Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
24/07/2024, 23:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
LisectAVT_2403002A_200.exe
Resource
win7-20240704-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
LisectAVT_2403002A_200.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
22 signatures
150 seconds
General
- Target LisectAVT_2403002A_200.exe
- Size 3.3MB
- Sample240724-3vn86axgla
- SHA256 aa2fa7c979e868047cf947370ae3f511068276c3c0eb1541301b9f6a3fa7abba
- MD5 ebf1db324a7e5a4f9dfc3e9731a8a301
- SHA1 6e95daa4f46b8b32320c9b3676119233aa72f21f
- SHA512 d9456fd19fef61e1557c089ff97e40b8295029fae5903871cd600370464b2a6c6042855771e15f8991b6a05208c64cf3aa654475cbf074578fc6661c3b65b96e
- SSDEEP 49152:o8xhCcpCNPulYCFckZHvEdM1jegx7oOCM1Gn72tESduILWMJd33eRkX2EuFgtDGg:NhrChV+cU/NeBPMY72tRR0EuUG
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- DcRat 52 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process 744 schtasks.exe 3788 schtasks.exe 3464 schtasks.exe 4560 schtasks.exe 3296 schtasks.exe 4288 schtasks.exe 2532 schtasks.exe 4048 schtasks.exe 2556 schtasks.exe 4780 schtasks.exe 4140 schtasks.exe 1740 schtasks.exe 1360 schtasks.exe 1616 schtasks.exe 4328 schtasks.exe 3328 schtasks.exe 3136 schtasks.exe 2168 schtasks.exe 3160 schtasks.exe 1812 schtasks.exe 2092 schtasks.exe 3472 schtasks.exe 3848 schtasks.exe 3120 schtasks.exe 3880 schtasks.exe 1392 schtasks.exe 3068 schtasks.exe 4292 schtasks.exe 3600 schtasks.exe 4348 schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LisectAVT_2403002A_200.exe 3368 schtasks.exe 4276 schtasks.exe 2152 schtasks.exe 636 schtasks.exe 1708 schtasks.exe 1732 schtasks.exe 2784 schtasks.exe 4372 schtasks.exe 4552 schtasks.exe 2684 schtasks.exe 3628 schtasks.exe 3360 schtasks.exe 404 schtasks.exe 2080 schtasks.exe 1844 schtasks.exe 2108 schtasks.exe 5080 schtasks.exe 3428 schtasks.exe 3256 schtasks.exe 4040 schtasks.exe 3192 schtasks.exe - Modifies WinLogon for persistence 2 TTPs 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\services.exe\", \"C:\\Windows\\Offline Web Pages\\unsecapp.exe\", \"C:\\Users\\Public\\AccountPictures\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\winlogon.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\services.exe\", \"C:\\Windows\\Offline Web Pages\\unsecapp.exe\", \"C:\\Users\\Public\\AccountPictures\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\winlogon.exe\", \"C:\\Users\\Default\\Links\\SearchApp.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\services.exe\", \"C:\\Windows\\Offline Web Pages\\unsecapp.exe\", \"C:\\Users\\Public\\AccountPictures\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\winlogon.exe\", \"C:\\Users\\Default\\Links\\SearchApp.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\Idle.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\services.exe\", \"C:\\Windows\\Offline Web Pages\\unsecapp.exe\", \"C:\\Users\\Public\\AccountPictures\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\services.exe\", \"C:\\Windows\\Offline Web Pages\\unsecapp.exe\", \"C:\\Users\\Public\\AccountPictures\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\winlogon.exe\", \"C:\\Users\\Default\\Links\\SearchApp.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\Idle.exe\", \"C:\\Windows\\Cursors\\StartMenuExperienceHost.exe\", \"C:\\Windows\\es-ES\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Registry.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\unsecapp.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\services.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\services.exe\", \"C:\\Windows\\Offline Web Pages\\unsecapp.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\services.exe\", \"C:\\Windows\\Offline Web Pages\\unsecapp.exe\", \"C:\\Users\\Public\\AccountPictures\\RuntimeBroker.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\services.exe\", \"C:\\Windows\\Offline Web Pages\\unsecapp.exe\", \"C:\\Users\\Public\\AccountPictures\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\winlogon.exe\", \"C:\\Users\\Default\\Links\\SearchApp.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\Idle.exe\", \"C:\\Windows\\Cursors\\StartMenuExperienceHost.exe\", \"C:\\Windows\\es-ES\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Registry.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\services.exe\", \"C:\\Windows\\Offline Web Pages\\unsecapp.exe\", \"C:\\Users\\Public\\AccountPictures\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\winlogon.exe\", \"C:\\Users\\Default\\Links\\SearchApp.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\Idle.exe\", \"C:\\Windows\\Cursors\\StartMenuExperienceHost.exe\", \"C:\\Windows\\es-ES\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Registry.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Windows\\it-IT\\smss.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\services.exe\", \"C:\\Windows\\Offline Web Pages\\unsecapp.exe\", \"C:\\Users\\Public\\AccountPictures\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\winlogon.exe\", \"C:\\Users\\Default\\Links\\SearchApp.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\Idle.exe\", \"C:\\Windows\\Cursors\\StartMenuExperienceHost.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\services.exe\", \"C:\\Windows\\Offline Web Pages\\unsecapp.exe\", \"C:\\Users\\Public\\AccountPictures\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\winlogon.exe\", \"C:\\Users\\Default\\Links\\SearchApp.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\Idle.exe\", \"C:\\Windows\\Cursors\\StartMenuExperienceHost.exe\", \"C:\\Windows\\es-ES\\RuntimeBroker.exe\"" LisectAVT_2403002A_200.exe - Process spawned unexpected child process 51 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1844 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3296 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4040 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1708 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2168 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2684 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 744 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1392 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3328 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2108 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1812 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3880 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4140 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3120 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3788 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3848 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3628 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4780 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3368 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1616 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1360 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2092 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4288 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4328 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4276 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1732 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2532 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3472 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2152 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3360 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 404 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3464 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2784 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3192 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5080 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4048 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4560 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2556 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3160 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3068 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3136 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 636 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2080 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4372 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1740 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4292 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4552 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3600 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3428 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3256 4956 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4348 4956 schtasks.exe 87 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" LisectAVT_2403002A_200.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" LisectAVT_2403002A_200.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" LisectAVT_2403002A_200.exe -
resource yara_rule behavioral2/memory/1100-2-0x0000000000210000-0x00000000007E8000-memory.dmp dcrat behavioral2/memory/1100-133-0x0000000000210000-0x00000000007E8000-memory.dmp dcrat behavioral2/memory/3916-135-0x0000000000DE0000-0x00000000013B8000-memory.dmp dcrat behavioral2/memory/3916-138-0x0000000000DE0000-0x00000000013B8000-memory.dmp dcrat - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation LisectAVT_2403002A_200.exe - Executes dropped EXE 1 IoCs
pid Process 3916 smss.exe - Adds Run key to start application 2 TTPs 34 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\Provisioning\\services.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\Offline Web Pages\\unsecapp.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\Idle.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\es-ES\\RuntimeBroker.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\it-IT\\smss.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files (x86)\\Windows Defender\\unsecapp.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\Offline Web Pages\\unsecapp.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\winlogon.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Recovery\\WindowsRE\\TextInputHost.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\es-ES\\RuntimeBroker.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\it-IT\\smss.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\Default\\Links\\SearchApp.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\Idle.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files\\dotnet\\shared\\Registry.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\Cursors\\StartMenuExperienceHost.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\Provisioning\\services.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Public\\AccountPictures\\RuntimeBroker.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files (x86)\\Windows Defender\\unsecapp.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\Cursors\\StartMenuExperienceHost.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files\\dotnet\\shared\\Registry.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Recovery\\WindowsRE\\TextInputHost.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Public\\AccountPictures\\RuntimeBroker.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\Default\\Links\\SearchApp.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\SystemResources\\Windows.UI.ShellCommon\\NetworkUX\\Assets\\TextInputHost.exe\"" LisectAVT_2403002A_200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\winlogon.exe\"" LisectAVT_2403002A_200.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LisectAVT_2403002A_200.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" LisectAVT_2403002A_200.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 3916 smss.exe 3916 smss.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Media Player\uk-UA\cc11b995f2a76d LisectAVT_2403002A_200.exe File opened for modification C:\Program Files (x86)\Windows Media Player\uk-UA\winlogon.exe LisectAVT_2403002A_200.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\uk-UA\Idle.exe LisectAVT_2403002A_200.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\dwm.exe LisectAVT_2403002A_200.exe File created C:\Program Files (x86)\Windows Defender\unsecapp.exe LisectAVT_2403002A_200.exe File created C:\Program Files\dotnet\shared\Registry.exe LisectAVT_2403002A_200.exe File created C:\Program Files (x86)\Windows Portable Devices\dwm.exe LisectAVT_2403002A_200.exe File opened for modification C:\Program Files (x86)\Windows Defender\unsecapp.exe LisectAVT_2403002A_200.exe File opened for modification C:\Program Files\dotnet\shared\Registry.exe LisectAVT_2403002A_200.exe File created C:\Program Files (x86)\Windows Photo Viewer\uk-UA\Idle.exe LisectAVT_2403002A_200.exe File created C:\Program Files (x86)\Windows Photo Viewer\uk-UA\6ccacd8608530f LisectAVT_2403002A_200.exe File created C:\Program Files (x86)\Windows Media Player\uk-UA\winlogon.exe LisectAVT_2403002A_200.exe File created C:\Program Files\dotnet\shared\ee2ad38f3d4382 LisectAVT_2403002A_200.exe File created C:\Program Files (x86)\Windows Portable Devices\6cb0b6c459d5d3 LisectAVT_2403002A_200.exe File created C:\Program Files (x86)\Windows Defender\29c1c3cc0f7685 LisectAVT_2403002A_200.exe - Drops file in Windows directory 18 IoCs
description ioc Process File opened for modification C:\Windows\Provisioning\services.exe LisectAVT_2403002A_200.exe File created C:\Windows\Cursors\StartMenuExperienceHost.exe LisectAVT_2403002A_200.exe File created C:\Windows\Cursors\55b276f4edf653 LisectAVT_2403002A_200.exe File created C:\Windows\Offline Web Pages\29c1c3cc0f7685 LisectAVT_2403002A_200.exe File created C:\Windows\es-ES\RuntimeBroker.exe LisectAVT_2403002A_200.exe File created C:\Windows\es-ES\9e8d7a4ca61bd9 LisectAVT_2403002A_200.exe File opened for modification C:\Windows\Offline Web Pages\unsecapp.exe LisectAVT_2403002A_200.exe File created C:\Windows\Provisioning\services.exe LisectAVT_2403002A_200.exe File created C:\Windows\Offline Web Pages\unsecapp.exe LisectAVT_2403002A_200.exe File opened for modification C:\Windows\it-IT\smss.exe LisectAVT_2403002A_200.exe File created C:\Windows\Provisioning\c5b4cb5e9653cc LisectAVT_2403002A_200.exe File created C:\Windows\it-IT\smss.exe LisectAVT_2403002A_200.exe File created C:\Windows\it-IT\69ddcba757bf72 LisectAVT_2403002A_200.exe File opened for modification C:\Windows\SystemResources\Windows.UI.ShellCommon\NetworkUX\Assets\TextInputHost.exe LisectAVT_2403002A_200.exe File opened for modification C:\Windows\Cursors\StartMenuExperienceHost.exe LisectAVT_2403002A_200.exe File opened for modification C:\Windows\es-ES\RuntimeBroker.exe LisectAVT_2403002A_200.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\NetworkUX\Assets\TextInputHost.exe LisectAVT_2403002A_200.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\NetworkUX\Assets\22eafd247d37c3 LisectAVT_2403002A_200.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LisectAVT_2403002A_200.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ LisectAVT_2403002A_200.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3160 schtasks.exe 2168 schtasks.exe 2684 schtasks.exe 3328 schtasks.exe 1844 schtasks.exe 4780 schtasks.exe 3464 schtasks.exe 2152 schtasks.exe 3428 schtasks.exe 3628 schtasks.exe 3368 schtasks.exe 1732 schtasks.exe 4292 schtasks.exe 3120 schtasks.exe 3788 schtasks.exe 4560 schtasks.exe 3192 schtasks.exe 1708 schtasks.exe 1392 schtasks.exe 2092 schtasks.exe 3360 schtasks.exe 5080 schtasks.exe 3600 schtasks.exe 4372 schtasks.exe 404 schtasks.exe 2080 schtasks.exe 636 schtasks.exe 4348 schtasks.exe 3848 schtasks.exe 4048 schtasks.exe 2556 schtasks.exe 1360 schtasks.exe 4288 schtasks.exe 1740 schtasks.exe 1812 schtasks.exe 3880 schtasks.exe 3296 schtasks.exe 4328 schtasks.exe 3256 schtasks.exe 3472 schtasks.exe 3136 schtasks.exe 4040 schtasks.exe 1616 schtasks.exe 3068 schtasks.exe 2784 schtasks.exe 2108 schtasks.exe 4276 schtasks.exe 2532 schtasks.exe 744 schtasks.exe 4140 schtasks.exe 4552 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 1100 LisectAVT_2403002A_200.exe 3916 smss.exe 3916 smss.exe 3916 smss.exe 3916 smss.exe 3916 smss.exe 3916 smss.exe 3916 smss.exe 3916 smss.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1100 LisectAVT_2403002A_200.exe Token: SeDebugPrivilege 3916 smss.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1100 LisectAVT_2403002A_200.exe 3916 smss.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1100 wrote to memory of 3916 1100 LisectAVT_2403002A_200.exe 143 PID 1100 wrote to memory of 3916 1100 LisectAVT_2403002A_200.exe 143 PID 1100 wrote to memory of 3916 1100 LisectAVT_2403002A_200.exe 143 - System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" LisectAVT_2403002A_200.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" LisectAVT_2403002A_200.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" LisectAVT_2403002A_200.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" smss.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_200.exe"C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_200.exe"1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1100 -
C:\Windows\it-IT\smss.exe"C:\Windows\it-IT\smss.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3916
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3296
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Windows\SystemResources\Windows.UI.ShellCommon\NetworkUX\Assets\TextInputHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\SystemResources\Windows.UI.ShellCommon\NetworkUX\Assets\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Windows\SystemResources\Windows.UI.ShellCommon\NetworkUX\Assets\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\unsecapp.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:744
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1392
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3120
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3788
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Windows\Provisioning\services.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3848
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Provisioning\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3628
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Windows\Provisioning\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Windows\Offline Web Pages\unsecapp.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3368
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Windows\Offline Web Pages\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4276
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\winlogon.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3360
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Links\SearchApp.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Default\Links\SearchApp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Links\SearchApp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\Idle.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3192
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Windows\Cursors\StartMenuExperienceHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\Cursors\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Windows\Cursors\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3160
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\es-ES\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3136
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files\dotnet\shared\Registry.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Registry.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files\dotnet\shared\Registry.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4292
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3600
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\it-IT\smss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\it-IT\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\it-IT\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4348
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Recovery\WindowsRE\RuntimeBroker.exe
- Size 3.3MB
- SHA256 aa2fa7c979e868047cf947370ae3f511068276c3c0eb1541301b9f6a3fa7abba
- MD5 ebf1db324a7e5a4f9dfc3e9731a8a301
- SHA1 6e95daa4f46b8b32320c9b3676119233aa72f21f
- SHA512 d9456fd19fef61e1557c089ff97e40b8295029fae5903871cd600370464b2a6c6042855771e15f8991b6a05208c64cf3aa654475cbf074578fc6661c3b65b96e
- SSDEEP 49152:o8xhCcpCNPulYCFckZHvEdM1jegx7oOCM1Gn72tESduILWMJd33eRkX2EuFgtDGg:NhrChV+cU/NeBPMY72tRR0EuUG
- MD5 SHA1 SHA512 SSDEEP