1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326

Analysis

max time kernel
16s
max time network
30s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
22-09-2024 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dControl.exe
Size

447KB
MD5

58008524a6473bdf86c1040a9a9e39c3
SHA1

cb704d2e8df80fd3500a5b817966dc262d80ddb8
SHA256

1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
SHA512

8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31
SSDEEP

6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD

Score

10^/10

defense_evasion discovery evasion execution persistence trojan upx

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION	dControl.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "2"	dControl.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3208-0-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/3972-22-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/3208-23-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/3972-45-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/320-105-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/320-106-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/2248-110-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/2248-134-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/320-686-0x0000000000400000-0x00000000004CD000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3264	powershell.exe

Modifies Security services 2 TTPs 3 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "0"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "3"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "3"	dControl.exe

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/3208-23-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/3972-45-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/320-105-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/320-106-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/2248-134-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/320-686-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dControl.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	dControl.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\MpCmdRun-56-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	MsMpEng.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	MsMpEng.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	MsMpEng.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3208	dControl.exe
3208	dControl.exe
3208	dControl.exe
3208	dControl.exe
3208	dControl.exe
3208	dControl.exe
3972	dControl.exe
3972	dControl.exe
3972	dControl.exe
3972	dControl.exe
3972	dControl.exe
3972	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
2248	dControl.exe
2248	dControl.exe
2248	dControl.exe
2248	dControl.exe
2248	dControl.exe
2248	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
3264	powershell.exe
320	dControl.exe
320	dControl.exe
3264	powershell.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
3264	powershell.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
320	dControl.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
68	MsMpEng.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	3208	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	3208	dControl.exe
Token: SeIncreaseQuotaPrivilege	3208	dControl.exe
Token: 0	3208	dControl.exe
Token: SeDebugPrivilege	3972	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	3972	dControl.exe
Token: SeIncreaseQuotaPrivilege	3972	dControl.exe
Token: SeDebugPrivilege	320	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	320	dControl.exe
Token: SeIncreaseQuotaPrivilege	320	dControl.exe
Token: 0	320	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	68	MsMpEng.exe
Token: SeIncreaseQuotaPrivilege	68	MsMpEng.exe
Token: SeTcbPrivilege	68	MsMpEng.exe
Token: SeSecurityPrivilege	68	MsMpEng.exe
Token: SeTakeOwnershipPrivilege	68	MsMpEng.exe
Token: SeLoadDriverPrivilege	68	MsMpEng.exe
Token: SeIncBasePriorityPrivilege	68	MsMpEng.exe
Token: SeBackupPrivilege	68	MsMpEng.exe
Token: SeRestorePrivilege	68	MsMpEng.exe
Token: SeShutdownPrivilege	68	MsMpEng.exe
Token: SeDebugPrivilege	68	MsMpEng.exe
Token: SeSystemEnvironmentPrivilege	68	MsMpEng.exe
Token: SeChangeNotifyPrivilege	68	MsMpEng.exe
Token: SeImpersonatePrivilege	68	MsMpEng.exe
Token: SeDebugPrivilege	68	MsMpEng.exe
Token: SeBackupPrivilege	68	MsMpEng.exe
Token: SeRestorePrivilege	68	MsMpEng.exe
Token: SeDebugPrivilege	3264	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
1848	MSASCuiL.exe
1848	MSASCuiL.exe
320	dControl.exe
1848	MSASCuiL.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
1848	MSASCuiL.exe
320	dControl.exe
1848	MSASCuiL.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe
320	dControl.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 2248	320	dControl.exe	79
PID 320 wrote to memory of 2248	320	dControl.exe	79
PID 320 wrote to memory of 2248	320	dControl.exe	79
PID 320 wrote to memory of 3132	320	dControl.exe	81
PID 320 wrote to memory of 3132	320	dControl.exe	81
PID 2788 wrote to memory of 1848	2788	explorer.exe	83
PID 2788 wrote to memory of 1848	2788	explorer.exe	83
PID 320 wrote to memory of 3264	320	dControl.exe	88
PID 320 wrote to memory of 3264	320	dControl.exe	88
PID 68 wrote to memory of 4340	68	MsMpEng.exe	90
PID 68 wrote to memory of 4340	68	MsMpEng.exe	90
PID 4340 wrote to memory of 4788	4340	MpCmdRun.exe	93
PID 4340 wrote to memory of 4788	4340	MpCmdRun.exe	93
PID 68 wrote to memory of 4808	68	MsMpEng.exe	94
PID 68 wrote to memory of 4808	68	MsMpEng.exe	94
PID 68 wrote to memory of 728	68	MsMpEng.exe	96
PID 68 wrote to memory of 728	68	MsMpEng.exe	96

C:\Users\Admin\AppData\Local\Temp\dControl.exe
"C:\Users\Admin\AppData\Local\Temp\dControl.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3208
- C:\Users\Admin\AppData\Local\Temp\dControl.exe
  C:\Users\Admin\AppData\Local\Temp\dControl.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3972
- - C:\Users\Admin\AppData\Local\Temp\dControl.exe
    "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /TI
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Modifies security service
    - Modifies Security services
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:320
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Program Files\Windows Defender\MSASCuiL.exe
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3352|
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2248
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:3132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3264

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4080

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:4236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3592

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files\Windows Defender\MSASCuiL.exe
  "C:\Program Files\Windows Defender\MSASCuiL.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1848

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:68
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -EnableService
  2⤵
  PID:4380
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:4788
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -UnmanagedUpdate
  2⤵
  PID:4808
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:728
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges -Reinvoke
    3⤵
    PID:4324
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" GetDeviceTicket -AccessKey F94DDBB3-57D0-4623-1ED0-0B8C1587D3CF
  2⤵
  PID:4640

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dControl.ini

Filesize
2KB

MD5
05175ea8a9d16cd113935cea970b786c

SHA1
af101318472993a175ae4324090d6e1e985dc1f3

SHA256
c59c2bf59cafd618bd3080fb5d4b06350447d9f29ae1600a7f801838181abb41

SHA512
bd76d3f00f9fedec7a1e3c82d793a06201101c46263546b969609aca92f1a06bf6fecf1a18357ca60e833df83b890ee0e4111978dbfc63333a6f47215a4d89cb

Download Submit
C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\MpCmdRun.log

Filesize
1KB

MD5
6d3fe8cb93bcd34e960095380249a207

SHA1
85ce830a63c3ed28297cb6091a676fcf1b19c10c

SHA256
6b9c3586fb5a246817388afd6e211b9b2ed0b4d96e113679ab724ff81a15ddb1

SHA512
d7f75c03d43eb7f9fd3842643131f4ced15107922205c348af584b82db07a97c43b6601f4a2e38de5d6cc038443b293638ef3445fe3e211508fd0bc32655da44

Download Submit
C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\MpCmdRun.log

Filesize
2KB

MD5
5c30251cf454f2ff3ff83bfe7a5b2064

SHA1
7f6960f7bc20348b5dd3110f5d564fd6710d8516

SHA256
80c130ba00fe2b8b4bba62190dc70792530e7062ce7fcfbe3a2c0b6696a24755

SHA512
5a47842af7db3566b9987c32440421f33059e2ed0a2cfcd3700e8c9d07ba113419618b40934b264584aa35663927555bda1a971ad56cebc29aed8aca8da0392e

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
233B

MD5
cd4326a6fd01cd3ca77cfd8d0f53821b

SHA1
a1030414d1f8e5d5a6e89d5a309921b8920856f9

SHA256
1c59482111e657ef5190e22de6c047609a67e46e28d67fd70829882fd8087a9c

SHA512
29ce5532fb3adf55caa011e53736507fbf241afee9d3ca516a1d9bffec6e5cb2f87c4cd73e4da8c33b8706f96ba3b31f13ce229746110d5bd248839f67ec6d67

Download Submit
C:\Windows\TEMP\MpCmdRun.log

Filesize
4KB

MD5
d65ebac20f348b692f55c1b5827137e6

SHA1
dd8e450b9907ac5296cf233eb4564d038f0b52f6

SHA256
063ed616199406e541c196294d3b9cbdd517e844c0d844c948aa3359da6765e5

SHA512
e99a20afd073f970b1f0d67b002c747ce68da8954b4c3aa001b5f7e6a2a19bf70afd57d3c1c65fd0bd860f114473f6a56c3b836bb96fa03a3e8e598fdadf60b0

Download Submit
C:\Windows\TEMP\MpCmdRun.log

Filesize
5KB

MD5
186c6dcea8aca0da2265cff52c18f84d

SHA1
8ae0bfd9a643000841f8b084914708286015d969

SHA256
4494714b9fa0fbe5189bd3d4f2c12b9c4c32fa7d7eed26271f23c2485024b5e2

SHA512
44c0e43c40e118958ee97cecfe20c623f9e00f88d2d696281a51ece1ffd94c57382ba117ef6819df98f478d66222cc54f4988a688db4bebf61fd2ebcf95f9c30

Download Submit
C:\Windows\TEMP\MpCmdRun.log

Filesize
5KB

MD5
2133d75e3eef76eb92fb3f415a57905b

SHA1
9c8827eda3be80ac14528455f7604e2e32961eff

SHA256
9da65b54cd4b3fb68c62c37acf4ee561ceea66eeeb072744852d42f869d8c9f9

SHA512
fc1b1e0242e23b60bfdbe6a03fa962fcb4449c93166f4457e31b3cccca1c8537131a27f45d5981f9fce3eb780d4a2b773101cf7da460577c0f876d0eeb2360a8

Download Submit
C:\Windows\TEMP\MpCmdRun.log

Filesize
7KB

MD5
2ee9463b2f74301a7ddd5871fc4bf3f8

SHA1
7274664b22b9cbb3b4c2821a53cfd67de16e0c8c

SHA256
9cf35fe9baf9db9ada96e5bf04f04979ff074242cf7214c36eeb7db7bd8cc0bb

SHA512
c2fcb7b834f31703c417c51a07ca8e72125cc1648eaaf6b84c0763fc8be492159ca6ccfec2e347c6e9350e4a150f28953017b75601bf3476a0873077917b9497

Download Submit
C:\Windows\Temp\3t9v7e2w.tmp

Filesize
37KB

MD5
3bc9acd9c4b8384fb7ce6c08db87df6d

SHA1
936c93e3a01d5ae30d05711a97bbf3dfa5e0921f

SHA256
a3d7de3d70c7673e8af7275eede44c1596156b6503a9614c47bad2c8e5fa3f79

SHA512
f8508376d9fb001bce10a8cc56da5c67b31ff220afd01fb57e736e961f3a563731e84d6a6c046123e1a5c16d31f39d9b07528b64a8f432eac7baa433e1d23375

Download Submit
C:\Windows\Temp\__PSScriptPolicyTest_5h5t1zxd.2uc.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Windows\Temp\autF57C.tmp

Filesize
14KB

MD5
9d5a0ef18cc4bb492930582064c5330f

SHA1
2ec4168fd3c5ea9f2b0ab6acd676a5b4a95848c8

SHA256
8f5bbcc572bc62feb13a669f856d21886a61888fd6288afd066272a27ea79bb3

SHA512
1dc3387790b051c3291692607312819f0967848961bc075799b5a2353efadd65f54db54ddf47c296bb6a9f48e94ec83086a4f8bf7200c64329a73fc7ec4340a4

Download Submit
C:\Windows\Temp\autF57D.tmp

Filesize
12KB

MD5
efe44d9f6e4426a05e39f99ad407d3e7

SHA1
637c531222ee6a56780a7fdcd2b5078467b6e036

SHA256
5ea3b26c6b1b71edaef17ce365d50be963ae9f4cb79b39ec723fe6e9e4054366

SHA512
8014b60cef62ff5c94bf6338ee3385962cfc62aaa6c101a607c592ba00aea2d860f52e5f52be2a2a3b35310f135548e8d0b00211bfcf32d6b71198f5d3046b63

Download Submit
C:\Windows\Temp\autF58D.tmp

Filesize
7KB

MD5
ecffd3e81c5f2e3c62bcdc122442b5f2

SHA1
d41567acbbb0107361c6ee1715fe41b416663f40

SHA256
9874ab363b07dcc7e9cd6022a380a64102c1814343642295239a9f120cb941c5

SHA512
7f84899b77e3e2c0a35fb4973f4cd57f170f7a22f862b08f01938cf7537c8af7c442ef2ae6e561739023f6c9928f93a59b50d463af6373ed344f68260bc47c76

Download Submit
memory/68-176-0x000001BF49ED0000-0x000001BF49ED1000-memory.dmp

Filesize
4KB

Download
memory/68-168-0x000001BF48CA0000-0x000001BF48CA4000-memory.dmp

Filesize
16KB

Download
memory/68-201-0x000001BF4A640000-0x000001BF4A641000-memory.dmp

Filesize
4KB

Download
memory/68-200-0x000001BF4AD20000-0x000001BF4AD21000-memory.dmp

Filesize
4KB

Download
memory/68-199-0x000001BF4AD10000-0x000001BF4AD11000-memory.dmp

Filesize
4KB

Download
memory/68-198-0x000001BF4AD00000-0x000001BF4AD01000-memory.dmp

Filesize
4KB

Download
memory/68-197-0x000001BF4AC60000-0x000001BF4AC61000-memory.dmp

Filesize
4KB

Download
memory/68-196-0x000001BF4AC50000-0x000001BF4AC51000-memory.dmp

Filesize
4KB

Download
memory/68-195-0x000001BF4AC40000-0x000001BF4AC41000-memory.dmp

Filesize
4KB

Download
memory/68-194-0x000001BF4AC30000-0x000001BF4AC31000-memory.dmp

Filesize
4KB

Download
memory/68-193-0x000001BF4AC20000-0x000001BF4AC21000-memory.dmp

Filesize
4KB

Download
memory/68-192-0x000001BF4AC10000-0x000001BF4AC11000-memory.dmp

Filesize
4KB

Download
memory/68-191-0x000001BF4AC00000-0x000001BF4AC01000-memory.dmp

Filesize
4KB

Download
memory/68-190-0x000001BF4ABF0000-0x000001BF4ABF1000-memory.dmp

Filesize
4KB

Download
memory/68-189-0x000001BF4ABE0000-0x000001BF4ABE1000-memory.dmp

Filesize
4KB

Download
memory/68-188-0x000001BF4ABC0000-0x000001BF4ABC1000-memory.dmp

Filesize
4KB

Download
memory/68-187-0x000001BF4ABB0000-0x000001BF4ABB1000-memory.dmp

Filesize
4KB

Download
memory/68-186-0x000001BF4ABA0000-0x000001BF4ABA1000-memory.dmp

Filesize
4KB

Download
memory/68-185-0x000001BF4AB90000-0x000001BF4AB91000-memory.dmp

Filesize
4KB

Download
memory/68-184-0x000001BF4A990000-0x000001BF4A991000-memory.dmp

Filesize
4KB

Download
memory/68-183-0x000001BF4A300000-0x000001BF4A301000-memory.dmp

Filesize
4KB

Download
memory/68-182-0x000001BF4A0F0000-0x000001BF4A0F1000-memory.dmp

Filesize
4KB

Download
memory/68-181-0x000001BF4A0E0000-0x000001BF4A0E1000-memory.dmp

Filesize
4KB

Download
memory/68-135-0x000001BF488F0000-0x000001BF4893C000-memory.dmp

Filesize
304KB

Download
memory/68-145-0x000001BF49200000-0x000001BF49204000-memory.dmp

Filesize
16KB

Download
memory/68-180-0x000001BF49D70000-0x000001BF49D71000-memory.dmp

Filesize
4KB

Download
memory/68-179-0x000001BF49D60000-0x000001BF49D61000-memory.dmp

Filesize
4KB

Download
memory/68-178-0x000001BF49D50000-0x000001BF49D51000-memory.dmp

Filesize
4KB

Download
memory/68-177-0x000001BF49CC0000-0x000001BF49CC1000-memory.dmp

Filesize
4KB

Download
memory/68-141-0x000001BF4D420000-0x000001BF4D863000-memory.dmp

Filesize
4.3MB

Download
memory/68-175-0x000001BF49DC0000-0x000001BF49DC1000-memory.dmp

Filesize
4KB

Download
memory/68-174-0x000001BF49BF0000-0x000001BF49BF1000-memory.dmp

Filesize
4KB

Download
memory/68-173-0x000001BF49B60000-0x000001BF49B61000-memory.dmp

Filesize
4KB

Download
memory/68-172-0x000001BF49250000-0x000001BF49251000-memory.dmp

Filesize
4KB

Download
memory/68-171-0x000001BF48CD0000-0x000001BF48CEB000-memory.dmp

Filesize
108KB

Download
memory/68-170-0x000001BF48CC0000-0x000001BF48CC1000-memory.dmp

Filesize
4KB

Download
memory/68-169-0x000001BF48CB0000-0x000001BF48CB3000-memory.dmp

Filesize
12KB

Download
memory/68-144-0x000001BF3E010000-0x000001BF3E011000-memory.dmp

Filesize
4KB

Download
memory/68-167-0x000001BF48C90000-0x000001BF48C94000-memory.dmp

Filesize
16KB

Download
memory/68-166-0x000001BF48C80000-0x000001BF48C84000-memory.dmp

Filesize
16KB

Download
memory/68-165-0x000001BF3E0D0000-0x000001BF3E0D4000-memory.dmp

Filesize
16KB

Download
memory/68-164-0x000001BF3E0C0000-0x000001BF3E0C4000-memory.dmp

Filesize
16KB

Download
memory/68-163-0x000001BF3E0B0000-0x000001BF3E0B4000-memory.dmp

Filesize
16KB

Download
memory/68-162-0x000001BF3E0A0000-0x000001BF3E0A4000-memory.dmp

Filesize
16KB

Download
memory/68-161-0x000001BF3E090000-0x000001BF3E094000-memory.dmp

Filesize
16KB

Download
memory/68-160-0x000001BF3E080000-0x000001BF3E084000-memory.dmp

Filesize
16KB

Download
memory/68-159-0x000001BF3E070000-0x000001BF3E074000-memory.dmp

Filesize
16KB

Download
memory/68-158-0x000001BF3E060000-0x000001BF3E064000-memory.dmp

Filesize
16KB

Download
memory/68-157-0x000001BF3E050000-0x000001BF3E054000-memory.dmp

Filesize
16KB

Download
memory/68-156-0x000001BF3E040000-0x000001BF3E044000-memory.dmp

Filesize
16KB

Download
memory/68-155-0x000001BF3E030000-0x000001BF3E034000-memory.dmp

Filesize
16KB

Download
memory/68-154-0x000001BF3E020000-0x000001BF3E024000-memory.dmp

Filesize
16KB

Download
memory/68-153-0x000001BF3E000000-0x000001BF3E004000-memory.dmp

Filesize
16KB

Download
memory/68-152-0x000001BF3DFF0000-0x000001BF3DFF4000-memory.dmp

Filesize
16KB

Download
memory/68-151-0x000001BF4A5F0000-0x000001BF4A5F4000-memory.dmp

Filesize
16KB

Download
memory/68-150-0x000001BF4A5E0000-0x000001BF4A5E4000-memory.dmp

Filesize
16KB

Download
memory/68-149-0x000001BF4A5D0000-0x000001BF4A5D4000-memory.dmp

Filesize
16KB

Download
memory/68-148-0x000001BF4AD30000-0x000001BF4AD34000-memory.dmp

Filesize
16KB

Download
memory/68-147-0x000001BF4ACF0000-0x000001BF4ACF4000-memory.dmp

Filesize
16KB

Download
memory/68-146-0x000001BF4ABD0000-0x000001BF4ABD4000-memory.dmp

Filesize
16KB

Download
memory/320-106-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/320-686-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/320-105-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2248-134-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2248-110-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/3208-23-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/3208-0-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/3264-430-0x0000015B567D0000-0x0000015B56846000-memory.dmp

Filesize
472KB

Download
memory/3264-474-0x0000015B56780000-0x0000015B5679C000-memory.dmp

Filesize
112KB

Download
memory/3264-480-0x0000015B56D20000-0x0000015B56DD9000-memory.dmp

Filesize
740KB

Download
memory/3264-529-0x0000015B567A0000-0x0000015B567AA000-memory.dmp

Filesize
40KB

Download
memory/3264-142-0x0000015B55BB0000-0x0000015B55BD2000-memory.dmp

Filesize
136KB

Download
memory/3972-22-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/3972-45-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download