dcrat | 37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dc

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-09-2024 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe
Size

4.9MB
MD5

549a897f0c0298c512c30faf8a911840
SHA1

77864449acf9065d7522006aec1bc67b543cb514
SHA256

37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dc
SHA512

481f73e8a9160def609cd28ec9d97398d66163c240a4d63f77686bfa2c99dddb5f7a9df0731c46309e8a1d19bed59d62e358e0ace10ec793731d3690df8bdd4e
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2184	schtasks.exe	30

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

lsass.exelsass.exe37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/1520-3-0x000000001B590000-0x000000001B6BE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2724	powershell.exe
2632	powershell.exe
2848	powershell.exe
3004	powershell.exe
2648	powershell.exe
2660	powershell.exe
2760	powershell.exe
2700	powershell.exe
2584	powershell.exe
2580	powershell.exe
2600	powershell.exe
2628	powershell.exe

Executes dropped EXE 12 IoCs

Processes:

lsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exe

pid	Process
2332	lsass.exe
2636	lsass.exe
660	lsass.exe
2876	lsass.exe
1620	lsass.exe
1592	lsass.exe
3024	lsass.exe
1144	lsass.exe
3048	lsass.exe
2788	lsass.exe
2436	lsass.exe
1196	lsass.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

lsass.exelsass.exelsass.exelsass.exelsass.exelsass.exe37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe

Drops file in Program Files directory 4 IoCs

Processes:

37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\lsass.exe	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe
File created	C:\Program Files (x86)\Reference Assemblies\6203df4a6bafc7	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\RCXBE90.tmp	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\lsass.exe	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
2716	schtasks.exe
2944	schtasks.exe
2936	schtasks.exe
2844	schtasks.exe
2480	schtasks.exe
2696	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exe

pid	Process
1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe
2760	powershell.exe
2584	powershell.exe
2600	powershell.exe
2724	powershell.exe
2632	powershell.exe
2660	powershell.exe
3004	powershell.exe
2580	powershell.exe
2700	powershell.exe
2648	powershell.exe
2848	powershell.exe
2628	powershell.exe
2332	lsass.exe
2636	lsass.exe
660	lsass.exe
2876	lsass.exe
1620	lsass.exe
1592	lsass.exe
3024	lsass.exe
1144	lsass.exe
3048	lsass.exe
2788	lsass.exe
2436	lsass.exe
1196	lsass.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

description	pid	Process
Token: SeDebugPrivilege	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	2332	lsass.exe
Token: SeDebugPrivilege	2636	lsass.exe
Token: SeDebugPrivilege	660	lsass.exe
Token: SeDebugPrivilege	2876	lsass.exe
Token: SeDebugPrivilege	1620	lsass.exe
Token: SeDebugPrivilege	1592	lsass.exe
Token: SeDebugPrivilege	3024	lsass.exe
Token: SeDebugPrivilege	1144	lsass.exe
Token: SeDebugPrivilege	3048	lsass.exe
Token: SeDebugPrivilege	2788	lsass.exe
Token: SeDebugPrivilege	2436	lsass.exe
Token: SeDebugPrivilege	1196	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.execmd.exelsass.exeWScript.exelsass.exeWScript.exelsass.exe

description	pid	Process	procid_target
PID 1520 wrote to memory of 2724	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	37
PID 1520 wrote to memory of 2724	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	37
PID 1520 wrote to memory of 2724	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	37
PID 1520 wrote to memory of 2760	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	38
PID 1520 wrote to memory of 2760	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	38
PID 1520 wrote to memory of 2760	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	38
PID 1520 wrote to memory of 2632	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	39
PID 1520 wrote to memory of 2632	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	39
PID 1520 wrote to memory of 2632	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	39
PID 1520 wrote to memory of 2700	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	40
PID 1520 wrote to memory of 2700	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	40
PID 1520 wrote to memory of 2700	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	40
PID 1520 wrote to memory of 2848	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	41
PID 1520 wrote to memory of 2848	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	41
PID 1520 wrote to memory of 2848	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	41
PID 1520 wrote to memory of 2584	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	42
PID 1520 wrote to memory of 2584	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	42
PID 1520 wrote to memory of 2584	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	42
PID 1520 wrote to memory of 2580	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	43
PID 1520 wrote to memory of 2580	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	43
PID 1520 wrote to memory of 2580	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	43
PID 1520 wrote to memory of 2600	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	44
PID 1520 wrote to memory of 2600	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	44
PID 1520 wrote to memory of 2600	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	44
PID 1520 wrote to memory of 2628	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	45
PID 1520 wrote to memory of 2628	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	45
PID 1520 wrote to memory of 2628	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	45
PID 1520 wrote to memory of 2648	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	46
PID 1520 wrote to memory of 2648	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	46
PID 1520 wrote to memory of 2648	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	46
PID 1520 wrote to memory of 2660	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	47
PID 1520 wrote to memory of 2660	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	47
PID 1520 wrote to memory of 2660	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	47
PID 1520 wrote to memory of 3004	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	48
PID 1520 wrote to memory of 3004	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	48
PID 1520 wrote to memory of 3004	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	48
PID 1520 wrote to memory of 1728	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	61
PID 1520 wrote to memory of 1728	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	61
PID 1520 wrote to memory of 1728	1520	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe	61
PID 1728 wrote to memory of 2312	1728	cmd.exe	63
PID 1728 wrote to memory of 2312	1728	cmd.exe	63
PID 1728 wrote to memory of 2312	1728	cmd.exe	63
PID 1728 wrote to memory of 2332	1728	cmd.exe	65
PID 1728 wrote to memory of 2332	1728	cmd.exe	65
PID 1728 wrote to memory of 2332	1728	cmd.exe	65
PID 2332 wrote to memory of 2816	2332	lsass.exe	66
PID 2332 wrote to memory of 2816	2332	lsass.exe	66
PID 2332 wrote to memory of 2816	2332	lsass.exe	66
PID 2332 wrote to memory of 2772	2332	lsass.exe	67
PID 2332 wrote to memory of 2772	2332	lsass.exe	67
PID 2332 wrote to memory of 2772	2332	lsass.exe	67
PID 2816 wrote to memory of 2636	2816	WScript.exe	68
PID 2816 wrote to memory of 2636	2816	WScript.exe	68
PID 2816 wrote to memory of 2636	2816	WScript.exe	68
PID 2636 wrote to memory of 2892	2636	lsass.exe	69
PID 2636 wrote to memory of 2892	2636	lsass.exe	69
PID 2636 wrote to memory of 2892	2636	lsass.exe	69
PID 2636 wrote to memory of 1512	2636	lsass.exe	70
PID 2636 wrote to memory of 1512	2636	lsass.exe	70
PID 2636 wrote to memory of 1512	2636	lsass.exe	70
PID 2892 wrote to memory of 660	2892	WScript.exe	71
PID 2892 wrote to memory of 660	2892	WScript.exe	71
PID 2892 wrote to memory of 660	2892	WScript.exe	71
PID 660 wrote to memory of 2384	660	lsass.exe	72

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

Processes:

lsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exe37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exelsass.exelsass.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe
"C:\Users\Admin\AppData\Local\Temp\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\daHDUzbFiW.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2312
- - C:\Program Files (x86)\Reference Assemblies\lsass.exe
    "C:\Program Files (x86)\Reference Assemblies\lsass.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2332
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c243f08d-c3ef-4172-85be-7237042dfc5f.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2816
    - - C:\Program Files (x86)\Reference Assemblies\lsass.exe
        
        "C:\Program Files (x86)\Reference Assemblies\lsass.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2636
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\50f1879e-5fc1-47b9-9978-862a031b2eb1.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2892
        
        C:\Program Files (x86)\Reference Assemblies\lsass.exe
        
        "C:\Program Files (x86)\Reference Assemblies\lsass.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:660
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64f034e7-83eb-4516-a7ed-0797441aeb09.vbs"
        8⤵
        
        PID:2384
        
        C:\Program Files (x86)\Reference Assemblies\lsass.exe
        
        "C:\Program Files (x86)\Reference Assemblies\lsass.exe"
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2876
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\34dfd702-1c5b-4ada-b4a6-e5d33a22cd97.vbs"
        10⤵
        
        PID:2280
        
        C:\Program Files (x86)\Reference Assemblies\lsass.exe
        
        "C:\Program Files (x86)\Reference Assemblies\lsass.exe"
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\86c519bc-109b-4960-bdd9-d899f2614ca3.vbs"
        12⤵
        
        PID:820
        
        C:\Program Files (x86)\Reference Assemblies\lsass.exe
        
        "C:\Program Files (x86)\Reference Assemblies\lsass.exe"
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\298011dd-cdb3-4186-b3b0-37327c7059bf.vbs"
        14⤵
        
        PID:2440
        
        C:\Program Files (x86)\Reference Assemblies\lsass.exe
        
        "C:\Program Files (x86)\Reference Assemblies\lsass.exe"
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3024
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9afa2350-8cf3-475f-affc-47362e586820.vbs"
        16⤵
        
        PID:1544
        
        C:\Program Files (x86)\Reference Assemblies\lsass.exe
        
        "C:\Program Files (x86)\Reference Assemblies\lsass.exe"
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1144
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\93bbf7c3-9b51-495a-8742-2ad2e0f1d323.vbs"
        18⤵
        
        PID:300
        
        C:\Program Files (x86)\Reference Assemblies\lsass.exe
        
        "C:\Program Files (x86)\Reference Assemblies\lsass.exe"
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3048
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5984b10-5709-4fd2-b81a-b1274e961a3d.vbs"
        20⤵
        
        PID:2628
        
        C:\Program Files (x86)\Reference Assemblies\lsass.exe
        
        "C:\Program Files (x86)\Reference Assemblies\lsass.exe"
        21⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2788
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d86df306-d02a-4b63-827c-37227fc38937.vbs"
        22⤵
        
        PID:1680
        
        C:\Program Files (x86)\Reference Assemblies\lsass.exe
        
        "C:\Program Files (x86)\Reference Assemblies\lsass.exe"
        23⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2436
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\240c98a6-3d10-4454-bd6b-1b49f34aec36.vbs"
        24⤵
        
        PID:1532
        
        C:\Program Files (x86)\Reference Assemblies\lsass.exe
        
        "C:\Program Files (x86)\Reference Assemblies\lsass.exe"
        25⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1196
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04d6d984-6797-4f54-aca6-c2db18ccda91.vbs"
        26⤵
        
        PID:1932
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28709b31-4b95-4982-a111-8601ef3652d4.vbs"
        26⤵
        
        PID:1544
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db0972cd-c6dc-48a3-9d59-eb88e2187fe3.vbs"
        24⤵
        
        PID:2708
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f505e019-2238-4279-97be-0e9b28a44257.vbs"
        22⤵
        
        PID:2456
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5e27782e-2849-4129-9b5a-33b2d0d3b333.vbs"
        20⤵
        
        PID:1608
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b731ea53-52e4-4f7b-b68e-e221d9907cfa.vbs"
        18⤵
        
        PID:1916
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c614b09e-cef7-493d-9465-0337043cb8fd.vbs"
        16⤵
        
        PID:2836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d42914cf-ab78-4b92-a673-053047c65d1d.vbs"
        14⤵
        
        PID:836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7f813add-9e8a-4c64-975a-f733827144d1.vbs"
        12⤵
        
        PID:2692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ca1c44d2-fcdf-4982-a073-658ca11bc4db.vbs"
        10⤵
        
        PID:2584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5cb58d2-286b-4ba2-8b46-8b721c6b86c0.vbs"
        8⤵
        
        PID:2324
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1e16319-5230-4eca-952d-5fab1ad505e8.vbs"
        6⤵
        
        PID:1512
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00350ac1-f593-4ea8-a656-c3ed8e02e656.vbs"
      4⤵
      PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Reference Assemblies\lsass.exe

Filesize
4.9MB

MD5
4be323cacf04251a71f0b34df121956a

SHA1
96bcca261036e10f9d7cd69dab956949f2049b7f

SHA256
f12ede33aa7e481462fe71427cbd25523742edef54436ce57c44187ba05dc224

SHA512
684b930009ccc2c9e69e1032efa081b07bb72c683d43edba9e2a5c17d3e2c5630b45a2b6afd67d7078405369d5f7ef4e35cdd66db0c6c8124da5b740a1733447

Download Submit
C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\Idle.exe

Filesize
4.9MB

MD5
549a897f0c0298c512c30faf8a911840

SHA1
77864449acf9065d7522006aec1bc67b543cb514

SHA256
37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dc

SHA512
481f73e8a9160def609cd28ec9d97398d66163c240a4d63f77686bfa2c99dddb5f7a9df0731c46309e8a1d19bed59d62e358e0ace10ec793731d3690df8bdd4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\00350ac1-f593-4ea8-a656-c3ed8e02e656.vbs

Filesize
505B

MD5
df8d328bb8bf327ce034b7476a7764a8

SHA1
b528578f59d7e4cb0e8e45b3ce921c34ddfe66e0

SHA256
0beac2cba3a2b058143e9c4343d4fd08559b44f5855e772d4951eb8b307413e7

SHA512
7a17e5e828c8acb654e4d0e835a44904dd6a50e2f78734e55a313d9e3e9b121338ba9cf2a6e072cfb17ba9c9861031e8d88f811529b346b8207e6c073cb2870e

Download Submit
C:\Users\Admin\AppData\Local\Temp\04d6d984-6797-4f54-aca6-c2db18ccda91.vbs

Filesize
729B

MD5
391d1786eb3ab70c61e6b3d7cb6b113e

SHA1
648f29bc3895d411db80521f85ff504174e470b4

SHA256
e99ba167b965542ba15c2e6138b727160276422c438068444575376cfc47b58b

SHA512
7b9196efedee181ad8f7fc5b76a98bc12684f0166a46bb2067dd10ca2d5d68064b752cce3b3d361ad7b8c9f1819edd909cf5744a4921b7155d237dcea98b7a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\10770bd47368861c1bd3fed1700d203ad75762c4.exe

Filesize
4.9MB

MD5
2839d1c3bdeb6f995934721677f11d23

SHA1
e908d033e89c11dcb2ed1f9cc6e681e3ceaaa42f

SHA256
b7b62488691d4671db1254a5e51d972795d13ca5f5dea6ff096a4690e9969bf5

SHA512
6954a8d70ce59736d7b23b2524b0784a196531f8f7c6a037977f18631907d666aba91637e962213397938e4be20e998e2f34b2281a6ca11e1143635441337cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\240c98a6-3d10-4454-bd6b-1b49f34aec36.vbs

Filesize
729B

MD5
578ea0ce275f1bb831128ee3c08ef05c

SHA1
817105645b7eb5c208cc1709b81803d7405b016d

SHA256
4337d068341336a2dd8a26aa97a54587fb8073711842310995c252c1f845b35c

SHA512
4f72f3b676accc8b65822ebf8e1d50ba39e5dca015559763c7ca220f15ec65b8ecaecf02c1e95df9b815a9219b184ee03ca898e54a3bceabaaa8182e986f8bca

Download Submit
C:\Users\Admin\AppData\Local\Temp\298011dd-cdb3-4186-b3b0-37327c7059bf.vbs

Filesize
729B

MD5
51ef802905c61817be9c61de786deaf7

SHA1
d7fbfba9b2e1a302642f170cee9c33fa054c25bb

SHA256
c2390e4aad27d26fba12960dd8df04da521d858e345ba7f2426c2119c7840fa6

SHA512
d7c485824b03ceb2df7d83ef97c66d88fdf7628a7d5da4952f49412695c256f838870b15ef84f24434718fda24474ac4fbf3ae3a7ce9d171ffdff12b9ebfc539

Download Submit
C:\Users\Admin\AppData\Local\Temp\34dfd702-1c5b-4ada-b4a6-e5d33a22cd97.vbs

Filesize
729B

MD5
763147f6d3739899d44d69ad75c9dcbc

SHA1
5b138caa740a4bc77a51901ea36a822c6b367d66

SHA256
eaa12b7ea0a266ef93a9d612c9e47e42be95b67b76f2c8780d2c44d6d51799d2

SHA512
dd8216c9780dfd197a01ce336c598f4af93cb9dd91b84e4384dcddf955aad777dbacf57172100e78f427592fe0836d76e615d4d93a770b44bc5f0a68bbea3d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\50f1879e-5fc1-47b9-9978-862a031b2eb1.vbs

Filesize
729B

MD5
1a9328ca8734b72ec099cfca221a12f7

SHA1
a57f1a8aa86763deb4de3b55435748f2ae923354

SHA256
91e1ce42d2b02580f4cc6042291f7260f9b655dafedaf97928aae409a3021612

SHA512
7e2cc360440a03dc5e849876002027a347fe8beb68733c2aaad05184132844750a3f6bd226dd110c0b4fdb4d8d333738642461bf5b808d2aec3bbb79ad68e619

Download Submit
C:\Users\Admin\AppData\Local\Temp\64f034e7-83eb-4516-a7ed-0797441aeb09.vbs

Filesize
728B

MD5
d9cd0d58d81f827784382920add9c422

SHA1
bd49cdbce6fc2d96fecf4ca1163727b29c64b86e

SHA256
be36fb7976ad5ef0c8083e0eed3473a4bb91b4149a817431f69d7871817072e5

SHA512
dd83006f33e8e6feebc61276476de92ff3953718a46d54a4438e759bd1bea54bf9622fbed52fd7e4a351db8d2dac4fbd589a2c2da439814caa640d7e6a13d62a

Download Submit
C:\Users\Admin\AppData\Local\Temp\86c519bc-109b-4960-bdd9-d899f2614ca3.vbs

Filesize
729B

MD5
e83bb383d68d6eb6d91fe9d20f2c58d1

SHA1
68a4a0820796abaa705fead5b93e425a2cbf1c0f

SHA256
a5d18b1f0a45dbe9481a11684f769243feb8617160ce0fbd3d6d8cde977b382c

SHA512
553435f08b77e135f9d7a8c0220c50c7a4aa40d9a6d9d15a5b301065892e75b5dd72af1f32cf9744149e25110e26ccf534c7b875b64b01f38dd788b246521e03

Download Submit
C:\Users\Admin\AppData\Local\Temp\93bbf7c3-9b51-495a-8742-2ad2e0f1d323.vbs

Filesize
729B

MD5
1c1b770a25e31d89e6c886eb5c22f174

SHA1
9202236e140903a0324d4ac6aa8f786d58afe8d6

SHA256
78b41d13a08cdedd6842bf031b1625078a408460b2ca8934ce96b873d6ef2e72

SHA512
ace08054d9b600b1db2183525bdd6c3870068de1e28175af153971574521408868dbf063aca70c4e01ceb38481b11fa21664658602438df18b25850c3714e548

Download Submit
C:\Users\Admin\AppData\Local\Temp\9afa2350-8cf3-475f-affc-47362e586820.vbs

Filesize
729B

MD5
5981092a8e4ad9fcaf3d0da4b59d0c87

SHA1
dd1db24ec28a0012ddf1146e0df0bce144b5267e

SHA256
874471d60ba3c6de39d5c6aec2b181e9ff6686ef52f9260e7ed0ca520f761d37

SHA512
ac519ec80e613398052e953f843e4fa356ecdc3cf5b9a0e1a0bd1e2c20295e701ca281de3c7edf66655b16bb0b92e8f3847739155950c8bc9c62e4b7834661f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\c243f08d-c3ef-4172-85be-7237042dfc5f.vbs

Filesize
729B

MD5
fe8de760dd63ff87969d6e368d7a5c5d

SHA1
7c3362bad381c0beae3248b72777726aa59676a3

SHA256
27e5d30677e223e32c0685df09963f395f8cb6fe87ffe66c2f164b9ed51384ea

SHA512
66abc1fd277d96285de5824acc30a25dc99b26b114bf599d29a79f14e358c7b2569216c45f080d2a7aa5d0387bf3bd8869ae007cb5398a292a63cc57447a942d

Download Submit
C:\Users\Admin\AppData\Local\Temp\d86df306-d02a-4b63-827c-37227fc38937.vbs

Filesize
729B

MD5
2cf07ea9e77b3a418030bf2f912bb100

SHA1
23f99d7560cd763c021b610fd436ef97713a2461

SHA256
64c599af838af4bfba673b98289f53ea2c86ae11b9eae4ead863fd35d1c2a4ec

SHA512
2d72728cf228333b5eadf3468be5c428cd6281ee448d06cc6e61e404eede68f9093e1b596208b3761eaf847052e8b9fc1c7b731f6fe00242659eb8286cefec0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\daHDUzbFiW.bat

Filesize
218B

MD5
3fa52b3d8771964e80b3d52f618b4dee

SHA1
2e5b0a359ddc2a7f04f7f95ca008bb8c18d44093

SHA256
284b3951f65d38099a73535867d391eadb6be38283d952f72530b475a9648867

SHA512
6d0e5714249d378b67b223088414f7043afa7c600e05e085dcb145554ba9d7875ca07a09b2c6df695a32bb91b6f66bbe4ced6f8e2920b3c10ce2c3d21880655d

Download Submit
C:\Users\Admin\AppData\Local\Temp\f5984b10-5709-4fd2-b81a-b1274e961a3d.vbs

Filesize
729B

MD5
9e71223910cccea895344f7a18fbf2bd

SHA1
1b2cb5b6cfb1f2cc6f2223c056476e15fafb5ad3

SHA256
4b25d5f3747a2784019e77fb9931c438f1609dd88771a30e72ce674459977214

SHA512
df697b813c16a3389b51ef5e28b3b412e0186120acb0420230d49ed567323f8cf61ea66fdce3c4e54462f059f9c2828ad417fba859a34773a6988f2732b7961b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp145B.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4e8bed87a602d5281a6f25e40c57528d

SHA1
ded60c7dc0afb30d1aeb15551274dc99d9bbff16

SHA256
951fd1fbdb6de768873bf0f5a8efddacaf1bca400af0a94808e58a5de9a78f6c

SHA512
ad07084b388e1053b1aea2f74bc3bf84b5d2e307c9c17f9b52ddbd8c848cce67b80a277145dae868c902ebaa254683e81fa974869f8ffc22702e024b5e9db36a

Download Submit
memory/660-137-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/660-136-0x00000000002C0000-0x00000000007B4000-memory.dmp

Filesize
5.0MB

Download
memory/1196-270-0x0000000000590000-0x00000000005A2000-memory.dmp

Filesize
72KB

Download
memory/1520-9-0x0000000000B80000-0x0000000000B8A000-memory.dmp

Filesize
40KB

Download
memory/1520-8-0x0000000000B70000-0x0000000000B80000-memory.dmp

Filesize
64KB

Download
memory/1520-1-0x0000000000250000-0x0000000000744000-memory.dmp

Filesize
5.0MB

Download
memory/1520-0-0x000007FEF58D3000-0x000007FEF58D4000-memory.dmp

Filesize
4KB

Download
memory/1520-11-0x0000000000BA0000-0x0000000000BAA000-memory.dmp

Filesize
40KB

Download
memory/1520-15-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/1520-10-0x0000000000B90000-0x0000000000BA2000-memory.dmp

Filesize
72KB

Download
memory/1520-88-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp

Filesize
9.9MB

Download
memory/1520-2-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp

Filesize
9.9MB

Download
memory/1520-16-0x0000000002420000-0x000000000242C000-memory.dmp

Filesize
48KB

Download
memory/1520-14-0x0000000002400000-0x0000000002408000-memory.dmp

Filesize
32KB

Download
memory/1520-13-0x00000000023F0000-0x00000000023FE000-memory.dmp

Filesize
56KB

Download
memory/1520-3-0x000000001B590000-0x000000001B6BE000-memory.dmp

Filesize
1.2MB

Download
memory/1520-12-0x0000000000BB0000-0x0000000000BBE000-memory.dmp

Filesize
56KB

Download
memory/1520-7-0x0000000000B50000-0x0000000000B66000-memory.dmp

Filesize
88KB

Download
memory/1520-6-0x0000000000B40000-0x0000000000B50000-memory.dmp

Filesize
64KB

Download
memory/1520-4-0x0000000000790000-0x00000000007AC000-memory.dmp

Filesize
112KB

Download
memory/1520-5-0x00000000007B0000-0x00000000007B8000-memory.dmp

Filesize
32KB

Download
memory/2332-107-0x0000000000D10000-0x0000000001204000-memory.dmp

Filesize
5.0MB

Download
memory/2436-255-0x0000000000E40000-0x0000000001334000-memory.dmp

Filesize
5.0MB

Download
memory/2636-121-0x0000000001330000-0x0000000001824000-memory.dmp

Filesize
5.0MB

Download
memory/2724-70-0x000000001B540000-0x000000001B822000-memory.dmp

Filesize
2.9MB

Download
memory/2760-81-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2788-240-0x0000000000270000-0x0000000000764000-memory.dmp

Filesize
5.0MB

Download
memory/2876-153-0x0000000000C50000-0x0000000000C62000-memory.dmp

Filesize
72KB

Download
memory/2876-152-0x0000000001280000-0x0000000001774000-memory.dmp

Filesize
5.0MB

Download
memory/3024-196-0x00000000005D0000-0x00000000005E2000-memory.dmp

Filesize
72KB

Download
memory/3048-225-0x0000000000380000-0x0000000000874000-memory.dmp

Filesize
5.0MB

Download