dcrat | d588c89ff1cee433b3b5d503e0adae787d8fbf8e516638cde0033de331aea1bb

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e721cd0b41361048ffeaf94be64a090N.exe
Size

4.9MB
MD5

2e721cd0b41361048ffeaf94be64a090
SHA1

0d5c61de07649f07f150785959ca3853f5d0529a
SHA256

d588c89ff1cee433b3b5d503e0adae787d8fbf8e516638cde0033de331aea1bb
SHA512

b9c264122c8e0eeb6007373d545a04900e0b9fc7866470b1fac7482f43972aab44352296e96076a898871e0962758bda3aba3e5aabee0d588b12a211d349f5d7
SSDEEP

49152:rl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2736	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2736	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	2736	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2736	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	2736	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	488	2736	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2736	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2736	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2736	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2736	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2736	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	2736	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	2736	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	2736	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2736	schtasks.exe	30

UAC bypass 3 TTPs 33 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2e721cd0b41361048ffeaf94be64a090N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2e721cd0b41361048ffeaf94be64a090N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2e721cd0b41361048ffeaf94be64a090N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/3048-3-0x000000001B630000-0x000000001B75E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2928	powershell.exe
1980	powershell.exe
1640	powershell.exe
2976	powershell.exe
2956	powershell.exe
2788	powershell.exe
1636	powershell.exe
1856	powershell.exe
2932	powershell.exe
1984	powershell.exe
2708	powershell.exe
1584	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
1284	csrss.exe
2800	csrss.exe
844	csrss.exe
1332	csrss.exe
3048	csrss.exe
2156	csrss.exe
2760	csrss.exe
2264	csrss.exe
2608	csrss.exe
2848	csrss.exe

Checks whether UAC is enabled 1 TTPs 22 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2e721cd0b41361048ffeaf94be64a090N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2e721cd0b41361048ffeaf94be64a090N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\taskhost.exe	2e721cd0b41361048ffeaf94be64a090N.exe
File created	C:\Program Files (x86)\Windows Mail\b75386f1303e64	2e721cd0b41361048ffeaf94be64a090N.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXAC1C.tmp	2e721cd0b41361048ffeaf94be64a090N.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\taskhost.exe	2e721cd0b41361048ffeaf94be64a090N.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\PCHEALTH\cc11b995f2a76d	2e721cd0b41361048ffeaf94be64a090N.exe
File opened for modification	C:\Windows\PCHEALTH\RCXA739.tmp	2e721cd0b41361048ffeaf94be64a090N.exe
File opened for modification	C:\Windows\PCHEALTH\winlogon.exe	2e721cd0b41361048ffeaf94be64a090N.exe
File created	C:\Windows\PCHEALTH\winlogon.exe	2e721cd0b41361048ffeaf94be64a090N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2888	schtasks.exe
2600	schtasks.exe
1688	schtasks.exe
2500	schtasks.exe
568	schtasks.exe
2836	schtasks.exe
1700	schtasks.exe
1864	schtasks.exe
2652	schtasks.exe
2592	schtasks.exe
2908	schtasks.exe
2244	schtasks.exe
488	schtasks.exe
2636	schtasks.exe
1756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3048	2e721cd0b41361048ffeaf94be64a090N.exe
2788	powershell.exe
2928	powershell.exe
1856	powershell.exe
1980	powershell.exe
1984	powershell.exe
2932	powershell.exe
1584	powershell.exe
2976	powershell.exe
2708	powershell.exe
1636	powershell.exe
1640	powershell.exe
2956	powershell.exe
1284	csrss.exe
2800	csrss.exe
844	csrss.exe
1332	csrss.exe
3048	csrss.exe
2156	csrss.exe
2760	csrss.exe
2264	csrss.exe
2608	csrss.exe
2848	csrss.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	2e721cd0b41361048ffeaf94be64a090N.exe
Token: SeDebugPrivilege	2788	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	1284	csrss.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	2800	csrss.exe
Token: SeDebugPrivilege	844	csrss.exe
Token: SeDebugPrivilege	1332	csrss.exe
Token: SeDebugPrivilege	3048	csrss.exe
Token: SeDebugPrivilege	2156	csrss.exe
Token: SeDebugPrivilege	2760	csrss.exe
Token: SeDebugPrivilege	2264	csrss.exe
Token: SeDebugPrivilege	2608	csrss.exe
Token: SeDebugPrivilege	2848	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1636	3048	2e721cd0b41361048ffeaf94be64a090N.exe	46
PID 3048 wrote to memory of 1636	3048	2e721cd0b41361048ffeaf94be64a090N.exe	46
PID 3048 wrote to memory of 1636	3048	2e721cd0b41361048ffeaf94be64a090N.exe	46
PID 3048 wrote to memory of 1584	3048	2e721cd0b41361048ffeaf94be64a090N.exe	47
PID 3048 wrote to memory of 1584	3048	2e721cd0b41361048ffeaf94be64a090N.exe	47
PID 3048 wrote to memory of 1584	3048	2e721cd0b41361048ffeaf94be64a090N.exe	47
PID 3048 wrote to memory of 2928	3048	2e721cd0b41361048ffeaf94be64a090N.exe	48
PID 3048 wrote to memory of 2928	3048	2e721cd0b41361048ffeaf94be64a090N.exe	48
PID 3048 wrote to memory of 2928	3048	2e721cd0b41361048ffeaf94be64a090N.exe	48
PID 3048 wrote to memory of 1980	3048	2e721cd0b41361048ffeaf94be64a090N.exe	49
PID 3048 wrote to memory of 1980	3048	2e721cd0b41361048ffeaf94be64a090N.exe	49
PID 3048 wrote to memory of 1980	3048	2e721cd0b41361048ffeaf94be64a090N.exe	49
PID 3048 wrote to memory of 1640	3048	2e721cd0b41361048ffeaf94be64a090N.exe	50
PID 3048 wrote to memory of 1640	3048	2e721cd0b41361048ffeaf94be64a090N.exe	50
PID 3048 wrote to memory of 1640	3048	2e721cd0b41361048ffeaf94be64a090N.exe	50
PID 3048 wrote to memory of 1856	3048	2e721cd0b41361048ffeaf94be64a090N.exe	51
PID 3048 wrote to memory of 1856	3048	2e721cd0b41361048ffeaf94be64a090N.exe	51
PID 3048 wrote to memory of 1856	3048	2e721cd0b41361048ffeaf94be64a090N.exe	51
PID 3048 wrote to memory of 2932	3048	2e721cd0b41361048ffeaf94be64a090N.exe	52
PID 3048 wrote to memory of 2932	3048	2e721cd0b41361048ffeaf94be64a090N.exe	52
PID 3048 wrote to memory of 2932	3048	2e721cd0b41361048ffeaf94be64a090N.exe	52
PID 3048 wrote to memory of 1984	3048	2e721cd0b41361048ffeaf94be64a090N.exe	53
PID 3048 wrote to memory of 1984	3048	2e721cd0b41361048ffeaf94be64a090N.exe	53
PID 3048 wrote to memory of 1984	3048	2e721cd0b41361048ffeaf94be64a090N.exe	53
PID 3048 wrote to memory of 2976	3048	2e721cd0b41361048ffeaf94be64a090N.exe	54
PID 3048 wrote to memory of 2976	3048	2e721cd0b41361048ffeaf94be64a090N.exe	54
PID 3048 wrote to memory of 2976	3048	2e721cd0b41361048ffeaf94be64a090N.exe	54
PID 3048 wrote to memory of 2708	3048	2e721cd0b41361048ffeaf94be64a090N.exe	55
PID 3048 wrote to memory of 2708	3048	2e721cd0b41361048ffeaf94be64a090N.exe	55
PID 3048 wrote to memory of 2708	3048	2e721cd0b41361048ffeaf94be64a090N.exe	55
PID 3048 wrote to memory of 2956	3048	2e721cd0b41361048ffeaf94be64a090N.exe	56
PID 3048 wrote to memory of 2956	3048	2e721cd0b41361048ffeaf94be64a090N.exe	56
PID 3048 wrote to memory of 2956	3048	2e721cd0b41361048ffeaf94be64a090N.exe	56
PID 3048 wrote to memory of 2788	3048	2e721cd0b41361048ffeaf94be64a090N.exe	57
PID 3048 wrote to memory of 2788	3048	2e721cd0b41361048ffeaf94be64a090N.exe	57
PID 3048 wrote to memory of 2788	3048	2e721cd0b41361048ffeaf94be64a090N.exe	57
PID 3048 wrote to memory of 1284	3048	2e721cd0b41361048ffeaf94be64a090N.exe	70
PID 3048 wrote to memory of 1284	3048	2e721cd0b41361048ffeaf94be64a090N.exe	70
PID 3048 wrote to memory of 1284	3048	2e721cd0b41361048ffeaf94be64a090N.exe	70
PID 1284 wrote to memory of 1688	1284	csrss.exe	71
PID 1284 wrote to memory of 1688	1284	csrss.exe	71
PID 1284 wrote to memory of 1688	1284	csrss.exe	71
PID 1284 wrote to memory of 480	1284	csrss.exe	72
PID 1284 wrote to memory of 480	1284	csrss.exe	72
PID 1284 wrote to memory of 480	1284	csrss.exe	72
PID 1688 wrote to memory of 2800	1688	WScript.exe	74
PID 1688 wrote to memory of 2800	1688	WScript.exe	74
PID 1688 wrote to memory of 2800	1688	WScript.exe	74
PID 2800 wrote to memory of 1760	2800	csrss.exe	75
PID 2800 wrote to memory of 1760	2800	csrss.exe	75
PID 2800 wrote to memory of 1760	2800	csrss.exe	75
PID 2800 wrote to memory of 848	2800	csrss.exe	76
PID 2800 wrote to memory of 848	2800	csrss.exe	76
PID 2800 wrote to memory of 848	2800	csrss.exe	76
PID 1760 wrote to memory of 844	1760	WScript.exe	77
PID 1760 wrote to memory of 844	1760	WScript.exe	77
PID 1760 wrote to memory of 844	1760	WScript.exe	77
PID 844 wrote to memory of 1016	844	csrss.exe	78
PID 844 wrote to memory of 1016	844	csrss.exe	78
PID 844 wrote to memory of 1016	844	csrss.exe	78
PID 844 wrote to memory of 2336	844	csrss.exe	79
PID 844 wrote to memory of 2336	844	csrss.exe	79
PID 844 wrote to memory of 2336	844	csrss.exe	79
PID 1016 wrote to memory of 1332	1016	WScript.exe	80

System policy modification 1 TTPs 33 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2e721cd0b41361048ffeaf94be64a090N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2e721cd0b41361048ffeaf94be64a090N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2e721cd0b41361048ffeaf94be64a090N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2e721cd0b41361048ffeaf94be64a090N.exe
"C:\Users\Admin\AppData\Local\Temp\2e721cd0b41361048ffeaf94be64a090N.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
  "C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1284
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\12ce71b0-aeb9-4808-a3d5-7569cc2585aa.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
      C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2800
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6cd8481b-15f1-48f5-a759-88c2fec834d5.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1760
      - C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
        
        C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c3537b26-39df-44b8-b4ce-2caa52e9edb0.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1016
        
        C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
        
        C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1332
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ca82221-033a-468a-adce-829998379c24.vbs"
        9⤵
        
        PID:2464
        
        C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
        
        C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3048
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5d7cecd-7421-40a5-9f1c-b01d3f177c3e.vbs"
        11⤵
        
        PID:2600
        
        C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
        
        C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2156
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\60977baa-ee50-4d98-a2b4-6265e80b3d24.vbs"
        13⤵
        
        PID:1104
        
        C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
        
        C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2760
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\82ae4e7e-fcd4-4b36-b634-f14060e94998.vbs"
        15⤵
        
        PID:2908
        
        C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
        
        C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2264
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8153f66a-a891-48df-8c11-e0abae9be46a.vbs"
        17⤵
        
        PID:1608
        
        C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
        
        C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2608
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\238a208d-315b-4186-93a6-3a025d63e8bc.vbs"
        19⤵
        
        PID:2996
        
        C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
        
        C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89cd6019-60e4-450e-ae22-a19a6e93559a.vbs"
        21⤵
        
        PID:1804
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\644a04f5-b8f7-4f6a-9ddc-679130118c68.vbs"
        21⤵
        
        PID:2584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\930c75f8-5eb9-47d7-9dc7-daef76736822.vbs"
        19⤵
        
        PID:2516
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0dcad02-8aa2-4d41-9e10-8261fff0970c.vbs"
        17⤵
        
        PID:1668
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e18bdfe5-4d89-4a56-98f5-27e45103f3f9.vbs"
        15⤵
        
        PID:1732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3f057ef1-4f9f-423b-94d7-600c903bd3f8.vbs"
        13⤵
        
        PID:1996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1f412172-5fda-41b0-945f-42894d57db97.vbs"
        11⤵
        
        PID:2472
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cb142787-f9af-4251-933a-e4ce9ab6546e.vbs"
        9⤵
        
        PID:1600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9fbcfb30-8ce8-4d70-93de-0048f8be2f76.vbs"
        7⤵
        
        PID:2336
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\161c1955-1633-438e-8913-b948c97dd4d5.vbs"
        5⤵
        
        PID:848
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\726917c3-d973-4ee6-a255-e475fc2d1e2d.vbs"
    3⤵
    PID:480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Favorites\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\All Users\Favorites\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Favorites\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Windows\PCHEALTH\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\PCHEALTH\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe

Filesize
4.9MB

MD5
ca32dac759e8ac72fa3e943fd9ad1fd9

SHA1
f561673260476635c4b9d3e9c615efa71a15f369

SHA256
af49665a9ae05cafd402b04e73c6c2e885c8b0759d56e04418de5fafb895a522

SHA512
5b67c704651032f652e10f744b25ee56dedd39a347a9977040d81046eb1fe7849dfd57779f651a2d6da73599bc0acc7abd9d900fded9a47bcad82d29e481fd93

Download Submit
C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\lsass.exe

Filesize
4.9MB

MD5
2e721cd0b41361048ffeaf94be64a090

SHA1
0d5c61de07649f07f150785959ca3853f5d0529a

SHA256
d588c89ff1cee433b3b5d503e0adae787d8fbf8e516638cde0033de331aea1bb

SHA512
b9c264122c8e0eeb6007373d545a04900e0b9fc7866470b1fac7482f43972aab44352296e96076a898871e0962758bda3aba3e5aabee0d588b12a211d349f5d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\12ce71b0-aeb9-4808-a3d5-7569cc2585aa.vbs

Filesize
734B

MD5
7c244c77f39e10bf5550cb160f30ab5c

SHA1
5cccd0427d7027c5a02f133af26f5ead00e4f1a8

SHA256
96eaf82517a319a2fdb4e861a1be501d2caa0c870de74e846af736bc732bb435

SHA512
c3d8cfc4d40c5d1f9f886167300e75b8b784510136c91e4a1417b83511cba4fd2dad5856806e3bf43a66055feff18dc163e6165b0eb3b80de182b3528d4e84a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\238a208d-315b-4186-93a6-3a025d63e8bc.vbs

Filesize
734B

MD5
9921dfc615dfe747746e64eb378e17c7

SHA1
42ac058466bc5e67f3d80280ed890353504ad81a

SHA256
f78f5f08dccd11b26810819e6316b01daa50621e44f0eab3d3b6e74d71de5da3

SHA512
37ee5c476da7ec52fcccbf1212c67c0349406a64b670f11229fad5577961ecb71e76b25d6d3608dcadc0e355cf18286285b72175dcae9261e250bf9c1eab73b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\60977baa-ee50-4d98-a2b4-6265e80b3d24.vbs

Filesize
734B

MD5
7273edbac4783c3fe50460a02a2e6228

SHA1
70a94566914ac9a84a15555b5f4dec806840799d

SHA256
9bbdd8cdc2c46452240fbb8b3a3b2427ca38cb8ef0c45af077f847ec117ee659

SHA512
a26937fed973401c5bee9e3848c32991f46b1ee2d1623b0856c756c2e88724c787cbcbe483b7ad75e380e83f430f46cb44785c557afcb286d9f1513373c72eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\6cd8481b-15f1-48f5-a759-88c2fec834d5.vbs

Filesize
734B

MD5
dbc5e161f3c00af77f5e1d1b3798f504

SHA1
ac352abfa668b71b85b3c2eb20a726e9bbc99234

SHA256
d99e010450904b7889f92a902e92750c12757e0981eb64f2eed92268b64e9427

SHA512
cfde1adff04784d392ad250e4b9ca4dbf2f5deee1398e1de83e7e35b2ee375d909b1ce1f6efdd4e8da59d7f3f3ca6bfc488ea0258efd9bfc7cd4127348818d68

Download Submit
C:\Users\Admin\AppData\Local\Temp\726917c3-d973-4ee6-a255-e475fc2d1e2d.vbs

Filesize
510B

MD5
3024182461bd9bd7c9b4b946c4e03ad1

SHA1
8a6e2de846ce3c8f84f3e62301d501d85730afbf

SHA256
e03ec133b360a4ccd867a375297893585009b85ce91f7bb3107d32e73ffde3ac

SHA512
3b634b7f770e8e6e6a504473fc6d127106a07e7019695201206b70e9b2177a66a9564be1e46f66554fb96a976ee4850c9af3bb9ea2e5421f0582f1e459fa7a97

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ca82221-033a-468a-adce-829998379c24.vbs

Filesize
734B

MD5
7f831b1e52fdd1800ff817f8004d1462

SHA1
37147e8a57f0d07aef3d88014757e2ee700176c9

SHA256
d28ee198927e5ad2d896a9a61d77301a4bf00f9e4e68db2a9334f3f621646ece

SHA512
fec7f3c77ee288fc0f30c63cb987ffcfefd8ce81d1e5474db701a2104815b8c904adfc6e386d99bed0a33a58c35a6b2ca05218648c1ab6efad33ee5f950d7fc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\8153f66a-a891-48df-8c11-e0abae9be46a.vbs

Filesize
734B

MD5
ae5306343a65625a8242e4595d5f4fb5

SHA1
425f91471203c6d0e33a32952ffd85f3ece737a9

SHA256
3f81f76b5c390c615097d2f94d81f7acaa577ed9a44a11c4ce68d93b0cbb3281

SHA512
472787c2c1f6c422f5bb7ae69c5d57ab26ddece069a2dd9acbedc0fbd05c8ee6d9315f3d71c065b4f4341d379886e279f644d4ba67b0086cd1e85055166f6cdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\82ae4e7e-fcd4-4b36-b634-f14060e94998.vbs

Filesize
734B

MD5
573e3d37bc54bdce4bf7f7a50573d679

SHA1
6e8bb50f74de0868e93e47d68ffd9555afe24a1a

SHA256
2c4329f835b0ec6177fa54f449fcb9c806f3e6d319b696e3a65338b303870a77

SHA512
1b0923f22ac9e1056e7b770d647ae668b62ffc2b5a7f2dbba12a87e31251816ed88838289e3d8491d1dd3509f4d2f894429d631cf91323292555bb55b6618e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\89cd6019-60e4-450e-ae22-a19a6e93559a.vbs

Filesize
734B

MD5
2a73eeecc2387593560e85ef70463d05

SHA1
b470b3b8339810db9e3e8cd644b041ac8dc2a276

SHA256
de59b7de7d02b998b857740309658bb7476fbf502172a2aa650f59a5af8c06a3

SHA512
5ba378b56094f34ff4d14baedd8b90dfba0ce936595091f7175176962c29dae40f2a989c6faf7caa9eef4b882a47697c999aa50e789bb45bf83f4e5a57ebd076

Download Submit
C:\Users\Admin\AppData\Local\Temp\b5d7cecd-7421-40a5-9f1c-b01d3f177c3e.vbs

Filesize
734B

MD5
64d16721f6c5de5f73f690ddbfa2a8a7

SHA1
c189bb0052a1b13f991eb21161c47766fc9e6b16

SHA256
225becd733f04e7ca8c7a0b688c0bdf97bcdfb3d7cba7473b31993481723ddf4

SHA512
3c9bb8af62ffe6e202eb6fdb467d056b8e86219ae5f787e8c49c5914ce73f43004f733c864cf0daa3c7b1b6e68715ce6b9bb484fe6d2aa18782d4ce4a095e1e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3537b26-39df-44b8-b4ce-2caa52e9edb0.vbs

Filesize
733B

MD5
01a84e1a661cb51976471f724ddec055

SHA1
18e28edf7244cf54c112f7f049440f14e4b7f905

SHA256
f4bf72c826d947de83295239cc70019b18f7995e16b0a58d13961dc4e9438575

SHA512
b611defe368829586bcfb76935a8260d41042bcc783db53cf68acba90353e17112277463dca5a6d4e03e963358f5f159c349b07e7ae59dc3a116c05f5ecfeb2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBFF5.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f78e8696645f7a6823d332bed31de0d9

SHA1
4b21730f875cfe50ffe1ae5422f2904b4b96125c

SHA256
1581343f702301185b0e994fff13b4e2fbc2cab8a4292c04be8b9451d1532b93

SHA512
64c439931f3addb3d21cb08bdbd9a7f7469226f01c4e34a8045f4b6442b72ca10689871bc3ed9c0dc53e78a20e5aff3d33662a2c75f9a3938c425f54e975bcb8

Download Submit
memory/844-158-0x00000000013B0000-0x00000000018A4000-memory.dmp

Filesize
5.0MB

Download
memory/844-159-0x0000000000520000-0x0000000000532000-memory.dmp

Filesize
72KB

Download
memory/1284-93-0x0000000000F20000-0x0000000001414000-memory.dmp

Filesize
5.0MB

Download
memory/1284-129-0x0000000000CD0000-0x0000000000CE2000-memory.dmp

Filesize
72KB

Download
memory/2608-244-0x0000000000020000-0x0000000000514000-memory.dmp

Filesize
5.0MB

Download
memory/2788-89-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/2800-143-0x00000000012E0000-0x00000000017D4000-memory.dmp

Filesize
5.0MB

Download
memory/2848-260-0x0000000000920000-0x0000000000932000-memory.dmp

Filesize
72KB

Download
memory/2848-259-0x00000000002D0000-0x00000000007C4000-memory.dmp

Filesize
5.0MB

Download
memory/2928-88-0x000000001B4C0000-0x000000001B7A2000-memory.dmp

Filesize
2.9MB

Download
memory/3048-10-0x00000000009B0000-0x00000000009C2000-memory.dmp

Filesize
72KB

Download
memory/3048-6-0x00000000007B0000-0x00000000007C0000-memory.dmp

Filesize
64KB

Download
memory/3048-12-0x0000000000A50000-0x0000000000A5E000-memory.dmp

Filesize
56KB

Download
memory/3048-14-0x0000000000A70000-0x0000000000A78000-memory.dmp

Filesize
32KB

Download
memory/3048-11-0x0000000000A40000-0x0000000000A4A000-memory.dmp

Filesize
40KB

Download
memory/3048-102-0x000007FEF58B0000-0x000007FEF629C000-memory.dmp

Filesize
9.9MB

Download
memory/3048-9-0x0000000000820000-0x000000000082A000-memory.dmp

Filesize
40KB

Download
memory/3048-8-0x0000000000810000-0x0000000000820000-memory.dmp

Filesize
64KB

Download
memory/3048-7-0x00000000007F0000-0x0000000000806000-memory.dmp

Filesize
88KB

Download
memory/3048-13-0x0000000000A60000-0x0000000000A6E000-memory.dmp

Filesize
56KB

Download
memory/3048-5-0x0000000000790000-0x0000000000798000-memory.dmp

Filesize
32KB

Download
memory/3048-4-0x00000000007D0000-0x00000000007EC000-memory.dmp

Filesize
112KB

Download
memory/3048-3-0x000000001B630000-0x000000001B75E000-memory.dmp

Filesize
1.2MB

Download
memory/3048-15-0x0000000000A80000-0x0000000000A88000-memory.dmp

Filesize
32KB

Download
memory/3048-2-0x000007FEF58B0000-0x000007FEF629C000-memory.dmp

Filesize
9.9MB

Download
memory/3048-0-0x000007FEF58B3000-0x000007FEF58B4000-memory.dmp

Filesize
4KB

Download
memory/3048-16-0x00000000025B0000-0x00000000025BC000-memory.dmp

Filesize
48KB

Download
memory/3048-1-0x0000000000020000-0x0000000000514000-memory.dmp

Filesize
5.0MB

Download