
PID 456 wrote to memory of 4384	456	backgroundTaskHost.exe	155
PID 456 wrote to memory of 1436	456	backgroundTaskHost.exe	156
PID 456 wrote to memory of 1436	456	backgroundTaskHost.exe	156
PID 4384 wrote to memory of 4508	4384	WScript.exe	157
PID 4384 wrote to memory of 4508	4384	WScript.exe	157
PID 4508 wrote to memory of 4056	4508	backgroundTaskHost.exe	158
PID 4508 wrote to memory of 4056	4508	backgroundTaskHost.exe	158
PID 4508 wrote to memory of 2852	4508	backgroundTaskHost.exe	159
PID 4508 wrote to memory of 2852	4508	backgroundTaskHost.exe	159
PID 4056 wrote to memory of 2696	4056	WScript.exe	160
PID 4056 wrote to memory of 2696	4056	WScript.exe	160
PID 2696 wrote to memory of 2308	2696	backgroundTaskHost.exe	161
PID 2696 wrote to memory of 2308	2696	backgroundTaskHost.exe	161
PID 2696 wrote to memory of 5064	2696	backgroundTaskHost.exe	162
PID 2696 wrote to memory of 5064	2696	backgroundTaskHost.exe	162
PID 2308 wrote to memory of 3104	2308	WScript.exe	163
PID 2308 wrote to memory of 3104	2308	WScript.exe	163
PID 3104 wrote to memory of 3824	3104	backgroundTaskHost.exe	164
PID 3104 wrote to memory of 3824	3104	backgroundTaskHost.exe	164
PID 3104 wrote to memory of 3532	3104	backgroundTaskHost.exe	165
PID 3104 wrote to memory of 3532	3104	backgroundTaskHost.exe	165
PID 3824 wrote to memory of 1336	3824	WScript.exe	167
PID 3824 wrote to memory of 1336	3824	WScript.exe	167
PID 1336 wrote to memory of 1896	1336	backgroundTaskHost.exe	168
PID 1336 wrote to memory of 1896	1336	backgroundTaskHost.exe	168
PID 1336 wrote to memory of 448	1336	backgroundTaskHost.exe	169
PID 1336 wrote to memory of 448	1336	backgroundTaskHost.exe	169
PID 1896 wrote to memory of 536	1896	WScript.exe	177
PID 1896 wrote to memory of 536	1896	WScript.exe	177

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Hypercommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Hypercommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Hypercommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	backgroundTaskHost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe
"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"
1⤵
- DcRat
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\hovtpw.exe
  "C:\Users\Admin\AppData\Local\Temp\hovtpw.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\portwebdll\fn8HNHVgHWFLApRQ1mH.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\portwebdll\CedH0gOYji0h1dJ.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\Users\Admin\AppData\Roaming\portwebdll\Hypercommon.exe
        
        "C:\Users\Admin\AppData\Roaming\portwebdll\Hypercommon.exe"
        5⤵
        DcRat
        Modifies WinLogon for persistence
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1420
      - C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4396
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8af6d6f1-f9ca-4dbf-a609-98d144ed2edc.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe"
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:400
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\14e1f8dd-97cb-4f6a-9b71-deeb13a58c21.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe"
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1336
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\edc6687f-f2bc-43de-a6e1-04931072f044.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe"
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:456
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4461f3b3-6d28-4382-8003-1fcb2a86aca2.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe"
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d8932713-d21c-4794-8320-c78bcc57e234.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe"
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cbd1382d-f99f-4f08-b4af-05652643d859.vbs"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:2308
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe"
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3104
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5164f896-c7fd-4c21-989e-894822c92a23.vbs"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:3824
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe"
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1336
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8672ee9d-a884-4a9d-9357-ab783d420963.vbs"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe"
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:536
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d20064b3-254e-4656-8dee-0533aac2bc27.vbs"
        23⤵
        
        PID:1804
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe"
        24⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3812
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\49516b22-2d31-4ca6-9ad0-fdaadfa4c08f.vbs"
        25⤵
        
        PID:2220
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe"
        26⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1132
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b75fa26b-52f3-41d0-9c23-63aa48b10c28.vbs"
        27⤵
        
        PID:1976
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe"
        28⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\24efefe8-b486-4514-be8c-cf87eefd0ffe.vbs"
        29⤵
        
        PID:3840
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bbdc79a6-34c7-45d4-bf5b-1e085d93bdea.vbs"
        29⤵
        
        PID:4488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce276b3b-d015-42e9-b9b9-8cd94ca04a63.vbs"
        27⤵
        
        PID:1672
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02e8bfd6-524a-4da8-9b30-93de92ee23da.vbs"
        25⤵
        
        PID:2872
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cd7bae4f-2cbb-47c6-bc4b-18789a6598d4.vbs"
        23⤵
        
        PID:2828
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91da0304-79b1-4a4f-8b66-61296f12c575.vbs"
        21⤵
        
        PID:448
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3fd549e5-a621-47fa-a15e-c1f4296a7b7e.vbs"
        19⤵
        
        PID:3532
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\50a437f6-7bf5-4c79-a2e7-4140a5b874ca.vbs"
        17⤵
        
        PID:5064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\590c719a-0822-4eaa-8462-4b9e480ce3d5.vbs"
        15⤵
        
        PID:2852
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e7d3cac1-6002-42f5-8054-09b57ada8e59.vbs"
        13⤵
        
        PID:1436
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f2bb39b-3027-4232-abf5-bcda0f046a58.vbs"
        11⤵
        
        PID:832
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d81f75b7-9b0b-4a0a-b900-a2c1a49e9b64.vbs"
        9⤵
        
        PID:3648
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a2c4dd2-3fec-41e6-b803-627c7f7bab31.vbs"
        7⤵
        
        PID:4316
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1944
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /im cmstp.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4376
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\system32\cmstp.exe" /au C:\Windows\temp\5iu40kon.inf
  2⤵
  PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TiWorkerT" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\TiWorker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TiWorker" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\TiWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TiWorkerT" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\TiWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\TextInputHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files\Java\jre-1.8\lib\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\lib\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jre-1.8\lib\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\VideoLAN\VLC\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
PID:4780
- C:\Windows\SysWOW64\mshta.exe
  mshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""C:\ProgramData\Getscreen.exe"":close")
  2⤵
  - Checks computer location settings
  PID:1292
- - C:\ProgramData\Getscreen.exe
    "C:\ProgramData\Getscreen.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3660
  - - C:\ProgramData\Getscreen.exe
      "C:\ProgramData\Getscreen.exe" -gpipe \\.\pipe\PCommand97Getscreen.me -gui
      4⤵
      Executes dropped EXE
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1536
  - - C:\ProgramData\Getscreen.exe
      "C:\ProgramData\Getscreen.exe" -cpipe \\.\pipe\PCommand96Getscreen.me -child
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1516
- C:\Windows\SysWOW64\mshta.exe
  mshta vbscript:Execute("CreateObject(ChrW(87) + ChrW(83) + ChrW(99) + ChrW(114) + ChrW(105) + ChrW(112) + ChrW(116) + ChrW(46) + ChrW(83) + ChrW(104) + ChrW(101) + ChrW(108) + ChrW(108)).Run ""powershell.exe Stop-Process -Name 'cmstp'"", 0, true:close")
  2⤵
  - Checks computer location settings
  PID:4588
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Stop-Process -Name 'cmstp'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4800

C:\ProgramData\Getscreen.exe
"C:\ProgramData\Getscreen.exe" -elevate \\.\pipe\elevateGS512zgrdhgy
1⤵
- Executes dropped EXE
PID:744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Getscreen.exe

Filesize
4.9MB

MD5
c062dc70bff732dc20a897cebb008b87

SHA1
74c0adcc331615fd53dedb96d0ca31c797dc2378

SHA256
26ef17585f22d4c7c9862106dca31e3a5a0d95c129cb720ef03d62f9c3657a50

SHA512
7f4d7f20c90cf99c3a29d5ca631fa07ee54cc2ca7d9669756ec0e18fe07291504c2b5172d417ace64897768fef4f2fca09d40475cd750eeee05e126bc886ef72

Download Submit
C:\ProgramData\Getscreen.me\logs\20240723.log

Filesize
424B

MD5
530162f3e32bcbcb92237f56ff91097b

SHA1
9667059650d2c2e16b7b35349e0fa19055a352e5

SHA256
bd9dc84a2a873be71ae236480d6ff89767a85e4a1b1eafa688623202ce83e206

SHA512
2d5d899272e9001143881c1d1390e17d3e62dce2e51c1f878b3bb7f1510ba1dc041b135172708c04086d6553ce758719553086129ca1688441507acef7a5edb7

Download Submit
C:\ProgramData\Getscreen.me\logs\20240723.log

Filesize
1015B

MD5
f63d0a0a9f4593a053bca2931b116c62

SHA1
2191443c5ef656ce5ee7372f8ed38d631539d1bb

SHA256
e49010424338daa07747ad0994e97e1f2291594dd4c7d3cf687d710f75e145ad

SHA512
67c55973b25de6628512d07341cc1c2398075a8f0b5bc88744872a7d32a2c1e22284803a74734a7f655561fc87bc1f39df9aa410bcc12b669cdf056927a17896

Download Submit
C:\ProgramData\Getscreen.me\logs\20240723.log

Filesize
1KB

MD5
7dabd40835be155860832729cbb2c5ad

SHA1
48891fc071d3d8ca95724cf6f6109007db2afbd6

SHA256
ea6de481a6a2e748dbd62e4dd2b4e49808d57b5ca8b0f6bd50a57d559ede0dc6

SHA512
ade93922b7a09731e1452f0d04b6a7c6aa83d2d1c48c4383db36b0d519e192ee6388b0473acb03ebccdfae66be1545e028fa8c67f0f4e03fbec0859b71169edf

Download Submit
C:\ProgramData\Getscreen.me\memory\0000pipe0PCommand96Getscreen0me

Filesize
16.0MB

MD5
4b1b4e345cc5f2c368f3ac861ef9cf78

SHA1
59a6c0a73cb6e95ab5ff8575cb5777ee7945dd0c

SHA256
ae8286341fde8f581c76ee67718d602efcc5d94de663d2054f9dca1a6195e987

SHA512
2dd27dc84c14f7d88bee7494900a68149d6d7de1db768d92e6fc69263646f0e7a22dddb36aadb35d4176fa284b16d293356a0403e87b758e13b859a6368edc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\backgroundTaskHost.exe.log

Filesize
1KB

MD5
9b0256da3bf9a5303141361b3da59823

SHA1
d73f34951777136c444eb2c98394f62912ebcdac

SHA256
96cbc3f4e49d7ae13cd46e36ebb4819b6db1eabe5db910902638c1a24947208e

SHA512
9f014fef4b1bb71dbdd1d0bad11bd20437a9801eaa830ab386f901f6b5be374a26f68161d7638ea03483028e9a56bf97023cc24b45356a9c76cb755a53d9c164

Download Submit
C:\Users\Admin\AppData\Local\Temp\14e1f8dd-97cb-4f6a-9b71-deeb13a58c21.vbs

Filesize
771B

MD5
ae5c260e68a3780650820fcd3e8bc52f

SHA1
3aecac11f526f1872f89dc61f8c4248d8c3887b0

SHA256
77eed194856ca4695c8702f7ee8ce029afb0adbc652ff18eae124a61e1998664

SHA512
937efa488a1f05a7a0934f99279fda6da547b702ba304f79c703c515184a9cbb31ef411a2bfd88e8451901c65a2b0c069d8f6f08e751b7f7ea2d24ab5410c96c

Download Submit
C:\Users\Admin\AppData\Local\Temp\24efefe8-b486-4514-be8c-cf87eefd0ffe.vbs

Filesize
772B

MD5
eb0d08ae238c70e8faf1792e31b3e0f0

SHA1
923e20cb4e32e2aa6038174f9c28a9003280ac23

SHA256
a0cebbb097a2bd7809209f15828282e3d6060fe545e4938fdd91172c05d32302

SHA512
bba932907bc87b68381407c1ea8fb979a45195d8cb2a87bf9b70243f25bb2c8b79b8a473f443bfd3f91492fb6e8e85261e6626834a25c7d037f5e9da6aaca6d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\4461f3b3-6d28-4382-8003-1fcb2a86aca2.vbs

Filesize
771B

MD5
38629e29206c5bdf7d9b9567d7459a90

SHA1
46134ec4257188bd18535fd4bead01a4dbec6c08

SHA256
8fce4c76eb42345474399f204898fbeaef46b2cc533a23ab441b3aa82313667c

SHA512
38ce0423f163283e8c3b2c52a1dcc5c47439250abc934adeee0b399f85c40e907db30025addbeb5edad95dd312b989e9adf69bcec25e7aa6208593cd1a406c05

Download Submit
C:\Users\Admin\AppData\Local\Temp\49516b22-2d31-4ca6-9ad0-fdaadfa4c08f.vbs

Filesize
772B

MD5
180c21b48e78014e95fb7d9806e0bca7

SHA1
f5ab0214081fb27894dd10c182c3ef3c716a0888

SHA256
1748bb0642b70641ca37903ccad50580999d37c4efe0dffa72644ffb20a563fc

SHA512
4001abd8f3d5d7a1b82e89ad1fb41afc08de10b021e827afa95597d1d9d162d0125a5782126499394b2164232ebb46d665c7a97e6a87fc694dbcbcbe2e815c38

Download Submit
C:\Users\Admin\AppData\Local\Temp\5164f896-c7fd-4c21-989e-894822c92a23.vbs

Filesize
772B

MD5
98af5a3d746dff3c8dce0380252fa5a7

SHA1
972a2e87984aaeea068aac45c1a22c5c24b0803d

SHA256
61bc139e5091860ca5eb5c3dc1782de042ee72b3b9ef7313d24822222215c6e0

SHA512
6e670e109774421b2e15164ebc3d50ddc0c9737aee90b16b630dca85365171a6b4ef324343084c3e2063e98a734a11b7448f89296977dedfd88d4a4d28936fa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7a2c4dd2-3fec-41e6-b803-627c7f7bab31.vbs

Filesize
548B

MD5
4d37681a2eb712b037c5cc13868962e8

SHA1
ad323cc1e1d325015fb48aa9c63c7e5222fc5f6f

SHA256
39f56be7b00f2ee167e012350e558b745f739480cd2f7db1cd4a6a78b5083a3f

SHA512
84b586789502a93122b2e07d1594bb74bb6f7291bad36c7bfa535ee594f88c7866b81322b35f4bca6bb6ab87a3a3f1938734040966c0b235d68fc082d2dae3f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\8af6d6f1-f9ca-4dbf-a609-98d144ed2edc.vbs

Filesize
772B

MD5
9fb74fb2a458a36dd977241d404f0d5f

SHA1
e15eec37e08ce76baf459ba45ac70033c3df901f

SHA256
cc92109fe2998948cdcd6358227080911620eb7f41c9b9908b5d50aebd944fa4

SHA512
9d59dffc24311e669660b9edd1bcaaa0587d84481b47313f4cf305ec1261d349bfbdda62c86c8b637b2609111de5eaa92654046e3e0d9349d81e8ec1c29f4738

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eqdjcp2x.o00.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b75fa26b-52f3-41d0-9c23-63aa48b10c28.vbs

Filesize
772B

MD5
ca4edc37211c68e51c2cc8ebaa3f86a9

SHA1
e8e9a0576d3836bd4aa7ebaa89fbd5d6960021c6

SHA256
4b09a39ee1b3fdc6008e60aadea4e75c9f98e2898046bf68f319ca680233a0ed

SHA512
a97e1aafdd9e74035d993f99923b938d4673affff2fb43e3d89536daab915149fddf4e1a071dd22e2ad688e0bce59f65a6c7654151ef335c463fea53821e7cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\cbd1382d-f99f-4f08-b4af-05652643d859.vbs

Filesize
772B

MD5
5d8a59058b4cecdfb64ec67c2158db13

SHA1
ba24589181db54b47a88f2e4940d673853471367

SHA256
528f5cc8d31e776bb95e8d849f7af056a653b68903a492acc7831623d0cd88f0

SHA512
89f7c1428bffc2ee7f9c2373f766f8cab669a9972f717a2a89f7f24bd3477769e9366adaaa5ed8cabd5a1719c49896578532d5739ef281af7e6bd95c5976265b

Download Submit
C:\Users\Admin\AppData\Local\Temp\d20064b3-254e-4656-8dee-0533aac2bc27.vbs

Filesize
771B

MD5
7f11ffeefc2a9f84848222f606948290

SHA1
3b7fd74cbb705e1ee3e4638bef096afb9082c7a0

SHA256
c4f68d0c1c7000e9cc7f6745f1b39f0ab7ebb391662e6cdce147bbfc1f2a285b

SHA512
19c3e51dcaf0f0d16d3ba328fbc4cec1aacdfefa520f91046d8e503156f196c2282ed5428b5b122c21df4df9679425ac076fc13a1a75dfcc582f16f53176def3

Download Submit
C:\Users\Admin\AppData\Local\Temp\d8932713-d21c-4794-8320-c78bcc57e234.vbs

Filesize
772B

MD5
92789aad6190d52d7ded87a3c58a16e4

SHA1
3b90fb743351980de2dc4bfe9752bfa67305d09f

SHA256
31ad2ab974f4775e51158722783a78891a586d8f4d910364389770e7c69f2ab7

SHA512
de5bd20a29fdcbcce122adc4ce7a301c7c6b5fede46f0e9a52c4bfa48c5cb8669db51883edc8b97d76644ccdc94700d0f86beb37c2bc3aea1ac9e290c799cf40

Download Submit
C:\Users\Admin\AppData\Local\Temp\edc6687f-f2bc-43de-a6e1-04931072f044.vbs

Filesize
772B

MD5
c414c16115e3288089e737f508955387

SHA1
53409771eccf217df6a7d7fb00e33f9c9b592f6b

SHA256
bb86f2dd119a51a66b259235d01c5d6c51e35ceb83515ee5fefacaefda3d6667

SHA512
76e92959969c81c6a2d5b438c455a883d6a29dc7c06a0920ed7adba49d23721d929ea4530ec7c98c966d8f403b36a07d0971678d90303379cf80685f8120545e

Download Submit
C:\Users\Admin\AppData\Local\Temp\hovtpw.exe

Filesize
1.9MB

MD5
9c49f8ab036331a19ab63f9aff82db38

SHA1
a27f11d48f1428b8efb5384f779f355271cc8877

SHA256
c50ff535a4d6f888019f7865b319658fc35fd9c3ce5734308821641407d91df9

SHA512
2a61a2bf0bfff8c84f2ba5065b87563edd36b4a8ab34e2354f01e46a9ab7d19677cda9b686f95598921de7c2480da53a5e76965f01733e875033208adf9bfecd

Download Submit
C:\Users\Admin\AppData\Roaming\portwebdll\CedH0gOYji0h1dJ.bat

Filesize
38B

MD5
6c77726beb17fe13c44cbc3312d1ca54

SHA1
919076735be5e1c6c9d077b12beadce4470c7bb2

SHA256
e8130ea9479e696b38d37edbd700f6f08daf4c85c1758d6b6a9a71e627ce5e03

SHA512
5089be432cd1f996f399f4aa03140a7bdb8062304fbf4818351f93090deaa1f2e42fe034307ce542ca5ad7f7484948e7e454b4cfee885815ce402436e573d9c4

Download Submit
C:\Users\Admin\AppData\Roaming\portwebdll\Hypercommon.exe

Filesize
1.4MB

MD5
f1ca585436d62720be1c8d7f24fb773f

SHA1
3687e578f150e45aa5194f9c485b221459f0f454

SHA256
dc22e22564f7758fd8179f22aace45dfb9a5fbedcf7203ee71a71bf26435cbc7

SHA512
9e56f51802b8de96589dfd51da94c466c70fd320e05a4a574054fac41ffcf5acba2fcbc29f3a655c152560dc13a45cb4f13366ab2db975b3aa7371a041fdaddc

Download Submit
C:\Users\Admin\AppData\Roaming\portwebdll\fn8HNHVgHWFLApRQ1mH.vbe

Filesize
209B

MD5
2febca5513bbb1d2fb14b29bd4998314

SHA1
5fbcf3720fa6200f4dfd67e2d3ec4d91e45b9def

SHA256
d92d5826088b6d9e94de6ef772d9283594ee4c51ca03e829c7024b4dd2f74112

SHA512
60a6ef94ea1d5c379c330e5c2627a34d33c5d1ed85e03fb01d561aa3ded0cad26f5ff9ef682ad83abc234a9aede970dd902e508556524c135ff3661e60b27e1c

Download Submit
C:\Windows\temp\5iu40kon.inf

Filesize
12KB

MD5
5f43e657d0898672ad25bc085ad29725

SHA1
0438646f3c8e8243da282614b54f85741d720f27

SHA256
d2ff9bf64b5a303063b4246b31bbc82a0f9e6b01d8456ebcdbd399f694118a2a

SHA512
902bf5c2adabf1d1b6b97c1aa8bc54326248aa4ed64a033cfec82552d68b25e6a4384793fa01026ed892934fbb947ada59eec700f7bbc77fa98cc0bcb6da04b7

Download Submit
memory/744-205-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp

Filesize
28.0MB

Download
memory/744-204-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp

Filesize
28.0MB

Download
memory/1420-36-0x0000000003380000-0x000000000338E000-memory.dmp

Filesize
56KB

Download
memory/1420-41-0x000000001BD90000-0x000000001BD98000-memory.dmp

Filesize
32KB

Download
memory/1420-46-0x000000001C380000-0x000000001C38A000-memory.dmp

Filesize
40KB

Download
memory/1420-44-0x000000001C310000-0x000000001C31A000-memory.dmp

Filesize
40KB

Download
memory/1420-43-0x000000001C300000-0x000000001C310000-memory.dmp

Filesize
64KB

Download
memory/1420-45-0x000000001C370000-0x000000001C37C000-memory.dmp

Filesize
48KB

Download
memory/1420-42-0x000000001C2F0000-0x000000001C2F8000-memory.dmp

Filesize
32KB

Download
memory/1420-35-0x0000000000FF0000-0x0000000001160000-memory.dmp

Filesize
1.4MB

Download
memory/1420-40-0x000000001C2D0000-0x000000001C2E6000-memory.dmp

Filesize
88KB

Download
memory/1420-37-0x000000001C2B0000-0x000000001C2CC000-memory.dmp

Filesize
112KB

Download
memory/1420-39-0x0000000003390000-0x0000000003398000-memory.dmp

Filesize
32KB

Download
memory/1420-38-0x000000001C320000-0x000000001C370000-memory.dmp

Filesize
320KB

Download
memory/1516-248-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp

Filesize
28.0MB

Download
memory/1536-250-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp

Filesize
28.0MB

Download
memory/1536-196-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp

Filesize
28.0MB

Download
memory/1536-264-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp

Filesize
28.0MB

Download
memory/1856-10-0x0000000074BCE000-0x0000000074BCF000-memory.dmp

Filesize
4KB

Download
memory/1856-4-0x0000000005200000-0x000000000529C000-memory.dmp

Filesize
624KB

Download
memory/1856-13-0x0000000006C80000-0x0000000006CA2000-memory.dmp

Filesize
136KB

Download
memory/1856-1-0x00000000003C0000-0x00000000003D6000-memory.dmp

Filesize
88KB

Download
memory/1856-12-0x0000000006D00000-0x0000000006D76000-memory.dmp

Filesize
472KB

Download
memory/1856-14-0x0000000006D80000-0x0000000006D9E000-memory.dmp

Filesize
120KB

Download
memory/1856-11-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/1856-185-0x00000000084D0000-0x00000000089C6000-memory.dmp

Filesize
5.0MB

Download
memory/1856-7-0x0000000005690000-0x000000000569A000-memory.dmp

Filesize
40KB

Download
memory/1856-93-0x0000000006E00000-0x0000000006E42000-memory.dmp

Filesize
264KB

Download
memory/1856-2-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/1856-118-0x00000000070F0000-0x0000000007112000-memory.dmp

Filesize
136KB

Download
memory/1856-0-0x0000000074BCE000-0x0000000074BCF000-memory.dmp

Filesize
4KB

Download
memory/1856-6-0x00000000056A0000-0x0000000005732000-memory.dmp

Filesize
584KB

Download
memory/1856-5-0x0000000005A50000-0x0000000005FF4000-memory.dmp

Filesize
5.6MB

Download
memory/1856-189-0x00000000027D0000-0x00000000027F4000-memory.dmp

Filesize
144KB

Download
memory/1856-3-0x0000000004DB0000-0x0000000004E16000-memory.dmp

Filesize
408KB

Download
memory/3660-249-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp

Filesize
28.0MB

Download
memory/3660-275-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp

Filesize
28.0MB

Download
memory/3660-194-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp

Filesize
28.0MB

Download
memory/3660-263-0x00007FF7AF380000-0x00007FF7B0F8A000-memory.dmp

Filesize
28.0MB

Download
memory/4800-208-0x0000000005F00000-0x0000000005F22000-memory.dmp

Filesize
136KB

Download
memory/4800-220-0x0000000006180000-0x00000000064D4000-memory.dmp

Filesize
3.3MB

Download
memory/4800-223-0x0000000006770000-0x000000000678E000-memory.dmp

Filesize
120KB

Download
memory/4800-230-0x0000000007750000-0x00000000077E6000-memory.dmp

Filesize
600KB

Download
memory/4800-209-0x0000000005FA0000-0x0000000006006000-memory.dmp

Filesize
408KB

Download
memory/4800-207-0x00000000058A0000-0x0000000005EC8000-memory.dmp

Filesize
6.2MB

Download
memory/4800-231-0x0000000006C70000-0x0000000006C8A000-memory.dmp

Filesize
104KB

Download
memory/4800-206-0x0000000002E80000-0x0000000002EB6000-memory.dmp

Filesize
216KB

Download
memory/4800-232-0x0000000006CD0000-0x0000000006CF2000-memory.dmp

Filesize
136KB

Download
memory/4800-224-0x00000000067B0000-0x00000000067FC000-memory.dmp

Filesize
304KB

Download