dcrat | 86c845b26ff1a36147c647ba50a1cf1ef62c829bcd432bb6ffb6d167532da7c6

Analysis

max time kernel
150s
max time network
158s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
483e96684fcd22e9ae54520fbabce4ce.exe
Size 3.6MB
Sample240726-pp2emsxfmm
SHA256 86c845b26ff1a36147c647ba50a1cf1ef62c829bcd432bb6ffb6d167532da7c6
MD5 483e96684fcd22e9ae54520fbabce4ce
SHA1 d8da92f363bdad025496a55b4e195e239dee24fc
SHA512 5b80834a00acce4592ec75ea277e199ba406fb359109fa1d889bb203383be1a6fa6feef90f8e28fc7557ac46b1e56b036176b8efc3cf4608f52d87f1a54aedce
SSDEEP 98304:Ly5WEuCcNtwzYfsV5K6xAWF5WsX8APALK9Ts8L:Ly57uCcNOzYSK6xAng8AIeV7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion execution infostealer persistence rat trojan

Malware Config

Signatures

DcRat 56 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2608	schtasks.exe
		2212	schtasks.exe
		1672	schtasks.exe
		908	schtasks.exe
File created	C:\Windows\schemas\56085415360792		483e96684fcd22e9ae54520fbabce4ce.exe
		2876	schtasks.exe
		1744	schtasks.exe
		1556	schtasks.exe
		304	schtasks.exe
		468	schtasks.exe
		2592	schtasks.exe
		2748	schtasks.exe
		2192	schtasks.exe
		3036	schtasks.exe
		1528	schtasks.exe
		348	schtasks.exe
		2984	schtasks.exe
		572	schtasks.exe
		684	schtasks.exe
		2316	schtasks.exe
		2016	schtasks.exe
		1156	schtasks.exe
		1788	schtasks.exe
		2100	schtasks.exe
		876	schtasks.exe
		2752	schtasks.exe
		1796	schtasks.exe
		2124	schtasks.exe
		1964	schtasks.exe
		1508	schtasks.exe
		2600	schtasks.exe
		1660	schtasks.exe
		1704	schtasks.exe
		2296	schtasks.exe
		2712	schtasks.exe
		2912	schtasks.exe
		948	schtasks.exe
		3056	schtasks.exe
		944	schtasks.exe
		2864	schtasks.exe
		1624	schtasks.exe
		2392	schtasks.exe
		1684	schtasks.exe
		1236	schtasks.exe
		2884	schtasks.exe
		2032	schtasks.exe
		2256	schtasks.exe
		2780	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		483e96684fcd22e9ae54520fbabce4ce.exe
		1720	schtasks.exe
		2208	schtasks.exe
		2216	schtasks.exe
		2504	schtasks.exe
		1768	schtasks.exe
		744	schtasks.exe
		1044	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	572	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	744	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	908	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	348	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	304	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2412	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	2412	schtasks.exe	31

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

DCRat payload 11 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2308-1-0x0000000000090000-0x0000000000436000-memory.dmp	dcrat
behavioral1/files/0x0006000000017400-28.dat	dcrat
behavioral1/memory/2172-125-0x0000000000360000-0x0000000000706000-memory.dmp	dcrat
behavioral1/memory/1532-164-0x0000000000A50000-0x0000000000DF6000-memory.dmp	dcrat
behavioral1/memory/1612-177-0x0000000000120000-0x00000000004C6000-memory.dmp	dcrat
behavioral1/memory/2220-190-0x0000000000C50000-0x0000000000FF6000-memory.dmp	dcrat
behavioral1/memory/328-214-0x0000000000CD0000-0x0000000001076000-memory.dmp	dcrat
behavioral1/memory/1388-228-0x00000000001E0000-0x0000000000586000-memory.dmp	dcrat
behavioral1/memory/2896-240-0x0000000000CA0000-0x0000000001046000-memory.dmp	dcrat
behavioral1/memory/1284-264-0x0000000000240000-0x00000000005E6000-memory.dmp	dcrat
behavioral1/memory/1776-278-0x0000000000C90000-0x0000000001036000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2264	powershell.exe
2584	powershell.exe
2936	powershell.exe
1692	powershell.exe
2704	powershell.exe
2688	powershell.exe
2536	powershell.exe
2808	powershell.exe
2724	powershell.exe
2656	powershell.exe
2560	powershell.exe
2820	powershell.exe
3064	powershell.exe
2868	powershell.exe
2432	powershell.exe
1284	powershell.exe
1852	powershell.exe
2056	powershell.exe
2744	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2172	csrss.exe
1532	csrss.exe
1612	csrss.exe
2220	csrss.exe
2460	csrss.exe
328	csrss.exe
1388	csrss.exe
2896	csrss.exe
2444	csrss.exe
1284	csrss.exe
1776	csrss.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\ServiceProfiles\\lsass.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Public\\csrss.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Program Files\\Windows Photo Viewer\\en-US\\WMIADAP.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\schemas\\wininit.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\483e96684fcd22e9ae54520fbabce4ce = "\"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\483e96684fcd22e9ae54520fbabce4ce.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Common Files\\Services\\dllhost.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\OSPPSVC.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\All Users\\Adobe\\Acrobat\\sppsvc.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Users\\Default User\\WMIADAP.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Windows Defender\\explorer.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\OSPPSVC.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\schemas\\wininit.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Users\\Default User\\WMIADAP.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\WMIADAP.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\WmiPrvSE.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Program Files\\Windows Photo Viewer\\en-US\\WMIADAP.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\Cursors\\winlogon.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\sppsvc.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Public\\csrss.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\WmiPrvSE.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Windows Defender\\explorer.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\Cursors\\winlogon.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\All Users\\Adobe\\Acrobat\\sppsvc.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\WMIADAP.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\ServiceProfiles\\lsass.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\audiodg.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\audiodg.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Common Files\\Services\\dllhost.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Common Files\\DESIGNER\\System.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Common Files\\DESIGNER\\System.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\483e96684fcd22e9ae54520fbabce4ce = "\"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\483e96684fcd22e9ae54520fbabce4ce.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\sppsvc.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	483e96684fcd22e9ae54520fbabce4ce.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\it-IT\1f817c271dba0c	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\audiodg.exe	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Program Files\Windows Defender\7a0fd90576e088	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OSPPSVC.exe	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Program Files (x86)\Common Files\DESIGNER\System.exe	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Program Files (x86)\Google\Update\Offline\7a0fd90576e088	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Program Files (x86)\Windows Media Player\it-IT\483e96684fcd22e9ae54520fbabce4ce.exe	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Program Files (x86)\Common Files\DESIGNER\27d1bcfc3c54e0	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Program Files (x86)\Google\Update\Offline\explorer.exe	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Program Files\Common Files\Services\5940a34987c991	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\WMIADAP.exe	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\75a57c1bdf437c	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\42af1c969fbb7b	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Program Files\Common Files\Services\dllhost.exe	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Program Files\Windows Defender\explorer.exe	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\1610b97d3ab4a7	483e96684fcd22e9ae54520fbabce4ce.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\6203df4a6bafc7	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Windows\Cursors\winlogon.exe	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Windows\Cursors\cc11b995f2a76d	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Windows\schemas\wininit.exe	483e96684fcd22e9ae54520fbabce4ce.exe
File opened for modification	C:\Windows\schemas\wininit.exe	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Windows\schemas\56085415360792	483e96684fcd22e9ae54520fbabce4ce.exe
File created	C:\Windows\ServiceProfiles\lsass.exe	483e96684fcd22e9ae54520fbabce4ce.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1684	schtasks.exe
2592	schtasks.exe
2752	schtasks.exe
2316	schtasks.exe
1156	schtasks.exe
2192	schtasks.exe
1044	schtasks.exe
1964	schtasks.exe
2712	schtasks.exe
2780	schtasks.exe
2608	schtasks.exe
2212	schtasks.exe
2032	schtasks.exe
2256	schtasks.exe
1744	schtasks.exe
468	schtasks.exe
572	schtasks.exe
1788	schtasks.exe
2912	schtasks.exe
2124	schtasks.exe
1660	schtasks.exe
2016	schtasks.exe
348	schtasks.exe
2864	schtasks.exe
1768	schtasks.exe
2748	schtasks.exe
2296	schtasks.exe
1236	schtasks.exe
1672	schtasks.exe
2884	schtasks.exe
3036	schtasks.exe
1624	schtasks.exe
684	schtasks.exe
948	schtasks.exe
2216	schtasks.exe
304	schtasks.exe
1556	schtasks.exe
2100	schtasks.exe
2984	schtasks.exe
1508	schtasks.exe
876	schtasks.exe
744	schtasks.exe
2208	schtasks.exe
2600	schtasks.exe
1528	schtasks.exe
944	schtasks.exe
1796	schtasks.exe
1704	schtasks.exe
3056	schtasks.exe
2392	schtasks.exe
2504	schtasks.exe
2876	schtasks.exe
1720	schtasks.exe
908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2308	483e96684fcd22e9ae54520fbabce4ce.exe
2704	powershell.exe
2656	powershell.exe
3064	powershell.exe
2432	powershell.exe
1284	powershell.exe
2724	powershell.exe
2820	powershell.exe
1852	powershell.exe
2584	powershell.exe
2056	powershell.exe
2536	powershell.exe
1692	powershell.exe
2744	powershell.exe
2936	powershell.exe
2560	powershell.exe
2688	powershell.exe
2868	powershell.exe
2808	powershell.exe
2264	powershell.exe
2172	csrss.exe
1532	csrss.exe
1612	csrss.exe
2220	csrss.exe
2460	csrss.exe
328	csrss.exe
1388	csrss.exe
2896	csrss.exe
2444	csrss.exe
1284	csrss.exe
1776	csrss.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	483e96684fcd22e9ae54520fbabce4ce.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	1284	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	2172	csrss.exe
Token: SeDebugPrivilege	1532	csrss.exe
Token: SeDebugPrivilege	1612	csrss.exe
Token: SeDebugPrivilege	2220	csrss.exe
Token: SeDebugPrivilege	2460	csrss.exe
Token: SeDebugPrivilege	328	csrss.exe
Token: SeDebugPrivilege	1388	csrss.exe
Token: SeDebugPrivilege	2896	csrss.exe
Token: SeDebugPrivilege	2444	csrss.exe
Token: SeDebugPrivilege	1284	csrss.exe
Token: SeDebugPrivilege	1776	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2656	2308	483e96684fcd22e9ae54520fbabce4ce.exe	86
PID 2308 wrote to memory of 2656	2308	483e96684fcd22e9ae54520fbabce4ce.exe	86
PID 2308 wrote to memory of 2656	2308	483e96684fcd22e9ae54520fbabce4ce.exe	86
PID 2308 wrote to memory of 2432	2308	483e96684fcd22e9ae54520fbabce4ce.exe	87
PID 2308 wrote to memory of 2432	2308	483e96684fcd22e9ae54520fbabce4ce.exe	87
PID 2308 wrote to memory of 2432	2308	483e96684fcd22e9ae54520fbabce4ce.exe	87
PID 2308 wrote to memory of 1692	2308	483e96684fcd22e9ae54520fbabce4ce.exe	88
PID 2308 wrote to memory of 1692	2308	483e96684fcd22e9ae54520fbabce4ce.exe	88
PID 2308 wrote to memory of 1692	2308	483e96684fcd22e9ae54520fbabce4ce.exe	88
PID 2308 wrote to memory of 2056	2308	483e96684fcd22e9ae54520fbabce4ce.exe	90
PID 2308 wrote to memory of 2056	2308	483e96684fcd22e9ae54520fbabce4ce.exe	90
PID 2308 wrote to memory of 2056	2308	483e96684fcd22e9ae54520fbabce4ce.exe	90
PID 2308 wrote to memory of 1852	2308	483e96684fcd22e9ae54520fbabce4ce.exe	92
PID 2308 wrote to memory of 1852	2308	483e96684fcd22e9ae54520fbabce4ce.exe	92
PID 2308 wrote to memory of 1852	2308	483e96684fcd22e9ae54520fbabce4ce.exe	92
PID 2308 wrote to memory of 1284	2308	483e96684fcd22e9ae54520fbabce4ce.exe	93
PID 2308 wrote to memory of 1284	2308	483e96684fcd22e9ae54520fbabce4ce.exe	93
PID 2308 wrote to memory of 1284	2308	483e96684fcd22e9ae54520fbabce4ce.exe	93
PID 2308 wrote to memory of 2868	2308	483e96684fcd22e9ae54520fbabce4ce.exe	94
PID 2308 wrote to memory of 2868	2308	483e96684fcd22e9ae54520fbabce4ce.exe	94
PID 2308 wrote to memory of 2868	2308	483e96684fcd22e9ae54520fbabce4ce.exe	94
PID 2308 wrote to memory of 2724	2308	483e96684fcd22e9ae54520fbabce4ce.exe	95
PID 2308 wrote to memory of 2724	2308	483e96684fcd22e9ae54520fbabce4ce.exe	95
PID 2308 wrote to memory of 2724	2308	483e96684fcd22e9ae54520fbabce4ce.exe	95
PID 2308 wrote to memory of 2808	2308	483e96684fcd22e9ae54520fbabce4ce.exe	96
PID 2308 wrote to memory of 2808	2308	483e96684fcd22e9ae54520fbabce4ce.exe	96
PID 2308 wrote to memory of 2808	2308	483e96684fcd22e9ae54520fbabce4ce.exe	96
PID 2308 wrote to memory of 2704	2308	483e96684fcd22e9ae54520fbabce4ce.exe	97
PID 2308 wrote to memory of 2704	2308	483e96684fcd22e9ae54520fbabce4ce.exe	97
PID 2308 wrote to memory of 2704	2308	483e96684fcd22e9ae54520fbabce4ce.exe	97
PID 2308 wrote to memory of 2688	2308	483e96684fcd22e9ae54520fbabce4ce.exe	98
PID 2308 wrote to memory of 2688	2308	483e96684fcd22e9ae54520fbabce4ce.exe	98
PID 2308 wrote to memory of 2688	2308	483e96684fcd22e9ae54520fbabce4ce.exe	98
PID 2308 wrote to memory of 2936	2308	483e96684fcd22e9ae54520fbabce4ce.exe	99
PID 2308 wrote to memory of 2936	2308	483e96684fcd22e9ae54520fbabce4ce.exe	99
PID 2308 wrote to memory of 2936	2308	483e96684fcd22e9ae54520fbabce4ce.exe	99
PID 2308 wrote to memory of 2744	2308	483e96684fcd22e9ae54520fbabce4ce.exe	101
PID 2308 wrote to memory of 2744	2308	483e96684fcd22e9ae54520fbabce4ce.exe	101
PID 2308 wrote to memory of 2744	2308	483e96684fcd22e9ae54520fbabce4ce.exe	101
PID 2308 wrote to memory of 2584	2308	483e96684fcd22e9ae54520fbabce4ce.exe	103
PID 2308 wrote to memory of 2584	2308	483e96684fcd22e9ae54520fbabce4ce.exe	103
PID 2308 wrote to memory of 2584	2308	483e96684fcd22e9ae54520fbabce4ce.exe	103
PID 2308 wrote to memory of 3064	2308	483e96684fcd22e9ae54520fbabce4ce.exe	105
PID 2308 wrote to memory of 3064	2308	483e96684fcd22e9ae54520fbabce4ce.exe	105
PID 2308 wrote to memory of 3064	2308	483e96684fcd22e9ae54520fbabce4ce.exe	105
PID 2308 wrote to memory of 2264	2308	483e96684fcd22e9ae54520fbabce4ce.exe	106
PID 2308 wrote to memory of 2264	2308	483e96684fcd22e9ae54520fbabce4ce.exe	106
PID 2308 wrote to memory of 2264	2308	483e96684fcd22e9ae54520fbabce4ce.exe	106
PID 2308 wrote to memory of 2820	2308	483e96684fcd22e9ae54520fbabce4ce.exe	107
PID 2308 wrote to memory of 2820	2308	483e96684fcd22e9ae54520fbabce4ce.exe	107
PID 2308 wrote to memory of 2820	2308	483e96684fcd22e9ae54520fbabce4ce.exe	107
PID 2308 wrote to memory of 2536	2308	483e96684fcd22e9ae54520fbabce4ce.exe	108
PID 2308 wrote to memory of 2536	2308	483e96684fcd22e9ae54520fbabce4ce.exe	108
PID 2308 wrote to memory of 2536	2308	483e96684fcd22e9ae54520fbabce4ce.exe	108
PID 2308 wrote to memory of 2560	2308	483e96684fcd22e9ae54520fbabce4ce.exe	109
PID 2308 wrote to memory of 2560	2308	483e96684fcd22e9ae54520fbabce4ce.exe	109
PID 2308 wrote to memory of 2560	2308	483e96684fcd22e9ae54520fbabce4ce.exe	109
PID 2308 wrote to memory of 2172	2308	483e96684fcd22e9ae54520fbabce4ce.exe	124
PID 2308 wrote to memory of 2172	2308	483e96684fcd22e9ae54520fbabce4ce.exe	124
PID 2308 wrote to memory of 2172	2308	483e96684fcd22e9ae54520fbabce4ce.exe	124
PID 2172 wrote to memory of 2228	2172	csrss.exe	125
PID 2172 wrote to memory of 2228	2172	csrss.exe	125
PID 2172 wrote to memory of 2228	2172	csrss.exe	125
PID 2172 wrote to memory of 448	2172	csrss.exe	126

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\483e96684fcd22e9ae54520fbabce4ce.exe
"C:\Users\Admin\AppData\Local\Temp\483e96684fcd22e9ae54520fbabce4ce.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\483e96684fcd22e9ae54520fbabce4ce.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\schemas\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\Offline\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Adobe\Acrobat\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\it-IT\483e96684fcd22e9ae54520fbabce4ce.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\it-IT\audiodg.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\WMIADAP.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\WMIADAP.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\Services\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\en-US\WMIADAP.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\DESIGNER\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Users\Public\csrss.exe
  "C:\Users\Public\csrss.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2172
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72ac0ea1-ead2-4823-a19e-a3566d747377.vbs"
    3⤵
    PID:2228
  - - C:\Users\Public\csrss.exe
      C:\Users\Public\csrss.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:1532
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f0abd4f-2969-451c-80b5-8f2997a75fe3.vbs"
        5⤵
        
        PID:1600
      - C:\Users\Public\csrss.exe
        
        C:\Users\Public\csrss.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e75c377a-c854-4278-98b8-b5bb5a8dfc4e.vbs"
        7⤵
        
        PID:2712
        
        C:\Users\Public\csrss.exe
        
        C:\Users\Public\csrss.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2220
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1e8a787-25c4-4811-8ba4-892b0d8170fc.vbs"
        9⤵
        
        PID:1840
        
        C:\Users\Public\csrss.exe
        
        C:\Users\Public\csrss.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2460
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e562922-506f-403a-b206-dea5861ec4cd.vbs"
        11⤵
        
        PID:2920
        
        C:\Users\Public\csrss.exe
        
        C:\Users\Public\csrss.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:328
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00689843-cbd5-4640-a9c4-83726f055615.vbs"
        13⤵
        
        PID:1040
        
        C:\Users\Public\csrss.exe
        
        C:\Users\Public\csrss.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1388
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\de457c87-5578-4606-a40e-cd9e88708b76.vbs"
        15⤵
        
        PID:1020
        
        C:\Users\Public\csrss.exe
        
        C:\Users\Public\csrss.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2896
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9c3b748-afff-4817-bbe0-06f83b515e9a.vbs"
        17⤵
        
        PID:3068
        
        C:\Users\Public\csrss.exe
        
        C:\Users\Public\csrss.exe
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bdb60d39-643d-4043-bdab-cfc044a7074d.vbs"
        19⤵
        
        PID:1304
        
        C:\Users\Public\csrss.exe
        
        C:\Users\Public\csrss.exe
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1284
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\de4e553b-47e8-4297-9d0e-30a812cb11f4.vbs"
        21⤵
        
        PID:2968
        
        C:\Users\Public\csrss.exe
        
        C:\Users\Public\csrss.exe
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1776
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e542aa14-44cd-42b3-bbcd-9f5bcf8fdb9b.vbs"
        23⤵
        
        PID:1040
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b6fd3609-8ff0-4a8a-824b-ba86ba3bea69.vbs"
        23⤵
        
        PID:1884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\51ff2625-9158-485b-9c74-0a80a98e6ba5.vbs"
        21⤵
        
        PID:1892
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\887c8c74-1a87-4d64-8d1c-b7aa57045f80.vbs"
        19⤵
        
        PID:2160
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31334d61-1dd6-4e8d-ab60-95be4cbdff5b.vbs"
        17⤵
        
        PID:2688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a8f865d7-53c9-4eee-af18-29ad46de6953.vbs"
        15⤵
        
        PID:1748
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\912052e8-2eca-41dd-9c60-2f921c941d77.vbs"
        13⤵
        
        PID:2484
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\987480bd-395d-4c16-923d-644a1cbcc01a.vbs"
        11⤵
        
        PID:2804
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9d3412a8-2d53-4218-bf10-e27c4f96213a.vbs"
        9⤵
        
        PID:1336
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28e9849c-3f41-4c05-bb22-c900ccba7724.vbs"
        7⤵
        
        PID:1476
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\970c4f23-ee96-4c50-9946-1591c3bed321.vbs"
        5⤵
        
        PID:1548
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d4cb5a40-0fcd-40ba-8521-45430d14e953.vbs"
    3⤵
    PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\schemas\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\schemas\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Windows\schemas\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Update\Offline\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Offline\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Update\Offline\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Adobe\Acrobat\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Acrobat\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Adobe\Acrobat\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "483e96684fcd22e9ae54520fbabce4ce4" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\483e96684fcd22e9ae54520fbabce4ce.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "483e96684fcd22e9ae54520fbabce4ce" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\483e96684fcd22e9ae54520fbabce4ce.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "483e96684fcd22e9ae54520fbabce4ce4" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\483e96684fcd22e9ae54520fbabce4ce.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\ServiceProfiles\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Windows\ServiceProfiles\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Public\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\WMIADAP.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Users\Default User\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\Services\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\Services\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Common Files\Services\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\en-US\WMIADAP.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Photo Viewer\en-US\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OSPPSVC.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\DESIGNER\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\DESIGNER\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\DESIGNER\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Windows\Cursors\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Cursors\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Windows\Cursors\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

483e96684fcd22e9ae54520fbabce4ce.exe

Path C:\Program Files (x86)\Windows Media Player\it-IT\483e96684fcd22e9ae54520fbabce4ce.exe
Size 3.6MB
SHA256 86c845b26ff1a36147c647ba50a1cf1ef62c829bcd432bb6ffb6d167532da7c6
MD5 483e96684fcd22e9ae54520fbabce4ce
SHA1 d8da92f363bdad025496a55b4e195e239dee24fc
SHA512 5b80834a00acce4592ec75ea277e199ba406fb359109fa1d889bb203383be1a6fa6feef90f8e28fc7557ac46b1e56b036176b8efc3cf4608f52d87f1a54aedce
SSDEEP 98304:Ly5WEuCcNtwzYfsV5K6xAWF5WsX8APALK9Ts8L:Ly57uCcNOzYSK6xAng8AIeV7
MD5 SHA1 SHA512 SSDEEP

Submit Download

00689843-cbd5-4640-a9c4-83726f055615.vbs

Path C:\Users\Admin\AppData\Local\Temp\00689843-cbd5-4640-a9c4-83726f055615.vbs
Size 700B
SHA256 482003b4661bc9008bb67cf52b9222603cd6b7067f28b748b0f7f4a4791046be
MD5 cc5dc37d12919fd1db3c735f302e3d10
SHA1 86bc2487d148a3841c9a310b07e5cb23b57c90aa
SHA512 f47076694235e9887cfbed8a7d5bc8bb5474918c10957ba6a7d74a1836e5bb545dbc5c623aa0859316b96dcd0a53a5ab3938977d8f75f36cd81bdb62d52e1e57
MD5 SHA1 SHA512

Submit Download

4f0abd4f-2969-451c-80b5-8f2997a75fe3.vbs

Path C:\Users\Admin\AppData\Local\Temp\4f0abd4f-2969-451c-80b5-8f2997a75fe3.vbs
Size 701B
SHA256 db40f23e20329fde6dd5d604134634001907b5ab8bd883229eb70954371e26ed
MD5 6a37654da2ba6e4f66dce463ffbfa2a7
SHA1 22778860c7079ca57c759c1acba8a8431e649051
SHA512 d8b6569c2f1fc90328ccf51b2335a7967930a8637eb28d0f80b56f801367ee800dd83283b1a6b60735654f12bb25f3e9672f976213fb725a356550f0fa0cc6f1
MD5 SHA1 SHA512

Submit Download

72ac0ea1-ead2-4823-a19e-a3566d747377.vbs

Path C:\Users\Admin\AppData\Local\Temp\72ac0ea1-ead2-4823-a19e-a3566d747377.vbs
Size 701B
SHA256 db911fef12e59536ba3d8c6fa4a6e096791f2c2febb03f91630cc4b2a0dc2a7e
MD5 747ffc980af4d73184b04a73cc9e193b
SHA1 fd2b8ffa3fa4a2fa52e2697b8621a5a10aac25cf
SHA512 204cf4fbc9d780c7e1e637863f7477d2b99cb421539c2e113c63ba6620b9942df38d7701f9e3feec336ec4f46a0a8a6100a4ba1288496b299cfb4b9d0bbe11c3
MD5 SHA1 SHA512

Submit Download

7e562922-506f-403a-b206-dea5861ec4cd.vbs

Path C:\Users\Admin\AppData\Local\Temp\7e562922-506f-403a-b206-dea5861ec4cd.vbs
Size 701B
SHA256 6dba9490041469739e553e792dfe6f36b1b625eaaa51c36c25bca3061815ce2e
MD5 365c127af2a9c10a8603ec78fed2e254
SHA1 f84e63f9f4aeacfe47aa9fa6cc121c9cfa6b1349
SHA512 a55c724d3d3dfd18e5e2d67ceba4308d5dc41445735a3e79010265f59b20bb6d8ed7ec165658ca17e2c52dae52fcc8d33c289861bf43775f1cb790a3e876216c
MD5 SHA1 SHA512

Submit Download

a1e8a787-25c4-4811-8ba4-892b0d8170fc.vbs

Path C:\Users\Admin\AppData\Local\Temp\a1e8a787-25c4-4811-8ba4-892b0d8170fc.vbs
Size 701B
SHA256 62bad3d236d2e776d12a7d680e79ba31d81cbd1548ea729e22a1d1d7726c72b1
MD5 0e9c415ff0749731bda99767113aafba
SHA1 c987861f0112831ecde880deb7e0458971ae73c8
SHA512 1898713012f89d55bc13a132597e3d5070abf08956eb9344973266cba13ca5d38e471970ed8c250ac4a59017425acc1e7fd59f1dd863db2dd18ff7c421deab3c
MD5 SHA1 SHA512

Submit Download

a9c3b748-afff-4817-bbe0-06f83b515e9a.vbs

Path C:\Users\Admin\AppData\Local\Temp\a9c3b748-afff-4817-bbe0-06f83b515e9a.vbs
Size 701B
SHA256 ddd3cab5cc97f6ebb838042abe045bf6bec8302fb7eb8e0c64f7d0ebf96561c9
MD5 947ca1ad843e74cd1e2030a89ee9982f
SHA1 f2fa7d8b4f1bf14120b545094380243594d750d3
SHA512 e748f757846e4d0d9e613608c0c2f5c20794e258d7c4e8b0b88d7940c398590ff7e421787c01caeb571004e58f2eea62654d4a4f7a30d4be0ad6d49078be7ba9
MD5 SHA1 SHA512

Submit Download

bdb60d39-643d-4043-bdab-cfc044a7074d.vbs

Path C:\Users\Admin\AppData\Local\Temp\bdb60d39-643d-4043-bdab-cfc044a7074d.vbs
Size 701B
SHA256 6ab3072ab9725b9327ef81f3d717aaa211cafc2354cc5d0a64f2c952a1c0d361
MD5 ce7ee6b37169e2c69cf24f54569d0c02
SHA1 dc176848f9556dc72bb90006c8dd1c73b747ee59
SHA512 195a229c9fe52b49e3ea469ce01f1444f176f256afb5a81e80a1fdfdc14273fb3c2e80583d57fe89139828235c6a133564a4e17a0914211225018716dfc4fdab
MD5 SHA1 SHA512

Submit Download

d4cb5a40-0fcd-40ba-8521-45430d14e953.vbs

Path C:\Users\Admin\AppData\Local\Temp\d4cb5a40-0fcd-40ba-8521-45430d14e953.vbs
Size 477B
SHA256 0074312a4a6904c691b12f7b32903baec2c401f5ec31f973cf8f8b224d4405c8
MD5 26fc86a05aab98c96d4bf5b6d31a3415
SHA1 f7aeaf42209c088152e318e2dbe40f57cc32d923
SHA512 a13e35a38da1d2844dab3b8f251303e30567c5948b066b9659fe297f640470676f22c9643784353696147fb719666cb075182c9a91300e6d9a69b3723f654a1b
MD5 SHA1 SHA512

Submit Download

de457c87-5578-4606-a40e-cd9e88708b76.vbs

Path C:\Users\Admin\AppData\Local\Temp\de457c87-5578-4606-a40e-cd9e88708b76.vbs
Size 701B
SHA256 0bb9c62c3290ebfe9b395715e5cb5e0f6915878eb9e6c9452f929d5939539fad
MD5 334be67735144c93bd896b72bd936328
SHA1 a551d8cdf5458008ef7e5846dd1b16e6b553d443
SHA512 d8de410e23c7057ac830aa0cfc60ca8dedea5f624e098e67bbd86f664e6666c3b9c0c7e4bbed676440a7bae7a8141bdf1d22b367ad8ec43c733f0cd742c58d4b
MD5 SHA1 SHA512

Submit Download

de4e553b-47e8-4297-9d0e-30a812cb11f4.vbs

Path C:\Users\Admin\AppData\Local\Temp\de4e553b-47e8-4297-9d0e-30a812cb11f4.vbs
Size 701B
SHA256 6bde2e12a303b19dab53c1737d5834d739f7650d0ae87a60024250978aa6dd1f
MD5 1366dbadc1132de62ef4dc5287203b3f
SHA1 1c4249da0d84186d4eea716335f57bcde637c94a
SHA512 cc63ec00747946fc1394b3cebb731f5c1aa31c9b87c6e02283389c41c6f42c571e91620c750e1687939e18895f8d4e513629802f3656e268372d5bc6fb4629be
MD5 SHA1 SHA512

Submit Download

e542aa14-44cd-42b3-bbcd-9f5bcf8fdb9b.vbs

Path C:\Users\Admin\AppData\Local\Temp\e542aa14-44cd-42b3-bbcd-9f5bcf8fdb9b.vbs
Size 701B
SHA256 37b6377596a401150ef905543828b11871298081773eb4e9e2d762e87dd0cdbd
MD5 6480d72f5735c1e3be36b9eaad964c9e
SHA1 28acd4f0a6c29993702dbc7f0988d855be7690ed
SHA512 bffa51cd39ee2b8ac6ad4ba004600539adc68f09f4c5995ca9f3372ed288a0604f9f2f22b07128fdfee6ae1865e328c5fa187c9e0c036dda9b69cb72aec77aa9
MD5 SHA1 SHA512

Submit Download

e75c377a-c854-4278-98b8-b5bb5a8dfc4e.vbs

Path C:\Users\Admin\AppData\Local\Temp\e75c377a-c854-4278-98b8-b5bb5a8dfc4e.vbs
Size 701B
SHA256 f5772e7196844aaa366582c55c326c2ef64df1165f6934291801f2f1e6d508d1
MD5 af0ed5df104c954a5027023a858579d8
SHA1 62a2d29a4a33de51e0bd6bcb49e9cf6a4382485f
SHA512 a6c9dd841430ad3505af9855e77e3f932d78824e6b195460774c79ed12b67e27ec85282e5858798a4fef2bfb70ac3d323d88fa285ee76aef92c3a57dc383ad95
MD5 SHA1 SHA512

Submit Download

G9I059F94F7I8WVTCMST.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G9I059F94F7I8WVTCMST.temp
Size 7KB
SHA256 8e35f625bb14323b1a6cfc1717cf1553cedea2477311e885df2e0a4ceb488de2
MD5 b8af51e62413b03e58c69edf8afb8e46
SHA1 f815d4b7993bae0a2a5210b07e62afbcc2132c9e
SHA512 bba2d67ace05608b1b4cfc9b5f816b275a1a9fdfcc85c1d3d3611193451965fb3a7aa480dd08248a423f877bee2e8bddc0ad38d8d4d25b4bec68829046410742
SSDEEP 96:4JiCwOM8onqvsqvJCwohJiCwOM8onqvsEHyqvJCwor5kPDQH+17HzXlUVDOJ:w2OUUof2OUAHnor54f17HzwOJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/328-215-0x0000000000650000-0x0000000000662000-memory.dmp

Download

memory/328-214-0x0000000000CD0000-0x0000000001076000-memory.dmp

Download

memory/328-216-0x00000000025E0000-0x0000000002636000-memory.dmp

Download

memory/1284-264-0x0000000000240000-0x00000000005E6000-memory.dmp

Download

memory/1284-266-0x000000001AFA0000-0x000000001AFF6000-memory.dmp

Download

memory/1284-265-0x000000001AED0000-0x000000001AF26000-memory.dmp

Download

memory/1388-228-0x00000000001E0000-0x0000000000586000-memory.dmp

Download

memory/1532-164-0x0000000000A50000-0x0000000000DF6000-memory.dmp

Download

memory/1532-165-0x0000000000510000-0x0000000000522000-memory.dmp

Download

memory/1612-178-0x0000000000800000-0x0000000000812000-memory.dmp

Download

memory/1612-177-0x0000000000120000-0x00000000004C6000-memory.dmp

Download

memory/1776-278-0x0000000000C90000-0x0000000001036000-memory.dmp

Download

memory/1776-279-0x0000000000A70000-0x0000000000AC6000-memory.dmp

Download

memory/2172-125-0x0000000000360000-0x0000000000706000-memory.dmp

Download

memory/2220-191-0x0000000000C40000-0x0000000000C52000-memory.dmp

Download

memory/2220-190-0x0000000000C50000-0x0000000000FF6000-memory.dmp

Download

memory/2308-6-0x0000000002370000-0x00000000023C6000-memory.dmp

Download

memory/2308-2-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp

Download

memory/2308-86-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp

Download

memory/2308-9-0x0000000002400000-0x0000000002408000-memory.dmp

Download

memory/2308-10-0x0000000002410000-0x000000000241C000-memory.dmp

Download

memory/2308-15-0x00000000024E0000-0x00000000024E8000-memory.dmp

Download

memory/2308-8-0x00000000023D0000-0x00000000023E2000-memory.dmp

Download

memory/2308-7-0x00000000023C0000-0x00000000023CC000-memory.dmp

Download

memory/2308-1-0x0000000000090000-0x0000000000436000-memory.dmp

Download

memory/2308-0-0x000007FEF5C33000-0x000007FEF5C34000-memory.dmp

Download

memory/2308-16-0x00000000024F0000-0x00000000024FE000-memory.dmp

Download

memory/2308-11-0x0000000002420000-0x0000000002428000-memory.dmp

Download

memory/2308-12-0x0000000002430000-0x0000000002438000-memory.dmp

Download

memory/2308-17-0x000000001AB20000-0x000000001AB28000-memory.dmp

Download

memory/2308-13-0x00000000024C0000-0x00000000024CA000-memory.dmp

Download

memory/2308-5-0x0000000000830000-0x000000000083A000-memory.dmp

Download

memory/2308-4-0x0000000002350000-0x0000000002366000-memory.dmp

Download

memory/2308-3-0x00000000007F0000-0x000000000080C000-memory.dmp

Download

memory/2308-14-0x00000000024D0000-0x00000000024DE000-memory.dmp

Download

memory/2308-19-0x000000001AA90000-0x000000001AA9C000-memory.dmp

Download

memory/2308-18-0x000000001AB40000-0x000000001AB4A000-memory.dmp

Download

memory/2656-75-0x000000001B6A0000-0x000000001B982000-memory.dmp

Download

memory/2704-74-0x0000000000390000-0x0000000000398000-memory.dmp

Download

memory/2896-241-0x000000001AA50000-0x000000001AAA6000-memory.dmp

Download

memory/2896-240-0x0000000000CA0000-0x0000000001046000-memory.dmp

Download

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\483e96684fcd22e9ae54520fbabce4ce.exe\", \"C:\\Windows\\ServiceProfiles\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\audiodg.exe\", \"C:\\Users\\Public\\csrss.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\483e96684fcd22e9ae54520fbabce4ce.exe\", \"C:\\Windows\\ServiceProfiles\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\audiodg.exe\", \"C:\\Users\\Public\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\WMIADAP.exe\", \"C:\\Users\\Default User\\WMIADAP.exe\", \"C:\\Program Files\\Common Files\\Services\\dllhost.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows Photo Viewer\\en-US\\WMIADAP.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\483e96684fcd22e9ae54520fbabce4ce.exe\", \"C:\\Windows\\ServiceProfiles\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\audiodg.exe\", \"C:\\Users\\Public\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\WMIADAP.exe\", \"C:\\Users\\Default User\\WMIADAP.exe\", \"C:\\Program Files\\Common Files\\Services\\dllhost.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows Photo Viewer\\en-US\\WMIADAP.exe\", \"C:\\Program Files\\Windows Defender\\explorer.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Common Files\\DESIGNER\\System.exe\", \"C:\\Windows\\Cursors\\winlogon.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\sppsvc.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\483e96684fcd22e9ae54520fbabce4ce.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\483e96684fcd22e9ae54520fbabce4ce.exe\", \"C:\\Windows\\ServiceProfiles\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\audiodg.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\483e96684fcd22e9ae54520fbabce4ce.exe\", \"C:\\Windows\\ServiceProfiles\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\audiodg.exe\", \"C:\\Users\\Public\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\WMIADAP.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\483e96684fcd22e9ae54520fbabce4ce.exe\", \"C:\\Windows\\ServiceProfiles\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\audiodg.exe\", \"C:\\Users\\Public\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\WMIADAP.exe\", \"C:\\Users\\Default User\\WMIADAP.exe\", \"C:\\Program Files\\Common Files\\Services\\dllhost.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows Photo Viewer\\en-US\\WMIADAP.exe\", \"C:\\Program Files\\Windows Defender\\explorer.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\483e96684fcd22e9ae54520fbabce4ce.exe\", \"C:\\Windows\\ServiceProfiles\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\audiodg.exe\", \"C:\\Users\\Public\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\WMIADAP.exe\", \"C:\\Users\\Default User\\WMIADAP.exe\", \"C:\\Program Files\\Common Files\\Services\\dllhost.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\483e96684fcd22e9ae54520fbabce4ce.exe\", \"C:\\Windows\\ServiceProfiles\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\audiodg.exe\", \"C:\\Users\\Public\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\WMIADAP.exe\", \"C:\\Users\\Default User\\WMIADAP.exe\", \"C:\\Program Files\\Common Files\\Services\\dllhost.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\WmiPrvSE.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\483e96684fcd22e9ae54520fbabce4ce.exe\", \"C:\\Windows\\ServiceProfiles\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\audiodg.exe\", \"C:\\Users\\Public\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\WMIADAP.exe\", \"C:\\Users\\Default User\\WMIADAP.exe\", \"C:\\Program Files\\Common Files\\Services\\dllhost.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows Photo Viewer\\en-US\\WMIADAP.exe\", \"C:\\Program Files\\Windows Defender\\explorer.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\OSPPSVC.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\483e96684fcd22e9ae54520fbabce4ce.exe\", \"C:\\Windows\\ServiceProfiles\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\audiodg.exe\", \"C:\\Users\\Public\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\WMIADAP.exe\", \"C:\\Users\\Default User\\WMIADAP.exe\", \"C:\\Program Files\\Common Files\\Services\\dllhost.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows Photo Viewer\\en-US\\WMIADAP.exe\", \"C:\\Program Files\\Windows Defender\\explorer.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Common Files\\DESIGNER\\System.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\483e96684fcd22e9ae54520fbabce4ce.exe\", \"C:\\Windows\\ServiceProfiles\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\audiodg.exe\", \"C:\\Users\\Public\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\WMIADAP.exe\", \"C:\\Users\\Default User\\WMIADAP.exe\", \"C:\\Program Files\\Common Files\\Services\\dllhost.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows Photo Viewer\\en-US\\WMIADAP.exe\", \"C:\\Program Files\\Windows Defender\\explorer.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Common Files\\DESIGNER\\System.exe\", \"C:\\Windows\\Cursors\\winlogon.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\sppsvc.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\483e96684fcd22e9ae54520fbabce4ce.exe\", \"C:\\Windows\\ServiceProfiles\\lsass.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\schemas\\wininit.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\explorer.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\explorer.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\it-IT\\483e96684fcd22e9ae54520fbabce4ce.exe\", \"C:\\Windows\\ServiceProfiles\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\audiodg.exe\", \"C:\\Users\\Public\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\WMIADAP.exe\", \"C:\\Users\\Default User\\WMIADAP.exe\""	483e96684fcd22e9ae54520fbabce4ce.exe