Analysis
-
max time kernel
119s -
max time network
114s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-09-2024 03:21
Static task
static1
Behavioral task
behavioral1
Sample
3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
Resource
win7-20240903-en
General
-
Target
3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
-
Size
4.9MB
-
MD5
3b6fd6541d4ddab0edbd51aa2f87e2b0
-
SHA1
a3e3dd0b42b506cab76d452088db7555dbdfa9fc
-
SHA256
ae9589d8290da8ddfbc081f3ecdb50857abcb22a7977d0c957f81b625a361781
-
SHA512
e9a5689f29ca646e76f5699a26a0ae5ed1b6a9e3a10260571f95ec15da1bb4bea1cf216035b4cbbe3a004884a233885d6cb779335de73b3f9521095994dd2b4a
-
SSDEEP
49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 21 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2724 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2808 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2672 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2556 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2992 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2996 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2012 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2980 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2584 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2428 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2128 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2532 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1308 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 652 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1884 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 552 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 800 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2864 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2840 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1212 2736 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 852 2736 schtasks.exe 30 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe -
resource yara_rule behavioral1/memory/1876-2-0x000000001BA30000-0x000000001BB5E000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3032 powershell.exe 2496 powershell.exe 1396 powershell.exe 1740 powershell.exe 2432 powershell.exe 568 powershell.exe 2500 powershell.exe 236 powershell.exe 1644 powershell.exe 1400 powershell.exe 2916 powershell.exe 1848 powershell.exe -
Executes dropped EXE 13 IoCs
pid Process 2664 Idle.exe 2296 Idle.exe 1516 Idle.exe 2840 Idle.exe 1732 Idle.exe 824 Idle.exe 2216 Idle.exe 2788 Idle.exe 2108 Idle.exe 2220 Idle.exe 2140 Idle.exe 2124 Idle.exe 2892 Idle.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Idle.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Idle.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Idle.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Idle.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Idle.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Idle.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Idle.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe -
Drops file in Program Files directory 12 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\24dbde2999530e 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File created C:\Program Files (x86)\Google\Temp\lsass.exe 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File created C:\Program Files\Internet Explorer\en-US\6cb0b6c459d5d3 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\RCXB4D.tmp 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\WmiPrvSE.exe 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File opened for modification C:\Program Files (x86)\Google\Temp\RCXDCD.tmp 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File opened for modification C:\Program Files\Internet Explorer\en-US\RCXFF0.tmp 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\WmiPrvSE.exe 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File created C:\Program Files (x86)\Google\Temp\6203df4a6bafc7 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File created C:\Program Files\Internet Explorer\en-US\dwm.exe 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File opened for modification C:\Program Files (x86)\Google\Temp\lsass.exe 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File opened for modification C:\Program Files\Internet Explorer\en-US\dwm.exe 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Web\6ccacd8608530f 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File created C:\Windows\tracing\csrss.exe 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File created C:\Windows\tracing\886983d96e3d3e 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File opened for modification C:\Windows\Web\RCX521.tmp 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File opened for modification C:\Windows\Web\Idle.exe 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File opened for modification C:\Windows\tracing\RCX744.tmp 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File opened for modification C:\Windows\tracing\csrss.exe 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe File created C:\Windows\Web\Idle.exe 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 652 schtasks.exe 1884 schtasks.exe 800 schtasks.exe 2864 schtasks.exe 2992 schtasks.exe 2012 schtasks.exe 2428 schtasks.exe 552 schtasks.exe 2724 schtasks.exe 2808 schtasks.exe 2980 schtasks.exe 1308 schtasks.exe 1212 schtasks.exe 852 schtasks.exe 2672 schtasks.exe 2584 schtasks.exe 2128 schtasks.exe 2840 schtasks.exe 2556 schtasks.exe 2996 schtasks.exe 2532 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 1400 powershell.exe 236 powershell.exe 2496 powershell.exe 2432 powershell.exe 568 powershell.exe 2500 powershell.exe 1848 powershell.exe 1396 powershell.exe 1740 powershell.exe 3032 powershell.exe 1644 powershell.exe 2916 powershell.exe 2664 Idle.exe 2296 Idle.exe 1516 Idle.exe 2840 Idle.exe 1732 Idle.exe 824 Idle.exe 2216 Idle.exe 2788 Idle.exe 2108 Idle.exe 2220 Idle.exe 2140 Idle.exe 2124 Idle.exe 2892 Idle.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeDebugPrivilege 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe Token: SeDebugPrivilege 1400 powershell.exe Token: SeDebugPrivilege 236 powershell.exe Token: SeDebugPrivilege 2496 powershell.exe Token: SeDebugPrivilege 2432 powershell.exe Token: SeDebugPrivilege 568 powershell.exe Token: SeDebugPrivilege 2500 powershell.exe Token: SeDebugPrivilege 1848 powershell.exe Token: SeDebugPrivilege 1396 powershell.exe Token: SeDebugPrivilege 1740 powershell.exe Token: SeDebugPrivilege 3032 powershell.exe Token: SeDebugPrivilege 1644 powershell.exe Token: SeDebugPrivilege 2916 powershell.exe Token: SeDebugPrivilege 2664 Idle.exe Token: SeDebugPrivilege 2296 Idle.exe Token: SeDebugPrivilege 1516 Idle.exe Token: SeDebugPrivilege 2840 Idle.exe Token: SeDebugPrivilege 1732 Idle.exe Token: SeDebugPrivilege 824 Idle.exe Token: SeDebugPrivilege 2216 Idle.exe Token: SeDebugPrivilege 2788 Idle.exe Token: SeDebugPrivilege 2108 Idle.exe Token: SeDebugPrivilege 2220 Idle.exe Token: SeDebugPrivilege 2140 Idle.exe Token: SeDebugPrivilege 2124 Idle.exe Token: SeDebugPrivilege 2892 Idle.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1876 wrote to memory of 3032 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 53 PID 1876 wrote to memory of 3032 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 53 PID 1876 wrote to memory of 3032 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 53 PID 1876 wrote to memory of 2500 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 54 PID 1876 wrote to memory of 2500 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 54 PID 1876 wrote to memory of 2500 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 54 PID 1876 wrote to memory of 236 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 56 PID 1876 wrote to memory of 236 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 56 PID 1876 wrote to memory of 236 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 56 PID 1876 wrote to memory of 2496 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 57 PID 1876 wrote to memory of 2496 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 57 PID 1876 wrote to memory of 2496 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 57 PID 1876 wrote to memory of 1644 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 59 PID 1876 wrote to memory of 1644 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 59 PID 1876 wrote to memory of 1644 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 59 PID 1876 wrote to memory of 568 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 61 PID 1876 wrote to memory of 568 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 61 PID 1876 wrote to memory of 568 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 61 PID 1876 wrote to memory of 2432 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 62 PID 1876 wrote to memory of 2432 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 62 PID 1876 wrote to memory of 2432 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 62 PID 1876 wrote to memory of 1848 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 63 PID 1876 wrote to memory of 1848 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 63 PID 1876 wrote to memory of 1848 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 63 PID 1876 wrote to memory of 1400 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 64 PID 1876 wrote to memory of 1400 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 64 PID 1876 wrote to memory of 1400 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 64 PID 1876 wrote to memory of 2916 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 65 PID 1876 wrote to memory of 2916 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 65 PID 1876 wrote to memory of 2916 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 65 PID 1876 wrote to memory of 1396 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 66 PID 1876 wrote to memory of 1396 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 66 PID 1876 wrote to memory of 1396 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 66 PID 1876 wrote to memory of 1740 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 67 PID 1876 wrote to memory of 1740 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 67 PID 1876 wrote to memory of 1740 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 67 PID 1876 wrote to memory of 2664 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 77 PID 1876 wrote to memory of 2664 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 77 PID 1876 wrote to memory of 2664 1876 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe 77 PID 2664 wrote to memory of 704 2664 Idle.exe 78 PID 2664 wrote to memory of 704 2664 Idle.exe 78 PID 2664 wrote to memory of 704 2664 Idle.exe 78 PID 2664 wrote to memory of 2156 2664 Idle.exe 79 PID 2664 wrote to memory of 2156 2664 Idle.exe 79 PID 2664 wrote to memory of 2156 2664 Idle.exe 79 PID 704 wrote to memory of 2296 704 WScript.exe 80 PID 704 wrote to memory of 2296 704 WScript.exe 80 PID 704 wrote to memory of 2296 704 WScript.exe 80 PID 2296 wrote to memory of 796 2296 Idle.exe 81 PID 2296 wrote to memory of 796 2296 Idle.exe 81 PID 2296 wrote to memory of 796 2296 Idle.exe 81 PID 2296 wrote to memory of 1324 2296 Idle.exe 82 PID 2296 wrote to memory of 1324 2296 Idle.exe 82 PID 2296 wrote to memory of 1324 2296 Idle.exe 82 PID 796 wrote to memory of 1516 796 WScript.exe 83 PID 796 wrote to memory of 1516 796 WScript.exe 83 PID 796 wrote to memory of 1516 796 WScript.exe 83 PID 1516 wrote to memory of 2356 1516 Idle.exe 84 PID 1516 wrote to memory of 2356 1516 Idle.exe 84 PID 1516 wrote to memory of 2356 1516 Idle.exe 84 PID 1516 wrote to memory of 1952 1516 Idle.exe 85 PID 1516 wrote to memory of 1952 1516 Idle.exe 85 PID 1516 wrote to memory of 1952 1516 Idle.exe 85 PID 2356 wrote to memory of 2840 2356 WScript.exe 86 -
System policy modification 1 TTPs 42 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Idle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Idle.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe"C:\Users\Admin\AppData\Local\Temp\3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1876 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:236
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2496
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:568
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2432
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1400
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1740
-
-
C:\Windows\Web\Idle.exe"C:\Windows\Web\Idle.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2664 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b1d6d79-1336-4777-af8a-93f25812b22a.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\Web\Idle.exeC:\Windows\Web\Idle.exe4⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2296 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6ebc0e66-06fd-419d-8066-3ffbfd26453b.vbs"5⤵
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\Web\Idle.exeC:\Windows\Web\Idle.exe6⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1516 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05bab65b-92e6-43e4-83da-3fdd4ab2d04d.vbs"7⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\Web\Idle.exeC:\Windows\Web\Idle.exe8⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2840 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4b82b5b-dcd6-4857-b3ed-1106231dd29f.vbs"9⤵PID:1840
-
C:\Windows\Web\Idle.exeC:\Windows\Web\Idle.exe10⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1732 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\282582a3-d3df-4529-86a4-b63a1d12e69a.vbs"11⤵PID:2208
-
C:\Windows\Web\Idle.exeC:\Windows\Web\Idle.exe12⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:824 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e9ad122c-4ef9-4b35-8155-9315ab08e794.vbs"13⤵PID:1772
-
C:\Windows\Web\Idle.exeC:\Windows\Web\Idle.exe14⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2216 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\854c6dd5-969b-46da-b107-c51aa3bd36e7.vbs"15⤵PID:2444
-
C:\Windows\Web\Idle.exeC:\Windows\Web\Idle.exe16⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2788 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9322b511-65bf-4673-88e5-da190e5b7d97.vbs"17⤵PID:2356
-
C:\Windows\Web\Idle.exeC:\Windows\Web\Idle.exe18⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2108 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bf4736ee-5e0c-408e-8b3b-565d8deca95a.vbs"19⤵PID:2860
-
C:\Windows\Web\Idle.exeC:\Windows\Web\Idle.exe20⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2220 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7607a6b2-1016-4ab1-a53f-3fffe681df07.vbs"21⤵PID:2700
-
C:\Windows\Web\Idle.exeC:\Windows\Web\Idle.exe22⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2140 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0e623e6-bb31-4e9a-91a4-cbb0a5c86b4d.vbs"23⤵PID:1588
-
C:\Windows\Web\Idle.exeC:\Windows\Web\Idle.exe24⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2124 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8929ea2d-2e02-4fd7-94e6-62369a4e3010.vbs"25⤵PID:2628
-
C:\Windows\Web\Idle.exeC:\Windows\Web\Idle.exe26⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2892 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c884a8b5-e739-482b-84e6-1dce127de029.vbs"27⤵PID:2292
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c5b347c2-083d-40e7-992e-60fde1c6b023.vbs"27⤵PID:2212
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\405c7986-d74f-4a09-9bb1-99866345fcf3.vbs"25⤵PID:1400
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4b469f34-18ee-47e6-a4f0-293029562b87.vbs"23⤵PID:1884
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d16a86f5-a28d-47c9-814e-e75d949d5036.vbs"21⤵PID:2572
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ebef3c7c-b642-4180-96fd-4669db5fbca6.vbs"19⤵PID:2228
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1a1620b-7d6f-4363-8027-96a50dbb39e4.vbs"17⤵PID:2348
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0ce5b1bb-7f34-4600-bb78-3d31480576b5.vbs"15⤵PID:2200
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\752f93ea-ce07-4187-a23a-fb1022b10d85.vbs"13⤵PID:2428
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d62ff8e9-47f2-4265-b888-2491c30e95a2.vbs"11⤵PID:2744
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\838673e7-743d-464e-9204-be5895e0b78d.vbs"9⤵PID:2752
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ffe47dfb-0cc9-49c9-9d3e-23423cd375e9.vbs"7⤵PID:1952
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dcaff32e-4927-4d8b-bb73-4c0c43c60e9a.vbs"5⤵PID:1324
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb642d0c-2002-4ee3-8fd1-f67ac21c997e.vbs"3⤵PID:2156
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Desktop\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Desktop\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Desktop\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Windows\Web\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Web\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Windows\Web\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\tracing\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\tracing\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\tracing\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\Temp\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Temp\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\en-US\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\en-US\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\en-US\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:852
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD54da0fa1d316e3677dab4cb71b9006664
SHA1cac130a6b11bf8e153f7be2dede3ed23998f3833
SHA256aa928bf1d6ecbc4f184f8f7d85d740e47a427351cb7c0e63ac8567114ae216f9
SHA512a2f45fe81c84490b9b373e54b19e3862137514430c1229ff27a984c66c09555be9e3aaea29bd382c0f2db87aebf6d44f916bfe6020fab703a22a6fc6506024b4
-
Filesize
4.9MB
MD53b6fd6541d4ddab0edbd51aa2f87e2b0
SHA1a3e3dd0b42b506cab76d452088db7555dbdfa9fc
SHA256ae9589d8290da8ddfbc081f3ecdb50857abcb22a7977d0c957f81b625a361781
SHA512e9a5689f29ca646e76f5699a26a0ae5ed1b6a9e3a10260571f95ec15da1bb4bea1cf216035b4cbbe3a004884a233885d6cb779335de73b3f9521095994dd2b4a
-
Filesize
4.9MB
MD5161482f28fe02bf9d6d598623e119cc9
SHA1ede1f8e92055797ad63397c2fd7424c1922e3352
SHA256c2f5b69e9491edfa5a20a04c51fe057786193970cdd39932a102c34de2bd68a7
SHA51222ca5482501a62ed65c1ed138410ee29925455b080893d58299d58ede665c57da8505f94aba5513ea8dc75f3a4351ed9f48219e80ddb00eb9e00912f80511494
-
Filesize
699B
MD56b5c6d402c762a5d920d857f8ca06a29
SHA1f93462938c913eff761d18cbcd7c1df5b67afa32
SHA256f0c9797f79c38b061248084718164676de3dad3d7b6548a7b341e5e1924c4b86
SHA512024c57a302e15941f444441d85b9a19d1dd08682fe78be8661efd237a7dea2a483257181b9d9497efb62a0c6bbd5fc55c9f9f6d223b6a947e3fd047da58015b9
-
Filesize
699B
MD5017207a6697a2fb2afb198326d7334ea
SHA1794a654890c8e98ef296939f86ef6562555695da
SHA2567ba5ee7e842416d47e63390bfbfd9692348fda66f2091dba024a72a55faf61c6
SHA5120f7e5c9f1434c68c4dac8f6e7fb44de5bd79176ace7425e0209557404d5ebcdf940f5b8dee17e64b2056d244fe3d1f3a5202788a7e6f8563c15d3ae9087ffadd
-
Filesize
699B
MD54c02b58cb787e45e22413f923fad25b2
SHA14f4b613473f075f8cc6891b37b141c98342d3bb4
SHA256ba1ab0d744b5e1bc7f937d4a74882e63b94eec2dad1ac0f86bc9f1fc66b74e7c
SHA5123f3dbc295ce693bdcfb23aaf934731e7e14e85578cef72f77d37092322a9e33a86afbf8319949ca907e0cc79b570856402f7a06864c6aae14932c990bc2f22db
-
Filesize
699B
MD5c54668aa152e9c8a65c6f938765a1972
SHA182005ff83808345360ce1d5d020cf318103af52b
SHA25654fee26aaf1e372264fae60eafcb13c0831f19c3ad5f0f4ad7a471f898c8fddb
SHA512b01bfb43aef1ac64653619652444d077080674b223d4557324e5dc210c820e27f237db7426f3b9fcc0f827f0cd5462108b6be4fec1e356ace68c88a6b6693ad5
-
Filesize
699B
MD5bcf14e7a136f2ef0b452f3ab93e461b5
SHA16c3383bd3d137ad152ba9e8ab4cb5ca36e46849b
SHA256786b931c6ee30942ffaf5b3d02ebe5169d82bed3a42b546828652f503f0d6ac3
SHA5129d2bcd86180559995c1f1fe22ae52882047ef010f647a84d2405302475f0efa401ca0613468a42370d396788535a521ab1b6cce94d72cc6377d8912d1fd15257
-
Filesize
699B
MD5fe9b666df3266e7bce76b1ae4d366775
SHA187bb331a22d3a0b41968da0a73292595748c14e7
SHA256da94de94a8ba8716be4e55565b57038ba7d08acd17e70ebb025dec25fe9bebf1
SHA512e35b7a63f81488da08279210484a25050e09a7a8f98476a95f12f93a8273c0ef19476ff90382367bb04aa6b67ce85c690cb721ec4b0bfba22f5afd6c10d2898d
-
Filesize
699B
MD5c0b463a289fe4b106abb2cba9346662e
SHA156ab8c7b48dda5013cd266c89fec492b77675204
SHA2567e37f0eb25c2b8d3f3a4b3d2d5227b8f121a7eea87106d23800bc1a608fb4dad
SHA512be3970cde4f2e6f1b342d329593ce24bf972a77a53c11cb6ba3f9a88a017829ef6c751bfbd7724f860f001c1499e49735eefe236b323979bdf7598aa4dd618a8
-
Filesize
699B
MD5c5961e3a3b3c2a87c0792300a5c574f9
SHA16472e68d37fa985f202343d23949d0c07d912a4d
SHA25623c882dfa10ae8ae24c9df126025b8b40ed681631435cd34b7220144ca2a1416
SHA5129683241e218c2b79fa69d1e1a3ddfcf5eaee4855834f9cda49a22e80a07bc8a304542d1fc8ff648524970a9e70939236bc176cb5a5aa87778f90d9d6b208ab7d
-
Filesize
475B
MD5d074fd37d4ee14b905b1a91279ab81ed
SHA1b14d2d448f407fc64d39eb4ca6a0b7faf3e3cc33
SHA256bada857a52d72b19d1f4de996e8ad3aec45c0fbe0a5709154ac4b07ae4104fd1
SHA51263d89e5e3886b5bd22e8bf7b91a6f046d09d15c01101a4cc024096dd8cf30dfb2dedbec50de7384b1f8fc86724925538dacb09fe0efb72a5ea1284a976edb99c
-
Filesize
699B
MD5fd5bdd8376d0eaaffc18ba98f0af572d
SHA1a89b847924d98dfe1b4ebc1646217793021efd7b
SHA2568fb09afb7174632703de0a6d45e8248d002dacc2e43f48c4ae65ab4d8caa898f
SHA512b23afb036802b3566cb5d5394b34c251ea68196c1dc044e038db5bd7078bb148671710f40d406b5e5e34ae0da65ab22c61449086b5850f75971fac17ad864428
-
Filesize
699B
MD57c26b41a4a41b5cbb161854b629d1c4a
SHA16fd8297037045933fa8c4a28770ea494e7d393c0
SHA256cc2ac9bd179cb141f48da6e403586e067f361425f9238157a05a7cdacb3738d2
SHA512a65b47bda848c7a5b63ea1096d23f8ee155dbd0440f82a7bcf7389cd93b2e09e1e91b457ef293b15b5ed08ed86454621eee3f4804c44e14c5b5427bae5325a1f
-
Filesize
698B
MD5a7ac85151a22cb6f97c586a8f1887471
SHA1e41f40e5da8d6275c1ea1a5b1696d712b0f7c561
SHA256ce9fb0a539ed09f3815270a2700b98dec5dc36acaebd7e7bc145c6e7b022de8c
SHA512cce2efb96ee99cf6be81aac48fe144acc19db4cc0986e6f22a6d65ad3d37dff8556c3f5b88c25baf86ac46570623359ac144861415a5bf2753e7859ac0afed35
-
Filesize
699B
MD5061daa79193ac92b7b1a349b8e658932
SHA1d6d2ef7219fcc538f2530c1c39c90962ff04644c
SHA25657b6e2c8b455d4653b728c078d7a3e22fbeffb8aeb4f062cee1bc69c7f7d286b
SHA5120677b74036a8878b6467a375892952c7145ea7ee76531b47e83a3ff3a5ac0d1dc086505625a627eb9cd11d9f0e500e8ae4fecf1f24ab2f4063f03818fd26db08
-
Filesize
699B
MD511099c7e51bab42c02981897894bba95
SHA1e80b839f0b1708077ae63f3c4bbb31a1d999a76f
SHA25673e5d36f1f715bf06c023e497b6eee4395276eb2c6d7c5abd60117450504ac3e
SHA512e42418c5793463d2cb0b3e4fb81b63aa62362631915f59716f3a8bf349a0e138d6a8eb5c132c972a1b20f000d8b061628113969a8619702df4f1ee4c4f65d93c
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD59fd29ca31d81027774400d3ddee0ab91
SHA187fda6b9abd1ed8a92bb54d2ba605d45ec3f1c7c
SHA25621dbe75851d880e0494012fded4488912bfc6ab3364bc38c214879268f11cb64
SHA5120e73414b0207c3793515612b6dde841c9a04ae30aeb3b81b688517fe8ad481238641b2748f0987d188cc88842b1cc44f026a8b91a3fa12e29189437aa835fb30