dcrat | d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-09-2024 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
Size

4.9MB
MD5

aa805d00b0ea3937b482d8e7325b8570
SHA1

d653bc8367a240f61a3d84ce05f1e7bbf7c31101
SHA256

d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0
SHA512

3adbb031a9f95dc5a9e6ebb538df8d53c56e6049653850875756659d37bb1ed808e30440bb0744f748647c58ce909deb61e4c275b04298f8901fc0d53b1d2a49
SSDEEP

49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	644	2276	schtasks.exe	30

UAC bypass 3 TTPs 30 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2564-2-0x000000001B4D0000-0x000000001B5FE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1228	powershell.exe
2396	powershell.exe
2072	powershell.exe
2732	powershell.exe
2328	powershell.exe
2432	powershell.exe
2100	powershell.exe
1524	powershell.exe
1812	powershell.exe
2124	powershell.exe
2108	powershell.exe
2572	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
2968	winlogon.exe
1508	winlogon.exe
2032	winlogon.exe
1680	winlogon.exe
1948	winlogon.exe
1980	winlogon.exe
2380	winlogon.exe
1192	winlogon.exe
2832	winlogon.exe

Checks whether UAC is enabled 1 TTPs 20 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\WmiPrvSE.exe	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
File opened for modification	C:\Program Files\MSBuild\RCXCCF1.tmp	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
File opened for modification	C:\Program Files\MSBuild\WmiPrvSE.exe	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
File created	C:\Program Files\DVD Maker\fr-FR\winlogon.exe	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
File created	C:\Program Files\Internet Explorer\69ddcba757bf72	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
File created	C:\Program Files\MSBuild\24dbde2999530e	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
File created	C:\Program Files\Internet Explorer\smss.exe	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\RCXD0F9.tmp	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
File opened for modification	C:\Program Files\Internet Explorer\smss.exe	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
File created	C:\Program Files (x86)\Reference Assemblies\spoolsv.exe	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
File created	C:\Program Files (x86)\Reference Assemblies\f3b6ecef712a24	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
File created	C:\Program Files\DVD Maker\fr-FR\cc11b995f2a76d	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\spoolsv.exe	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
File opened for modification	C:\Program Files\DVD Maker\fr-FR\RCXD30D.tmp	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
File opened for modification	C:\Program Files\DVD Maker\fr-FR\winlogon.exe	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
File opened for modification	C:\Program Files\Internet Explorer\RCXD714.tmp	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2428	schtasks.exe
3040	schtasks.exe
532	schtasks.exe
2652	schtasks.exe
2796	schtasks.exe
2912	schtasks.exe
2712	schtasks.exe
1484	schtasks.exe
2952	schtasks.exe
2244	schtasks.exe
644	schtasks.exe
2776	schtasks.exe
2932	schtasks.exe
2768	schtasks.exe
2748	schtasks.exe
1928	schtasks.exe
2896	schtasks.exe
2996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
2124	powershell.exe
2072	powershell.exe
2432	powershell.exe
1524	powershell.exe
2732	powershell.exe
2328	powershell.exe
1812	powershell.exe
2396	powershell.exe
2572	powershell.exe
2108	powershell.exe
2100	powershell.exe
1228	powershell.exe
2968	winlogon.exe
1508	winlogon.exe
2032	winlogon.exe
1680	winlogon.exe
1948	winlogon.exe
1980	winlogon.exe
2380	winlogon.exe
1192	winlogon.exe
2832	winlogon.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	2072	powershell.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeDebugPrivilege	2968	winlogon.exe
Token: SeDebugPrivilege	1508	winlogon.exe
Token: SeDebugPrivilege	2032	winlogon.exe
Token: SeDebugPrivilege	1680	winlogon.exe
Token: SeDebugPrivilege	1948	winlogon.exe
Token: SeDebugPrivilege	1980	winlogon.exe
Token: SeDebugPrivilege	2380	winlogon.exe
Token: SeDebugPrivilege	1192	winlogon.exe
Token: SeDebugPrivilege	2832	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2328	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	50
PID 2564 wrote to memory of 2328	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	50
PID 2564 wrote to memory of 2328	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	50
PID 2564 wrote to memory of 1812	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	51
PID 2564 wrote to memory of 1812	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	51
PID 2564 wrote to memory of 1812	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	51
PID 2564 wrote to memory of 2124	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	52
PID 2564 wrote to memory of 2124	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	52
PID 2564 wrote to memory of 2124	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	52
PID 2564 wrote to memory of 2108	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	53
PID 2564 wrote to memory of 2108	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	53
PID 2564 wrote to memory of 2108	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	53
PID 2564 wrote to memory of 2432	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	54
PID 2564 wrote to memory of 2432	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	54
PID 2564 wrote to memory of 2432	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	54
PID 2564 wrote to memory of 2100	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	55
PID 2564 wrote to memory of 2100	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	55
PID 2564 wrote to memory of 2100	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	55
PID 2564 wrote to memory of 1524	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	56
PID 2564 wrote to memory of 1524	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	56
PID 2564 wrote to memory of 1524	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	56
PID 2564 wrote to memory of 1228	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	57
PID 2564 wrote to memory of 1228	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	57
PID 2564 wrote to memory of 1228	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	57
PID 2564 wrote to memory of 2396	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	58
PID 2564 wrote to memory of 2396	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	58
PID 2564 wrote to memory of 2396	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	58
PID 2564 wrote to memory of 2572	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	59
PID 2564 wrote to memory of 2572	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	59
PID 2564 wrote to memory of 2572	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	59
PID 2564 wrote to memory of 2072	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	60
PID 2564 wrote to memory of 2072	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	60
PID 2564 wrote to memory of 2072	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	60
PID 2564 wrote to memory of 2732	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	61
PID 2564 wrote to memory of 2732	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	61
PID 2564 wrote to memory of 2732	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	61
PID 2564 wrote to memory of 776	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	74
PID 2564 wrote to memory of 776	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	74
PID 2564 wrote to memory of 776	2564	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe	74
PID 776 wrote to memory of 2920	776	cmd.exe	76
PID 776 wrote to memory of 2920	776	cmd.exe	76
PID 776 wrote to memory of 2920	776	cmd.exe	76
PID 776 wrote to memory of 2968	776	cmd.exe	77
PID 776 wrote to memory of 2968	776	cmd.exe	77
PID 776 wrote to memory of 2968	776	cmd.exe	77
PID 2968 wrote to memory of 1920	2968	winlogon.exe	78
PID 2968 wrote to memory of 1920	2968	winlogon.exe	78
PID 2968 wrote to memory of 1920	2968	winlogon.exe	78
PID 2968 wrote to memory of 980	2968	winlogon.exe	79
PID 2968 wrote to memory of 980	2968	winlogon.exe	79
PID 2968 wrote to memory of 980	2968	winlogon.exe	79
PID 1920 wrote to memory of 1508	1920	WScript.exe	80
PID 1920 wrote to memory of 1508	1920	WScript.exe	80
PID 1920 wrote to memory of 1508	1920	WScript.exe	80
PID 1508 wrote to memory of 2552	1508	winlogon.exe	81
PID 1508 wrote to memory of 2552	1508	winlogon.exe	81
PID 1508 wrote to memory of 2552	1508	winlogon.exe	81
PID 1508 wrote to memory of 3008	1508	winlogon.exe	82
PID 1508 wrote to memory of 3008	1508	winlogon.exe	82
PID 1508 wrote to memory of 3008	1508	winlogon.exe	82
PID 2552 wrote to memory of 2032	2552	WScript.exe	83
PID 2552 wrote to memory of 2032	2552	WScript.exe	83
PID 2552 wrote to memory of 2032	2552	WScript.exe	83
PID 2032 wrote to memory of 1996	2032	winlogon.exe	84

System policy modification 1 TTPs 30 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe
"C:\Users\Admin\AppData\Local\Temp\d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0N.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eUzUS1TuH8.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2920
- - C:\Program Files\DVD Maker\fr-FR\winlogon.exe
    "C:\Program Files\DVD Maker\fr-FR\winlogon.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2968
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\579c9a43-a6b2-454a-8583-4c68d02676ad.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1920
    - - C:\Program Files\DVD Maker\fr-FR\winlogon.exe
        
        "C:\Program Files\DVD Maker\fr-FR\winlogon.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1508
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\17d1b030-3064-4e7b-9ce8-9521c1447593.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Program Files\DVD Maker\fr-FR\winlogon.exe
        
        "C:\Program Files\DVD Maker\fr-FR\winlogon.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2032
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ed9af09-e1e5-4e4c-af4e-a85947e365b4.vbs"
        8⤵
        
        PID:1996
        
        C:\Program Files\DVD Maker\fr-FR\winlogon.exe
        
        "C:\Program Files\DVD Maker\fr-FR\winlogon.exe"
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae4c1eda-eb24-4aa5-ace8-9a138d7ff285.vbs"
        10⤵
        
        PID:1488
        
        C:\Program Files\DVD Maker\fr-FR\winlogon.exe
        
        "C:\Program Files\DVD Maker\fr-FR\winlogon.exe"
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89228b0e-d9ce-406b-b283-c979d9098400.vbs"
        12⤵
        
        PID:1660
        
        C:\Program Files\DVD Maker\fr-FR\winlogon.exe
        
        "C:\Program Files\DVD Maker\fr-FR\winlogon.exe"
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1980
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15396673-d8c7-4a2a-9ca4-a6bd40d56ec3.vbs"
        14⤵
        
        PID:1612
        
        C:\Program Files\DVD Maker\fr-FR\winlogon.exe
        
        "C:\Program Files\DVD Maker\fr-FR\winlogon.exe"
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2380
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc99f206-f77f-43ec-90ef-0e2366d66487.vbs"
        16⤵
        
        PID:1352
        
        C:\Program Files\DVD Maker\fr-FR\winlogon.exe
        
        "C:\Program Files\DVD Maker\fr-FR\winlogon.exe"
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1192
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4a1d43d6-291c-4bd0-b026-dcfe747bc078.vbs"
        18⤵
        
        PID:844
        
        C:\Program Files\DVD Maker\fr-FR\winlogon.exe
        
        "C:\Program Files\DVD Maker\fr-FR\winlogon.exe"
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2832
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f069acba-da83-433b-bffc-0ae72f5c6680.vbs"
        20⤵
        
        PID:1900
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1e2f2ed4-101d-4c0d-9638-8bf5a89b27c9.vbs"
        20⤵
        
        PID:1968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe43e515-b548-4a72-a511-55585f8225be.vbs"
        18⤵
        
        PID:2044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3fe0cde-544e-44ec-989a-67832931cb07.vbs"
        16⤵
        
        PID:2788
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\010613e2-c60d-4a3d-912b-c02a9edca683.vbs"
        14⤵
        
        PID:2584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e551665-a6a6-4dcb-a129-8196bdc8ca4d.vbs"
        12⤵
        
        PID:1564
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3d57b6b2-73a4-4b8f-a27f-1d546a6aea31.vbs"
        10⤵
        
        PID:2328
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8ef2524-0880-476e-ba72-46e3a4ac7958.vbs"
        8⤵
        
        PID:860
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\87639eb6-b0ca-4a92-8b8c-2776e323c1c1.vbs"
        6⤵
        
        PID:3008
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5269a4e8-2a2e-44b5-aefa-ab2284b4da6f.vbs"
      4⤵
      PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\MSBuild\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files\DVD Maker\fr-FR\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\fr-FR\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\DVD Maker\fr-FR\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Documents\My Videos\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\Documents\My Videos\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Documents\My Videos\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\15396673-d8c7-4a2a-9ca4-a6bd40d56ec3.vbs

Filesize
721B

MD5
8367ec0fc7b84494a096540242e42182

SHA1
f4ac8b29a7a132d8da178ebbb41a933d984a2f04

SHA256
6a989fcc81aff871184d246594bb41fffe61b05d882901310774698a8e73e0a3

SHA512
a4c337079a19ce097ecc10edd020bb722318a8a38395fea2dd931d378c5b1bd2b59de80611c9c61d51d80f9373715023e812782fc407a052c71e77e83783c369

Download Submit
C:\Users\Admin\AppData\Local\Temp\17d1b030-3064-4e7b-9ce8-9521c1447593.vbs

Filesize
721B

MD5
03cbd344fb6ef95ab7d9ceaf618a4b18

SHA1
fb60b699365ac066d1fce5855e8d803b836821b0

SHA256
08065fa7bd891c47226ba8103ef44fe2dab7195fa691c99ce9f0cf2b55a75699

SHA512
9181e852d1c11e3574b4acf18f4ca491937797e67f7d7a4735d079cda3ee697d612d05147f188cf47ba2d8191c5bf5b82c00c5f1c00e91deb19147fbe8f9fff9

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ed9af09-e1e5-4e4c-af4e-a85947e365b4.vbs

Filesize
721B

MD5
8eeb9b28db273301ceb7cd256e365bf6

SHA1
f8ced66661a5c1ee042c7aef0a604c6f1526c1c3

SHA256
49b282d42bb6e7b714ca14f2e57b42182265f94117f5985a671395df5d5f7a51

SHA512
5f397973e13823ba51804cc012a8818ff5d6b5c4ef5439d16883f6ca8e30ce67bd7327212b9143263b6c29ad68ba6f623cd7ed8b015f68f65e37b5b31ee560b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\4a1d43d6-291c-4bd0-b026-dcfe747bc078.vbs

Filesize
721B

MD5
3564b5730d5cf82700beec57211f5771

SHA1
98e50207f0bfe549cfb9d2ad434f911127a376ad

SHA256
7503f73a5cbce56456bd5eaf29e98b3a84ae2cc2be69e288fee1f39dee20e180

SHA512
553ab965d1324ebe3d4c28d0ef26e14f64cd1001e0d565d9f5e414b0e77a5b1a83fdf7d080c483841256e9fcc1385042c42c3ad2a3b458b49f65345594995288

Download Submit
C:\Users\Admin\AppData\Local\Temp\5269a4e8-2a2e-44b5-aefa-ab2284b4da6f.vbs

Filesize
497B

MD5
dff17f2e4411a28d075c7f7c0155c3b7

SHA1
85ee66fceacd5b35ed5c23e14f118d16d3d29479

SHA256
3d2cf1fbc4b193bbac9c25386256b053149ce54cfad7033a6a1ff1c5d4cbb17f

SHA512
d363687c2e0776cd25e880fc1091ece5e99c489900304bfb1ff1b55b693789d16276d0c126e09527996152a3714ca874748260537ba1234de978b383dd773666

Download Submit
C:\Users\Admin\AppData\Local\Temp\579c9a43-a6b2-454a-8583-4c68d02676ad.vbs

Filesize
721B

MD5
4eafb3389f127e6f2a057a8991206e2a

SHA1
5994647c96b0b523602174a07f1b453db6483414

SHA256
f4260a865daecd2323fbed43a3a00335254b600ca4368c6459f0af288c465eb9

SHA512
c59c2294ee3331ea9a437895c2568ac17d2e1bde44190ce0b87c1681de7bdaa308a109ae36659cc1cd0d8f48411172bdcd6b9873b0306ed6ce729850bfe1c385

Download Submit
C:\Users\Admin\AppData\Local\Temp\89228b0e-d9ce-406b-b283-c979d9098400.vbs

Filesize
721B

MD5
b09fa282bc710646f098930e5106d89a

SHA1
8f4755b21d9bb2111c0a2fe3ac12b9aaa698ccac

SHA256
07ca2ab14f2246c09fb26abb9ef72f20b840202af4463ce66185e982b7c6114c

SHA512
0831583bafc736c4b61f0765feed38df487bafbabebe28ab24ca6835e2c512eefe5dcb23cc2d88574fd6780f80c39d7dd93c85b01d12d00ae8312b1aca6f9eb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ae4c1eda-eb24-4aa5-ace8-9a138d7ff285.vbs

Filesize
721B

MD5
5b0cc8b39e579595da391d0f77ab0547

SHA1
833e2e9ced5d933cf49ddf1cfd6e6d6f4b86ab9a

SHA256
d3b6e7c72683a5e4679342d45722c0ac8a9ed4bfadd7fbd7aadc48939a2a01ec

SHA512
968b2482b792d8ab2ab25a684b4e84ab0a04c37d4d5ddd7652188536fc16ebd6d32090c14a034036be9c96670d48c5e116a76a2b1f8f5e3db65951cc509fb376

Download Submit
C:\Users\Admin\AppData\Local\Temp\dc99f206-f77f-43ec-90ef-0e2366d66487.vbs

Filesize
721B

MD5
1f5db385482eb0a4f67186ec1c1e821b

SHA1
f94dffff07d867965b723f7cb7632557fc6973b9

SHA256
62d43c6092989974d1058606741c8175a7d9b46b08873cbeca5ef3b58e66988e

SHA512
6b082f0476784ba4cc24df7ffbd424cd5ff56a8391f01b25d2212e13a5561fa6b756ba385f95112754b85a4339f2e6b00b568460ad085d2d1e2222acc43d102d

Download Submit
C:\Users\Admin\AppData\Local\Temp\eUzUS1TuH8.bat

Filesize
210B

MD5
968f79f168c05e0535d9695ba0e18f5d

SHA1
b4e7ef9b4ec8190c38da2cb0e864d5b7520a8c86

SHA256
e12389636380b071996b0df54202944fa5ecae47c9b20966f3ae4dd57f2763a4

SHA512
eca32d96cd6678ff991471676a330ff8e94513a78f00bd49fe9fc051de0c47a009643dc9cf07458ea88d47be6220aaf3aac02c1610062d81f3fc925b2b6fe65b

Download Submit
C:\Users\Admin\AppData\Local\Temp\f069acba-da83-433b-bffc-0ae72f5c6680.vbs

Filesize
721B

MD5
5664b59576c8327443bb24e00e800936

SHA1
7aee3a4c7d6d6e225f8a61257bd53be9995ad88c

SHA256
bf9db99e7cafcb9f753b431661d002147e5900feadbfba1299418682d928c001

SHA512
d27d800587cc5571a27dae2c39144960fff32fcb6b397375b374ce5347f03fba0ab9d2fa7c7d4a803a7fade889d3dd57bee2dba702a0c7c35199332d0215b0a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp10A.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
91039155980f35080b38724d4b63cd83

SHA1
192864a3e53c75e3f73a4b4cdc0deee9783c4ee4

SHA256
785779fc6639e59f4a128841bb01d5628ee42b2bcceff88e1e2b7dff5cc0f40e

SHA512
20b07c621733992d9c1b08e5c7da2f7cac623c1c1f5ddfb1ae0d9fae72e09fcd464fbb0b15a048e157cdad4ff1cbcd342a51edd5a818bed72efb9eb06fa7938c

Download Submit
C:\Users\Default\Videos\spoolsv.exe

Filesize
4.9MB

MD5
aa805d00b0ea3937b482d8e7325b8570

SHA1
d653bc8367a240f61a3d84ce05f1e7bbf7c31101

SHA256
d0a9d6d530b1f95fda03585df793378530b2df40746313cd91867d91d582eea0

SHA512
3adbb031a9f95dc5a9e6ebb538df8d53c56e6049653850875756659d37bb1ed808e30440bb0744f748647c58ce909deb61e4c275b04298f8901fc0d53b1d2a49

Download Submit
memory/1508-159-0x0000000000A50000-0x0000000000A62000-memory.dmp

Filesize
72KB

Download
memory/1508-158-0x0000000000FB0000-0x00000000014A4000-memory.dmp

Filesize
5.0MB

Download
memory/1680-188-0x0000000000620000-0x0000000000632000-memory.dmp

Filesize
72KB

Download
memory/1948-203-0x00000000010C0000-0x00000000015B4000-memory.dmp

Filesize
5.0MB

Download
memory/1980-218-0x0000000001250000-0x0000000001744000-memory.dmp

Filesize
5.0MB

Download
memory/2124-85-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2124-95-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/2564-11-0x0000000000830000-0x000000000083A000-memory.dmp

Filesize
40KB

Download
memory/2564-16-0x0000000002630000-0x000000000263C000-memory.dmp

Filesize
48KB

Download
memory/2564-10-0x00000000005A0000-0x00000000005B2000-memory.dmp

Filesize
72KB

Download
memory/2564-7-0x0000000000370000-0x0000000000386000-memory.dmp

Filesize
88KB

Download
memory/2564-9-0x0000000000590000-0x000000000059A000-memory.dmp

Filesize
40KB

Download
memory/2564-15-0x0000000002620000-0x0000000002628000-memory.dmp

Filesize
32KB

Download
memory/2564-14-0x0000000002610000-0x0000000002618000-memory.dmp

Filesize
32KB

Download
memory/2564-13-0x0000000002580000-0x000000000258E000-memory.dmp

Filesize
56KB

Download
memory/2564-12-0x0000000000840000-0x000000000084E000-memory.dmp

Filesize
56KB

Download
memory/2564-0-0x000007FEF55A3000-0x000007FEF55A4000-memory.dmp

Filesize
4KB

Download
memory/2564-1-0x0000000000850000-0x0000000000D44000-memory.dmp

Filesize
5.0MB

Download
memory/2564-139-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

Filesize
9.9MB

Download
memory/2564-2-0x000000001B4D0000-0x000000001B5FE000-memory.dmp

Filesize
1.2MB

Download
memory/2564-8-0x0000000000580000-0x0000000000590000-memory.dmp

Filesize
64KB

Download
memory/2564-6-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2564-5-0x0000000000340000-0x0000000000348000-memory.dmp

Filesize
32KB

Download
memory/2564-4-0x0000000000320000-0x000000000033C000-memory.dmp

Filesize
112KB

Download
memory/2564-3-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

Filesize
9.9MB

Download
memory/2832-261-0x0000000000090000-0x0000000000584000-memory.dmp

Filesize
5.0MB

Download
memory/2968-144-0x0000000000A90000-0x0000000000AA2000-memory.dmp

Filesize
72KB

Download
memory/2968-143-0x0000000000330000-0x0000000000824000-memory.dmp

Filesize
5.0MB

Download