dcrat | f19f7803a88945eb9370a47e0ac9c59a2f25d9a18c2af844298dbdfcc5177ddf

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-09-2024 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trojan.MSIL.Siggen.exe
Size

4.9MB
MD5

fa6a70b32304b41f2ca98115cae843f0
SHA1

15e0536c0b4be4fca7ee2a03a7e40a4075a18950
SHA256

f19f7803a88945eb9370a47e0ac9c59a2f25d9a18c2af844298dbdfcc5177ddf
SHA512

6226c2d25875e7b7fc930094ebfb6cbc67dfd4c52c0c3211adcf3a18c0ca5b9b6d5d68312dc44522fd8b36b777cd2cee0c201c24228e751d1e8e506491839279
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	2884	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2884	schtasks.exe

UAC bypass 3 TTPs 27 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

wininit.exewininit.exewininit.exeTrojan.MSIL.Siggen.exewininit.exewininit.exewininit.exewininit.exewininit.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Trojan.MSIL.Siggen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan.MSIL.Siggen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Trojan.MSIL.Siggen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/948-2-0x000000001B830000-0x000000001B95E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
2392	powershell.exe
1208	powershell.exe
924	powershell.exe
956	powershell.exe
3036	powershell.exe
2492	powershell.exe
2584	powershell.exe
1956	powershell.exe
288	powershell.exe
1624	powershell.exe
920	powershell.exe
3004	powershell.exe

Executes dropped EXE 8 IoCs

Processes:

wininit.exewininit.exewininit.exewininit.exewininit.exewininit.exewininit.exewininit.exe

pid process

2508 wininit.exe
1736 wininit.exe
2876 wininit.exe
388 wininit.exe
864 wininit.exe
2344 wininit.exe
2816 wininit.exe
1684 wininit.exe

pid	process
2508	wininit.exe
1736	wininit.exe
2876	wininit.exe
388	wininit.exe
864	wininit.exe
2344	wininit.exe
2816	wininit.exe
1684	wininit.exe

Checks whether UAC is enabled 1 TTPs 18 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

wininit.exewininit.exewininit.exewininit.exewininit.exeTrojan.MSIL.Siggen.exewininit.exewininit.exewininit.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Trojan.MSIL.Siggen.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan.MSIL.Siggen.exe

Drops file in Program Files directory 8 IoCs

Processes:

Trojan.MSIL.Siggen.exe

description	ioc	process
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe	Trojan.MSIL.Siggen.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\886983d96e3d3e	Trojan.MSIL.Siggen.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\sppsvc.exe	Trojan.MSIL.Siggen.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\0a1fd5f707cd16	Trojan.MSIL.Siggen.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RCX17EB.tmp	Trojan.MSIL.Siggen.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe	Trojan.MSIL.Siggen.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\RCX1A0E.tmp	Trojan.MSIL.Siggen.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\sppsvc.exe	Trojan.MSIL.Siggen.exe

Drops file in Windows directory 4 IoCs

Processes:

Trojan.MSIL.Siggen.exe

description	ioc	process
File created	C:\Windows\BitLockerDiscoveryVolumeContents\wininit.exe	Trojan.MSIL.Siggen.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\56085415360792	Trojan.MSIL.Siggen.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\RCX155B.tmp	Trojan.MSIL.Siggen.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\wininit.exe	Trojan.MSIL.Siggen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	process
2420	schtasks.exe
1644	schtasks.exe
1200	schtasks.exe
2240	schtasks.exe
2088	schtasks.exe
784	schtasks.exe
2676	schtasks.exe
2968	schtasks.exe
2800	schtasks.exe
2252	schtasks.exe
2992	schtasks.exe
2424	schtasks.exe
688	schtasks.exe
2132	schtasks.exe
2448	schtasks.exe
2308	schtasks.exe
2636	schtasks.exe
2700	schtasks.exe
1680	schtasks.exe
1940	schtasks.exe
3044	schtasks.exe
2680	schtasks.exe
2468	schtasks.exe
2172	schtasks.exe
2984	schtasks.exe
2900	schtasks.exe
2932	schtasks.exe
2456	schtasks.exe
2236	schtasks.exe
1980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

Trojan.MSIL.Siggen.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewininit.exewininit.exewininit.exewininit.exewininit.exewininit.exewininit.exewininit.exe

pid	process
948	Trojan.MSIL.Siggen.exe
948	Trojan.MSIL.Siggen.exe
948	Trojan.MSIL.Siggen.exe
920	powershell.exe
1956	powershell.exe
3036	powershell.exe
956	powershell.exe
288	powershell.exe
2492	powershell.exe
924	powershell.exe
2392	powershell.exe
1208	powershell.exe
1624	powershell.exe
2584	powershell.exe
3004	powershell.exe
2508	wininit.exe
1736	wininit.exe
2876	wininit.exe
388	wininit.exe
864	wininit.exe
2344	wininit.exe
2816	wininit.exe
1684	wininit.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	948	Trojan.MSIL.Siggen.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeDebugPrivilege	288	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	924	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	2508	wininit.exe
Token: SeDebugPrivilege	1736	wininit.exe
Token: SeDebugPrivilege	2876	wininit.exe
Token: SeDebugPrivilege	388	wininit.exe
Token: SeDebugPrivilege	864	wininit.exe
Token: SeDebugPrivilege	2344	wininit.exe
Token: SeDebugPrivilege	2816	wininit.exe
Token: SeDebugPrivilege	1684	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Trojan.MSIL.Siggen.execmd.exewininit.exeWScript.exewininit.exeWScript.exewininit.exe

description	pid	process	target process
PID 948 wrote to memory of 924	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 924	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 924	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 1208	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 1208	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 1208	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 3004	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 3004	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 3004	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 956	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 956	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 956	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 920	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 920	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 920	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 1624	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 1624	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 1624	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 288	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 288	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 288	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 2392	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 2392	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 2392	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 1956	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 1956	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 1956	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 2584	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 2584	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 2584	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 2492	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 2492	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 2492	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 3036	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 3036	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 3036	948	Trojan.MSIL.Siggen.exe	powershell.exe
PID 948 wrote to memory of 2348	948	Trojan.MSIL.Siggen.exe	cmd.exe
PID 948 wrote to memory of 2348	948	Trojan.MSIL.Siggen.exe	cmd.exe
PID 948 wrote to memory of 2348	948	Trojan.MSIL.Siggen.exe	cmd.exe
PID 2348 wrote to memory of 864	2348	cmd.exe	w32tm.exe
PID 2348 wrote to memory of 864	2348	cmd.exe	w32tm.exe
PID 2348 wrote to memory of 864	2348	cmd.exe	w32tm.exe
PID 2348 wrote to memory of 2508	2348	cmd.exe	wininit.exe
PID 2348 wrote to memory of 2508	2348	cmd.exe	wininit.exe
PID 2348 wrote to memory of 2508	2348	cmd.exe	wininit.exe
PID 2508 wrote to memory of 1688	2508	wininit.exe	WScript.exe
PID 2508 wrote to memory of 1688	2508	wininit.exe	WScript.exe
PID 2508 wrote to memory of 1688	2508	wininit.exe	WScript.exe
PID 2508 wrote to memory of 2044	2508	wininit.exe	WScript.exe
PID 2508 wrote to memory of 2044	2508	wininit.exe	WScript.exe
PID 2508 wrote to memory of 2044	2508	wininit.exe	WScript.exe
PID 1688 wrote to memory of 1736	1688	WScript.exe	wininit.exe
PID 1688 wrote to memory of 1736	1688	WScript.exe	wininit.exe
PID 1688 wrote to memory of 1736	1688	WScript.exe	wininit.exe
PID 1736 wrote to memory of 2008	1736	wininit.exe	WScript.exe
PID 1736 wrote to memory of 2008	1736	wininit.exe	WScript.exe
PID 1736 wrote to memory of 2008	1736	wininit.exe	WScript.exe
PID 1736 wrote to memory of 2684	1736	wininit.exe	WScript.exe
PID 1736 wrote to memory of 2684	1736	wininit.exe	WScript.exe
PID 1736 wrote to memory of 2684	1736	wininit.exe	WScript.exe
PID 2008 wrote to memory of 2876	2008	WScript.exe	wininit.exe
PID 2008 wrote to memory of 2876	2008	WScript.exe	wininit.exe
PID 2008 wrote to memory of 2876	2008	WScript.exe	wininit.exe
PID 2876 wrote to memory of 2456	2876	wininit.exe	WScript.exe

System policy modification 1 TTPs 27 IoCs

evasion

Modify Registry

T1112

Processes:

wininit.exewininit.exeTrojan.MSIL.Siggen.exewininit.exewininit.exewininit.exewininit.exewininit.exewininit.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Trojan.MSIL.Siggen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan.MSIL.Siggen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Trojan.MSIL.Siggen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Trojan.MSIL.Siggen.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.MSIL.Siggen.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1624

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\h26RurFrqG.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
3⤵
PID:864

C:\Users\All Users\Templates\wininit.exe
"C:\Users\All Users\Templates\wininit.exe"
3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2508

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9c06712-16a2-4c98-abb3-5004c6cac1e0.vbs"
4⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\All Users\Templates\wininit.exe
"C:\Users\All Users\Templates\wininit.exe"
5⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1736

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d06fe193-3437-4e5f-a59b-10dafbc6ec97.vbs"
6⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\All Users\Templates\wininit.exe
"C:\Users\All Users\Templates\wininit.exe"
7⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2876

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02b650c0-edc1-4355-8715-17c87e39e9a0.vbs"
8⤵
PID:2456

C:\Users\All Users\Templates\wininit.exe
"C:\Users\All Users\Templates\wininit.exe"
9⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:388

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da1a187c-5614-40a9-8628-515965bda3c1.vbs"
10⤵
PID:2292

C:\Users\All Users\Templates\wininit.exe
"C:\Users\All Users\Templates\wininit.exe"
11⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:864

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d6b8f87a-031d-4268-a8e4-a94f3acc319e.vbs"
12⤵
PID:1676

C:\Users\All Users\Templates\wininit.exe
"C:\Users\All Users\Templates\wininit.exe"
13⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2344

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8209b81-335f-4546-90aa-d65eb0047f04.vbs"
14⤵
PID:888

C:\Users\All Users\Templates\wininit.exe
"C:\Users\All Users\Templates\wininit.exe"
15⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2816

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a201cf64-b314-4862-81a7-c4d94b2561d9.vbs"
16⤵
PID:2524

C:\Users\All Users\Templates\wininit.exe
"C:\Users\All Users\Templates\wininit.exe"
17⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1684

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\63359417-a0d7-4168-907f-5d19d88d622f.vbs"
18⤵
PID:2484

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc63591d-6ea4-4366-9cbd-c3f28bdcc957.vbs"
18⤵
PID:2476

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c10aa9da-c99a-4a99-836d-e891156bc36f.vbs"
16⤵
PID:2264

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0fffbefa-6fa3-403c-86e0-cb905f80c085.vbs"
14⤵
PID:2640

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\728d8fe5-cf4c-4eda-9d1f-22a4c12ead64.vbs"
12⤵
PID:1660

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c94144d2-9121-4b5d-aa11-5cc1319be54f.vbs"
10⤵
PID:1996

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c968cff3-7b8f-4d34-a849-0c5c5dc9d58c.vbs"
8⤵
PID:2600

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c52b57a-2a6f-4df1-a498-3c0db43222c7.vbs"
6⤵
PID:2684

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d785f93f-cf76-41c2-b984-e63c0f68c7d1.vbs"
4⤵
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Microsoft Help\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft Help\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Microsoft Help\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Trojan.MSIL.SiggenT" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Trojan.MSIL.Siggen.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Trojan.MSIL.Siggen" /sc ONLOGON /tr "'C:\Users\All Users\Trojan.MSIL.Siggen.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Trojan.MSIL.SiggenT" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Trojan.MSIL.Siggen.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Downloads\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\Downloads\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Downloads\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Templates\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Templates\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Templates\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\02b650c0-edc1-4355-8715-17c87e39e9a0.vbs
Filesize
716B

MD5
238d4b81d9e4c6b372fe4df5959134d0

SHA1
24ec6addabf19155275ec523e35a0ed70a8dfc44

SHA256
ffcc013d6ba939ad19fc7a263bed935f8a818558bab07e6639123f20d65aa6a7

SHA512
96a402d128cd8017d11c5c6578827f6392efa71c71141e6c735a69df288c2289ef07e1c77d83401a308199602fc4d82064f73abf4feb738e7bdc34e779493c55

Download Submit
C:\Users\Admin\AppData\Local\Temp\63359417-a0d7-4168-907f-5d19d88d622f.vbs
Filesize
716B

MD5
47d4fa049c01c90b70c89b74472e0deb

SHA1
e8130f94d4fcfee63d1726e28068ddae754273d7

SHA256
ab36cd96b60cf170a09df4b3015b0da7452d8f9d89d6c102b83e74cc7bf6f5c5

SHA512
e1356fc06951ed7aff0f685900d92e6b921b0f24430cf302e317b5f6172eab666db207d235ae7bdd73f81b049aeab63f3b859e39e7f0d45723d48021fd195186

Download Submit
C:\Users\Admin\AppData\Local\Temp\790ae7fb75235c796e49c039207532319cbc2f9f.exe
Filesize
4.9MB

MD5
669def7102a3c4d112e2265180feaf6a

SHA1
9538bde73d9655c1f1afaf7919e9706f13ca71e4

SHA256
47732bcdc3423b0fd5d5e68db46c655c3b4fc6d0567ec1e8b15db949dec00547

SHA512
e9e37071b548be64b0339c1237b8898f82c87e06438a15c4cad8d5293d2bbbe02ff4d43ac77efcfd4ba16a263b327370526cdb0c24b041dd30c38b70a3b10e42

Download Submit
C:\Users\Admin\AppData\Local\Temp\a201cf64-b314-4862-81a7-c4d94b2561d9.vbs
Filesize
716B

MD5
a5d5e61b3b76fbc51f9bcdfa99d77370

SHA1
0cbc29964e2407c0ca72e56817bd3d82c26564da

SHA256
9aec8d278e6dc15684ebb50f0895647dcb2d1e37d39f0bc900c563cc9fb0377a

SHA512
870f891832ecf818d16e351965ee4f3bafe8f9c1932f93d1c9be7d439897f29641fc02a3450da64851675acdb3572816a4259a38dbb316c028e7eb565657581b

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9c06712-16a2-4c98-abb3-5004c6cac1e0.vbs
Filesize
716B

MD5
bfb9ee7cfd6c5501aa0a1debb7f0d4b5

SHA1
20a999ab70fca327eb2d52346a48bec3d3f8ee20

SHA256
4140bf08b13d818ebd2902306567f5db48b9e76afaab4fc5d4ea3d4538eae07b

SHA512
1d21a15d830c32c2435cd7353fc8f0ffb10ebadc9901648aa2113ca90fe48c4aa1c6051d1bb3255abed2a1958c5af6f72f9ee1cc357e38642ca26e15128c0327

Download Submit
C:\Users\Admin\AppData\Local\Temp\d06fe193-3437-4e5f-a59b-10dafbc6ec97.vbs
Filesize
716B

MD5
2136c05fa70082b093bfb74fac6495c1

SHA1
c27cc7a6609401856902c23212688f5f398891db

SHA256
ea8b42c7a821684946f0ac07a593bf95a92c3b870da32e282f0ac4679787b673

SHA512
1d04794aa894bd384eb6cc5cb8eab61b4e51a51b49461cac4b7e3f579e5c35f432b25d4b8cbf6f5fac51fff15334c80fa47ea93099c3689e001831732d18dc0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\d6b8f87a-031d-4268-a8e4-a94f3acc319e.vbs
Filesize
715B

MD5
1ad8269d062f20a86f654054ade18c25

SHA1
ef2ee73611688d189ebee3ca68a8b9138b4cfed6

SHA256
1554b41ae0cc7bb687c2ba6f8c69075ed6839a85a869f1cc0e3ab942c506a560

SHA512
ab808eec68d2916ee015243765fd2909a5197175490a062868c42fcc5ebe44676967a087300e82d360add438507e44a0f212ae6c14f74e71562a052bb39b34b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\d785f93f-cf76-41c2-b984-e63c0f68c7d1.vbs
Filesize
492B

MD5
5e30d35364b468cc151ebc2eced653a9

SHA1
4e9161babdf10b3aeae4054ce5d2beef609aa908

SHA256
010a23f77e4c4f4c9d397855305e0694b72f2fac07164236b1f5c85e62a790bf

SHA512
982acaddb0f7f0ffd8f87d4c10e0cc6615c19c36e16eae76b27376cb252d16f2f31396f3c098a74267cd1df2bcd1259c65b738f9a1139af7def8c997d24112e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\da1a187c-5614-40a9-8628-515965bda3c1.vbs
Filesize
715B

MD5
11af3be3f9cca8697949c343bee98d27

SHA1
77f25db2d1d0193cc9feb484c00ab7b4c4cfb095

SHA256
deb3ebc6f2a73a59838956335173eababe3bb0ef4c0ab5dfea945dd4f4368211

SHA512
b43e3841e71c5e2c2d05f2ddddfb56fee858c908c8e0c83e75f9083359dcf9218265d3039240aa5127bb2e2c9d90232123bc96487a7729f23937607d8d56ffbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\f8209b81-335f-4546-90aa-d65eb0047f04.vbs
Filesize
716B

MD5
140a1ff109ec24d8e27a7fc1af85c274

SHA1
076798e831332986ccd80e8415d9d044dcfffc3f

SHA256
5e8b1b49eb570c169abb4028a903eb8d0f21d19b5affeb41da9999e8c17498f8

SHA512
92c1c9085697d8f2734c47ef55f72f4403811ac6d42453be6affcd04630864610eb1dd0730b519202c2912fe2010dee54ebccecc66737f128d89cced2719956b

Download Submit
C:\Users\Admin\AppData\Local\Temp\h26RurFrqG.bat
Filesize
205B

MD5
31ac2256d1249cbb4cb9ad8907fdaf2c

SHA1
820fd0c55106123014a89d79f18247da1658dec1

SHA256
647c840c09c5be66462a3014398922c69a7dff0317db1f11efecf92ffdcb7e8f

SHA512
e6971dc5efaebbb30f71980c17233f338749f36fd7f7b39f547c4a9b5bf0fb53030a907ba051c010c304f1e25d526fa0557d3c05bef8563c053bb2b907dbf453

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5245.tmp.exe
Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
2299c5a820165b408660a608787433cb

SHA1
845b5e42e3007fdd5f21cab57bb3abd5dfd5df1d

SHA256
5ffa998e0f17c3a00d015c35cb78052fcfd85714abcedae2ca58f04d1e279641

SHA512
9a8377e981f3d0849534b34711dfc5d20e1a2ea8f07fcd9ea8ad4393d29cf28478194bcd8ab086d28fe1fc296a27a25be317ba625d4dac2c1ede7b6a907a175b

Download Submit
C:\Windows\BitLockerDiscoveryVolumeContents\wininit.exe
Filesize
4.9MB

MD5
fa6a70b32304b41f2ca98115cae843f0

SHA1
15e0536c0b4be4fca7ee2a03a7e40a4075a18950

SHA256
f19f7803a88945eb9370a47e0ac9c59a2f25d9a18c2af844298dbdfcc5177ddf

SHA512
6226c2d25875e7b7fc930094ebfb6cbc67dfd4c52c0c3211adcf3a18c0ca5b9b6d5d68312dc44522fd8b36b777cd2cee0c201c24228e751d1e8e506491839279

Download Submit
memory/388-228-0x0000000001250000-0x0000000001744000-memory.dmp

Filesize
5.0MB

Download
memory/948-0-0x000007FEF5F13000-0x000007FEF5F14000-memory.dmp

Filesize
4KB

Download
memory/948-15-0x0000000000650000-0x0000000000658000-memory.dmp

Filesize
32KB

Download
memory/948-16-0x0000000000660000-0x000000000066C000-memory.dmp

Filesize
48KB

Download
memory/948-97-0x000007FEF5F13000-0x000007FEF5F14000-memory.dmp

Filesize
4KB

Download
memory/948-112-0x000007FEF5F10000-0x000007FEF68FC000-memory.dmp

Filesize
9.9MB

Download
memory/948-13-0x00000000003B0000-0x00000000003BE000-memory.dmp

Filesize
56KB

Download
memory/948-128-0x000007FEF5F10000-0x000007FEF68FC000-memory.dmp

Filesize
9.9MB

Download
memory/948-10-0x0000000000380000-0x0000000000392000-memory.dmp

Filesize
72KB

Download
memory/948-9-0x0000000000370000-0x000000000037A000-memory.dmp

Filesize
40KB

Download
memory/948-12-0x00000000003A0000-0x00000000003AE000-memory.dmp

Filesize
56KB

Download
memory/948-2-0x000000001B830000-0x000000001B95E000-memory.dmp

Filesize
1.2MB

Download
memory/948-11-0x0000000000390000-0x000000000039A000-memory.dmp

Filesize
40KB

Download
memory/948-1-0x0000000000BD0000-0x00000000010C4000-memory.dmp

Filesize
5.0MB

Download
memory/948-3-0x000007FEF5F10000-0x000007FEF68FC000-memory.dmp

Filesize
9.9MB

Download
memory/948-6-0x0000000000330000-0x0000000000340000-memory.dmp

Filesize
64KB

Download
memory/948-8-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/948-4-0x0000000000300000-0x000000000031C000-memory.dmp

Filesize
112KB

Download
memory/948-7-0x0000000000340000-0x0000000000356000-memory.dmp

Filesize
88KB

Download
memory/948-5-0x0000000000320000-0x0000000000328000-memory.dmp

Filesize
32KB

Download
memory/948-14-0x0000000000640000-0x0000000000648000-memory.dmp

Filesize
32KB

Download
memory/1684-287-0x0000000000480000-0x0000000000492000-memory.dmp

Filesize
72KB

Download
memory/1736-198-0x00000000012E0000-0x00000000017D4000-memory.dmp

Filesize
5.0MB

Download
memory/2344-257-0x0000000000580000-0x0000000000592000-memory.dmp

Filesize
72KB

Download
memory/2508-184-0x0000000000250000-0x0000000000744000-memory.dmp

Filesize
5.0MB

Download
memory/2816-272-0x0000000000700000-0x0000000000712000-memory.dmp

Filesize
72KB

Download
memory/2876-213-0x00000000002F0000-0x00000000007E4000-memory.dmp

Filesize
5.0MB

Download
memory/3036-150-0x00000000024F0000-0x00000000024F8000-memory.dmp

Filesize
32KB

Download
memory/3036-138-0x000000001B190000-0x000000001B472000-memory.dmp

Filesize
2.9MB

Download