dcrat | 5f89b33cedfe3e9f075dd2312b10580dd16b5fb1702fe1f1ce572a792ec9bf91

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/09/2024, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
21bea813ae3d796798c3ac78edc721d6.exe
Size 3.3MB
Sample240926-e78xbsxgmp
SHA256 5f89b33cedfe3e9f075dd2312b10580dd16b5fb1702fe1f1ce572a792ec9bf91
MD5 21bea813ae3d796798c3ac78edc721d6
SHA1 26dae402be8e24a7c47c80a295be0c9aa419e3aa
SHA512 17b77435db81747b1ff36f01f9a4d2824a110159629cb4dc81a423d2a38ce48e9771d603da62ad15b4cb7375def67c70443bba50086ab12db783742cd504aee0
SSDEEP 49152:Yihzgkea3/GGFTXTRq6G5QbXDFwKeaY5uhrh408H5BX9mu3qLQG6d:Yitz/b5dqz5wXDq+wMr6FBNm0Ch6d
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3432	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4420	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3800	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4244	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	4248	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	4248	schtasks.exe	82

UAC bypass 3 TTPs 42 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	21bea813ae3d796798c3ac78edc721d6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	21bea813ae3d796798c3ac78edc721d6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	21bea813ae3d796798c3ac78edc721d6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2204-1-0x00000000001F0000-0x000000000054A000-memory.dmp	dcrat
behavioral2/files/0x00070000000234eb-47.dat	dcrat

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	21bea813ae3d796798c3ac78edc721d6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	csrss.exe

Executes dropped EXE 13 IoCs

pid	Process
1324	csrss.exe
1700	csrss.exe
2020	csrss.exe
4360	csrss.exe
2972	csrss.exe
1068	csrss.exe
4928	csrss.exe
452	csrss.exe
1768	csrss.exe
3888	csrss.exe
5060	csrss.exe
4424	csrss.exe
3980	csrss.exe

Checks whether UAC is enabled 1 TTPs 28 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	21bea813ae3d796798c3ac78edc721d6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	21bea813ae3d796798c3ac78edc721d6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\PackageManifests\SearchApp.exe	21bea813ae3d796798c3ac78edc721d6.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\SearchApp.exe	21bea813ae3d796798c3ac78edc721d6.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\38384e6a620884	21bea813ae3d796798c3ac78edc721d6.exe
File created	C:\Program Files\Windows Defender\it-IT\Idle.exe	21bea813ae3d796798c3ac78edc721d6.exe
File created	C:\Program Files\Windows Defender\it-IT\6ccacd8608530f	21bea813ae3d796798c3ac78edc721d6.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\uk-UA\5940a34987c991	21bea813ae3d796798c3ac78edc721d6.exe
File created	C:\Windows\RemotePackages\RemoteApps\RuntimeBroker.exe	21bea813ae3d796798c3ac78edc721d6.exe
File created	C:\Windows\RemotePackages\RemoteApps\9e8d7a4ca61bd9	21bea813ae3d796798c3ac78edc721d6.exe
File created	C:\Windows\uk-UA\dllhost.exe	21bea813ae3d796798c3ac78edc721d6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	21bea813ae3d796798c3ac78edc721d6.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2532	schtasks.exe
2140	schtasks.exe
3032	schtasks.exe
4840	schtasks.exe
2236	schtasks.exe
2904	schtasks.exe
2544	schtasks.exe
2380	schtasks.exe
2056	schtasks.exe
3444	schtasks.exe
1032	schtasks.exe
2424	schtasks.exe
4308	schtasks.exe
4712	schtasks.exe
4968	schtasks.exe
2504	schtasks.exe
3960	schtasks.exe
4488	schtasks.exe
3800	schtasks.exe
3592	schtasks.exe
3536	schtasks.exe
3432	schtasks.exe
4420	schtasks.exe
3048	schtasks.exe
2364	schtasks.exe
4244	schtasks.exe
2128	schtasks.exe
4008	schtasks.exe
4928	schtasks.exe
4872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2204	21bea813ae3d796798c3ac78edc721d6.exe
2204	21bea813ae3d796798c3ac78edc721d6.exe
2204	21bea813ae3d796798c3ac78edc721d6.exe
2204	21bea813ae3d796798c3ac78edc721d6.exe
2204	21bea813ae3d796798c3ac78edc721d6.exe
2204	21bea813ae3d796798c3ac78edc721d6.exe
2204	21bea813ae3d796798c3ac78edc721d6.exe
2204	21bea813ae3d796798c3ac78edc721d6.exe
2204	21bea813ae3d796798c3ac78edc721d6.exe
2204	21bea813ae3d796798c3ac78edc721d6.exe
2204	21bea813ae3d796798c3ac78edc721d6.exe
2204	21bea813ae3d796798c3ac78edc721d6.exe
2204	21bea813ae3d796798c3ac78edc721d6.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1324	csrss.exe
1700	csrss.exe
1700	csrss.exe
1700	csrss.exe
1700	csrss.exe
1700	csrss.exe
1700	csrss.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	21bea813ae3d796798c3ac78edc721d6.exe
Token: SeDebugPrivilege	1324	csrss.exe
Token: SeDebugPrivilege	1700	csrss.exe
Token: SeDebugPrivilege	2020	csrss.exe
Token: SeDebugPrivilege	4360	csrss.exe
Token: SeDebugPrivilege	2972	csrss.exe
Token: SeDebugPrivilege	1068	csrss.exe
Token: SeDebugPrivilege	4928	csrss.exe
Token: SeDebugPrivilege	452	csrss.exe
Token: SeDebugPrivilege	1768	csrss.exe
Token: SeDebugPrivilege	3888	csrss.exe
Token: SeDebugPrivilege	5060	csrss.exe
Token: SeDebugPrivilege	4424	csrss.exe
Token: SeDebugPrivilege	3980	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1616	2204	21bea813ae3d796798c3ac78edc721d6.exe	113
PID 2204 wrote to memory of 1616	2204	21bea813ae3d796798c3ac78edc721d6.exe	113
PID 1616 wrote to memory of 2336	1616	cmd.exe	115
PID 1616 wrote to memory of 2336	1616	cmd.exe	115
PID 1616 wrote to memory of 1324	1616	cmd.exe	116
PID 1616 wrote to memory of 1324	1616	cmd.exe	116
PID 1324 wrote to memory of 1320	1324	csrss.exe	117
PID 1324 wrote to memory of 1320	1324	csrss.exe	117
PID 1324 wrote to memory of 2080	1324	csrss.exe	118
PID 1324 wrote to memory of 2080	1324	csrss.exe	118
PID 1320 wrote to memory of 1700	1320	WScript.exe	125
PID 1320 wrote to memory of 1700	1320	WScript.exe	125
PID 1700 wrote to memory of 3052	1700	csrss.exe	126
PID 1700 wrote to memory of 3052	1700	csrss.exe	126
PID 1700 wrote to memory of 1708	1700	csrss.exe	127
PID 1700 wrote to memory of 1708	1700	csrss.exe	127
PID 3052 wrote to memory of 2020	3052	WScript.exe	128
PID 3052 wrote to memory of 2020	3052	WScript.exe	128
PID 2020 wrote to memory of 2268	2020	csrss.exe	129
PID 2020 wrote to memory of 2268	2020	csrss.exe	129
PID 2020 wrote to memory of 3036	2020	csrss.exe	131
PID 2020 wrote to memory of 3036	2020	csrss.exe	131
PID 2268 wrote to memory of 4360	2268	WScript.exe	133
PID 2268 wrote to memory of 4360	2268	WScript.exe	133
PID 4360 wrote to memory of 1616	4360	csrss.exe	134
PID 4360 wrote to memory of 1616	4360	csrss.exe	134
PID 4360 wrote to memory of 4716	4360	csrss.exe	135
PID 4360 wrote to memory of 4716	4360	csrss.exe	135
PID 1616 wrote to memory of 2972	1616	WScript.exe	136
PID 1616 wrote to memory of 2972	1616	WScript.exe	136
PID 2972 wrote to memory of 4404	2972	csrss.exe	137
PID 2972 wrote to memory of 4404	2972	csrss.exe	137
PID 2972 wrote to memory of 4336	2972	csrss.exe	138
PID 2972 wrote to memory of 4336	2972	csrss.exe	138
PID 4404 wrote to memory of 1068	4404	WScript.exe	139
PID 4404 wrote to memory of 1068	4404	WScript.exe	139
PID 1068 wrote to memory of 1276	1068	csrss.exe	140
PID 1068 wrote to memory of 1276	1068	csrss.exe	140
PID 1068 wrote to memory of 4008	1068	csrss.exe	141
PID 1068 wrote to memory of 4008	1068	csrss.exe	141
PID 1276 wrote to memory of 4928	1276	WScript.exe	142
PID 1276 wrote to memory of 4928	1276	WScript.exe	142
PID 4928 wrote to memory of 3660	4928	csrss.exe	143
PID 4928 wrote to memory of 3660	4928	csrss.exe	143
PID 4928 wrote to memory of 4272	4928	csrss.exe	144
PID 4928 wrote to memory of 4272	4928	csrss.exe	144
PID 3660 wrote to memory of 452	3660	WScript.exe	145
PID 3660 wrote to memory of 452	3660	WScript.exe	145
PID 452 wrote to memory of 4004	452	csrss.exe	146
PID 452 wrote to memory of 4004	452	csrss.exe	146
PID 452 wrote to memory of 4504	452	csrss.exe	147
PID 452 wrote to memory of 4504	452	csrss.exe	147
PID 4004 wrote to memory of 1768	4004	WScript.exe	148
PID 4004 wrote to memory of 1768	4004	WScript.exe	148
PID 1768 wrote to memory of 3832	1768	csrss.exe	149
PID 1768 wrote to memory of 3832	1768	csrss.exe	149
PID 1768 wrote to memory of 2444	1768	csrss.exe	150
PID 1768 wrote to memory of 2444	1768	csrss.exe	150
PID 3832 wrote to memory of 3888	3832	WScript.exe	151
PID 3832 wrote to memory of 3888	3832	WScript.exe	151
PID 3888 wrote to memory of 1912	3888	csrss.exe	152
PID 3888 wrote to memory of 1912	3888	csrss.exe	152
PID 3888 wrote to memory of 2660	3888	csrss.exe	153
PID 3888 wrote to memory of 2660	3888	csrss.exe	153

System policy modification 1 TTPs 42 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	21bea813ae3d796798c3ac78edc721d6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	21bea813ae3d796798c3ac78edc721d6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	21bea813ae3d796798c3ac78edc721d6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\21bea813ae3d796798c3ac78edc721d6.exe
"C:\Users\Admin\AppData\Local\Temp\21bea813ae3d796798c3ac78edc721d6.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WoWVsGLGG1.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2336
- - C:\Users\Admin\csrss.exe
    "C:\Users\Admin\csrss.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1324
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\551576c8-8a61-4c5f-bd7d-6f2c55cdef7d.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1320
    - - C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1700
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee9e63a2-0b8a-4dbe-86e6-8e18d7a98d74.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\695e9e36-5066-4503-b89c-a7916f5bba31.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2268
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4360
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4cd0b9d1-4695-4cb3-a14c-629a4e28a4e4.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23650e2e-8c3c-42b0-a6d0-694ff4963cc0.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75c94757-42aa-41ba-9811-12ba1cc622b0.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4928
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6f62f95-3ecb-4d46-9f62-09f7f7610374.vbs"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3660
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:452
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\24414a10-399d-4d36-a92e-f51101eb7ea1.vbs"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1768
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1dd2eabd-cea8-497e-b8f2-bffc1d72fa24.vbs"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3888
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fea7fa86-0785-4ed4-b415-4e38e4120b87.vbs"
        22⤵
        
        PID:1912
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d486bf6-4111-4eb0-9fa2-ea9fe5f68a17.vbs"
        24⤵
        
        PID:1088
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        25⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4424
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c8f8a1f-8a4d-4e56-9437-a2d61a1a2065.vbs"
        26⤵
        
        PID:3060
        
        C:\Users\Admin\csrss.exe
        
        C:\Users\Admin\csrss.exe
        27⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3980
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7aa6272c-07a4-4297-b853-06ff0c435db9.vbs"
        26⤵
        
        PID:4036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3edc8500-e88f-487b-b23d-c7bc5975769c.vbs"
        24⤵
        
        PID:5016
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6b1f9164-42ee-4f7b-ad8f-97a9ea5bda6c.vbs"
        22⤵
        
        PID:2660
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38e75ac9-684a-4926-ba56-414abb8398fe.vbs"
        20⤵
        
        PID:2444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c16f9a0-67b1-4754-a5b9-1096833b9f15.vbs"
        18⤵
        
        PID:4504
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a063300-c71b-4e5a-9233-5fc3bc807657.vbs"
        16⤵
        
        PID:4272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2c6c8778-bbcf-4150-b278-3239173c4e69.vbs"
        14⤵
        
        PID:4008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0492520-8eb1-4107-8ea2-14ab7c8dceae.vbs"
        12⤵
        
        PID:4336
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\66777e29-a5fe-486c-8176-992e76ec273d.vbs"
        10⤵
        
        PID:4716
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dea27ad6-e238-4c66-8041-b6fe7824fbcb.vbs"
        8⤵
        
        PID:3036
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6fbf7702-37c8-4373-b2f6-8c2d52b8b5f2.vbs"
        6⤵
        
        PID:1708
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\66608a78-febe-4a8f-9d44-f60db1839af3.vbs"
      4⤵
      PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\PackageManifests\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\PackageManifests\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Templates\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Templates\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Templates\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\RemotePackages\RemoteApps\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\RemotePackages\RemoteApps\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\it-IT\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\it-IT\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\it-IT\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\uk-UA\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\uk-UA\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\uk-UA\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\My Documents\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\My Documents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\My Documents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Downloads\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\Downloads\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Downloads\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

csrss.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log
Size 1KB
SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
MD5 49b64127208271d8f797256057d0b006
SHA1 b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
SHA512 f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e
MD5 SHA1 SHA512

Submit Download

0c8f8a1f-8a4d-4e56-9437-a2d61a1a2065.vbs

Path C:\Users\Admin\AppData\Local\Temp\0c8f8a1f-8a4d-4e56-9437-a2d61a1a2065.vbs
Size 700B
SHA256 1a42308be07472db4d1f48b28b3e2bf25c28831ee1f7c6e7e5d4eb42445a2747
MD5 a3353a83350fc5d0dd05b7450e169ad1
SHA1 48ed392864f3922e8ef4aa322b1c25f4a57af5b6
SHA512 fcce445928559fd1f0443572c70802d976887a3721d64adbb5995479b42c3eaa6da339b2e713618c3c42c5812e46b312a54346cedf1449cce77c4b14d0b1b8af
MD5 SHA1 SHA512

Submit Download

1dd2eabd-cea8-497e-b8f2-bffc1d72fa24.vbs

Path C:\Users\Admin\AppData\Local\Temp\1dd2eabd-cea8-497e-b8f2-bffc1d72fa24.vbs
Size 700B
SHA256 f6f98aa6be6de3eeaf9b4e3a54656efb4bfafd0d813c0356df14a4d910f0f317
MD5 71272d8f269dfeae33db61d6b5746d2d
SHA1 8a7e70fe16121bccf1818316898de907de4d0626
SHA512 a9d417086ae0618ce91be59f04ef14bd558bc1a509abbf8888564d4e98c9fd60ac499d9b016cdff98a47efeeca5bd30363dbaf9ea18e8eb934f117cdba5aa3ae
MD5 SHA1 SHA512

Submit Download

23650e2e-8c3c-42b0-a6d0-694ff4963cc0.vbs

Path C:\Users\Admin\AppData\Local\Temp\23650e2e-8c3c-42b0-a6d0-694ff4963cc0.vbs
Size 700B
SHA256 fc23567c485bc4ea2a8d72ef8cc8fca66a74b333524f87b70bbe4720e928be7b
MD5 dabd65e9af5a2c0403cc94fe44cc4dbb
SHA1 aebafd6897a73841a3e5daa3331a526a4c7f52c1
SHA512 f96d25eda685313667e2d2e8d935ad66acd1439dc841896ee3c35cc6c661f5b4e5b1da4bd55c841ab6c25cb12a0d58a64150773313cceaf3e31e0b086f18b1c3
MD5 SHA1 SHA512

Submit Download

24414a10-399d-4d36-a92e-f51101eb7ea1.vbs

Path C:\Users\Admin\AppData\Local\Temp\24414a10-399d-4d36-a92e-f51101eb7ea1.vbs
Size 699B
SHA256 5a22753f881bf9bf029a39b57719a9bae1bca8e375e5ebcbf76ecc3f309af059
MD5 c13f1eafe5375fae7a39885b391df03d
SHA1 60ac637ab6684b0696db37e1349c15a92386bb4a
SHA512 b6de3d75fc8c8663e158f019792ecce011066c654e767a0753e796a65bb270ad395eb9d2e5c1d959cd6ecd6ca5afcf4773abcf4544ca1ad56d83ae75ce5b1339
MD5 SHA1 SHA512

Submit Download

4cd0b9d1-4695-4cb3-a14c-629a4e28a4e4.vbs

Path C:\Users\Admin\AppData\Local\Temp\4cd0b9d1-4695-4cb3-a14c-629a4e28a4e4.vbs
Size 700B
SHA256 f9ab577ae019a9e8b83c9a6b15464919d8461bb4a3a2b2daf7663efb78d41082
MD5 3d3a9c8356a3822dc608aa421ff9f793
SHA1 0045f066feb0ad04dd7fdc84df4848080c3f68d2
SHA512 e4096ca1f5ae9ef5272f517c9f0f33c54ee4522dbf5d7903e84304f42259789a6b4b9384f0885011a45bd7707b552ff88df372d8ea13183616a793c4c1f9c1f0
MD5 SHA1 SHA512

Submit Download

551576c8-8a61-4c5f-bd7d-6f2c55cdef7d.vbs

Path C:\Users\Admin\AppData\Local\Temp\551576c8-8a61-4c5f-bd7d-6f2c55cdef7d.vbs
Size 700B
SHA256 c9fe2b530c1602dd7e04ee7898e338c05c7850b3292a65d159c067800a9e3569
MD5 887b38b90b6b07eeea82be56a220fc7d
SHA1 17c4ac540d33338ed6764853f01498711bc5c795
SHA512 c1e81da6b2e65abd794e634d57e26c7e5de83758f060e506b7df70729f7629ae42b05bfabaf17de8a8a4ea42b1618437d61810ba22189578d19da3e36974afce
MD5 SHA1 SHA512

Submit Download

66608a78-febe-4a8f-9d44-f60db1839af3.vbs

Path C:\Users\Admin\AppData\Local\Temp\66608a78-febe-4a8f-9d44-f60db1839af3.vbs
Size 476B
SHA256 11a9f95aa47937ac62f7d9be2d2ca4d1df2ca97f9f37e1f5770e2f34cfc03cc2
MD5 17532f636313e98b0ec9f948c0418195
SHA1 72dcf471db958e3f1f0557f79e9617f61cc69f52
SHA512 fe70fc247729c03c9d6e09705fdae99e923f24cc217a9258145802cd3318e08648f800d7281b8a7f701112f7e682af2a8b4c9d3589c60f8e0dd2b598db22189b
MD5 SHA1 SHA512

Submit Download

695e9e36-5066-4503-b89c-a7916f5bba31.vbs

Path C:\Users\Admin\AppData\Local\Temp\695e9e36-5066-4503-b89c-a7916f5bba31.vbs
Size 700B
SHA256 2546c2aa63d9e2da2455470dc97f94451fda79a0d70983bedfe35425e3c23ab7
MD5 5a83d037d1c9fe6547a701400240c05e
SHA1 5773a3a6e23e425692e5901b58769b365c70df24
SHA512 6f852bb683fccbc74e636bba62afefee24eeed95f34819c7affcb663bb98d45fb6cf62c28119533444093db15807916aecea29821d7351c5e367ec013168b48c
MD5 SHA1 SHA512

Submit Download

75c94757-42aa-41ba-9811-12ba1cc622b0.vbs

Path C:\Users\Admin\AppData\Local\Temp\75c94757-42aa-41ba-9811-12ba1cc622b0.vbs
Size 700B
SHA256 ab8face3bf90c29263e9cb4cead344defb06d12bdeed620c5a0be1cda5293b7f
MD5 bfcc7dd370a61512052904cb646b8d18
SHA1 eaf046b8c57407576085302a4b8cec33cb12b55a
SHA512 76c8c9824a611829a767872cb9efb13ad69e3b99a4925abe0abb89696b7f68c20935adcca942d2ecfd04e9be3d68dddc8f700df49a84ed16d18233e1d4250ef4
MD5 SHA1 SHA512

Submit Download

8d486bf6-4111-4eb0-9fa2-ea9fe5f68a17.vbs

Path C:\Users\Admin\AppData\Local\Temp\8d486bf6-4111-4eb0-9fa2-ea9fe5f68a17.vbs
Size 700B
SHA256 a0962efbb69a97a8c8cb53d2b0f3860558281ebc8db94cbe2fa00a4fdcb3113e
MD5 c40b99e3fe02165db892b4e1e31a073c
SHA1 b5a98011320549b8d7912203162a83531c2b8d82
SHA512 ba35ccfa3c3647b8571b123e80dfd76a28de45b79fe80e4db8008fa8d9074ca22c0efde83375c6f8c15d363b4e8b4cf998fa4c1adf41e99fcb7dba26a6846add
MD5 SHA1 SHA512

Submit Download

WoWVsGLGG1.bat

Path C:\Users\Admin\AppData\Local\Temp\WoWVsGLGG1.bat
Size 189B
SHA256 4a5024f9b9dee06d7416a4138e8cbbc65ac393087fb560bf5c759ed4d4a0aafb
MD5 086277e813816a55f83a17346173b72c
SHA1 eab867e9079dee4fd0ff66a79b0aa86c91219647
SHA512 64db2c7cd596fa98708fc6a895db68d6fbb05978b41f364925f774b9cc0da73e1719fe956dc7f076dd9d62ecaeb27249fd032367b05fd3e8e40a18639b947efd
MD5 SHA1 SHA512

Submit Download

c6f62f95-3ecb-4d46-9f62-09f7f7610374.vbs

Path C:\Users\Admin\AppData\Local\Temp\c6f62f95-3ecb-4d46-9f62-09f7f7610374.vbs
Size 700B
SHA256 750ec61f24a396cbc0b6e9e1b7624180e0878ae68f10d9c83a1ff796d0e4ee08
MD5 1ab73e377b4f480b65186dc5a887daeb
SHA1 ae1cebceabfce677bf54fffad8f92876c139cc74
SHA512 e113555f987bbebf06991587420fd7426da608b80c6292f6c3df299e83aff7846cfab622b71d100785b1dfb53d6d4ec033be5f81b0e60210e2b5adcf178537b5
MD5 SHA1 SHA512

Submit Download

ee9e63a2-0b8a-4dbe-86e6-8e18d7a98d74.vbs

Path C:\Users\Admin\AppData\Local\Temp\ee9e63a2-0b8a-4dbe-86e6-8e18d7a98d74.vbs
Size 700B
SHA256 c8988330526f64e1767dd61fc26735f5bc62f55fcfbb47db13e11d301897d8b4
MD5 3705857a862d1567768a02956a1eb8fc
SHA1 3c6d24f55b7554f3011328a12b0b956effd4e657
SHA512 85f48c395ed2f2a9e6569e8b8d93db29f45e1ad1afdc7b067e73db0be531390334af2e50b3fc5a658bbf67ce05c0331128e11e2480938b03f7e299d9d2fe0d55
MD5 SHA1 SHA512

Submit Download

fea7fa86-0785-4ed4-b415-4e38e4120b87.vbs

Path C:\Users\Admin\AppData\Local\Temp\fea7fa86-0785-4ed4-b415-4e38e4120b87.vbs
Size 700B
SHA256 eb6f14671b521c04a01f13046df1ad17550baee0ee67e384296d02435c12c36b
MD5 65b40e2a01c2575161c61779c54c2a61
SHA1 1e0d340d66c15d1ddfae35513d8256815575f51b
SHA512 ef2361d74cb0a659ea0f8c7b78160c25c7bef886ec3fe69b486b4b2d13c468288ac74225b488b014e453a574ca84ad6044d9418c567d94301813d1906439473f
MD5 SHA1 SHA512

Submit Download

dllhost.exe

Path C:\Windows\uk-UA\dllhost.exe
Size 3.3MB
SHA256 5f89b33cedfe3e9f075dd2312b10580dd16b5fb1702fe1f1ce572a792ec9bf91
MD5 21bea813ae3d796798c3ac78edc721d6
SHA1 26dae402be8e24a7c47c80a295be0c9aa419e3aa
SHA512 17b77435db81747b1ff36f01f9a4d2824a110159629cb4dc81a423d2a38ce48e9771d603da62ad15b4cb7375def67c70443bba50086ab12db783742cd504aee0
SSDEEP 49152:Yihzgkea3/GGFTXTRq6G5QbXDFwKeaY5uhrh408H5BX9mu3qLQG6d:Yitz/b5dqz5wXDq+wMr6FBNm0Ch6d
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1068-129-0x000000001D7F0000-0x000000001D802000-memory.dmp

Download

memory/1324-70-0x000000001D7D0000-0x000000001D826000-memory.dmp

Download

memory/1700-83-0x000000001BFF0000-0x000000001C002000-memory.dmp

Download

memory/1768-164-0x000000001D320000-0x000000001D332000-memory.dmp

Download

memory/1768-165-0x000000001D3F0000-0x000000001D402000-memory.dmp

Download

memory/2204-16-0x000000001B170000-0x000000001B17A000-memory.dmp

Download

memory/2204-19-0x000000001B2F0000-0x000000001B2F8000-memory.dmp

Download

memory/2204-23-0x000000001C010000-0x000000001C538000-memory.dmp

Download

memory/2204-24-0x000000001B350000-0x000000001B35C000-memory.dmp

Download

memory/2204-25-0x000000001B360000-0x000000001B36C000-memory.dmp

Download

memory/2204-27-0x000000001B380000-0x000000001B38C000-memory.dmp

Download

memory/2204-28-0x000000001B390000-0x000000001B39C000-memory.dmp

Download

memory/2204-29-0x000000001BD20000-0x000000001BD28000-memory.dmp

Download

memory/2204-35-0x000000001BD50000-0x000000001BD5C000-memory.dmp

Download

memory/2204-34-0x000000001BD40000-0x000000001BD48000-memory.dmp

Download

memory/2204-33-0x000000001BD30000-0x000000001BD38000-memory.dmp

Download

memory/2204-32-0x000000001B3C0000-0x000000001B3CE000-memory.dmp

Download

memory/2204-31-0x000000001B3B0000-0x000000001B3BA000-memory.dmp

Download

memory/2204-30-0x000000001B3A0000-0x000000001B3AC000-memory.dmp

Download

memory/2204-26-0x000000001B370000-0x000000001B378000-memory.dmp

Download

memory/2204-36-0x000000001BCE0000-0x000000001BCE8000-memory.dmp

Download

memory/2204-37-0x000000001BCF0000-0x000000001BCFA000-memory.dmp

Download

memory/2204-38-0x000000001BD00000-0x000000001BD0C000-memory.dmp

Download

memory/2204-21-0x000000001B310000-0x000000001B318000-memory.dmp

Download

memory/2204-20-0x000000001B300000-0x000000001B30C000-memory.dmp

Download

memory/2204-66-0x00007FFEAD820000-0x00007FFEAE2E1000-memory.dmp

Download

memory/2204-22-0x000000001B320000-0x000000001B332000-memory.dmp

Download

memory/2204-18-0x000000001B2E0000-0x000000001B2EC000-memory.dmp

Download

memory/2204-17-0x000000001B180000-0x000000001B1D6000-memory.dmp

Download

memory/2204-0-0x00007FFEAD823000-0x00007FFEAD825000-memory.dmp

Download

memory/2204-15-0x000000001B150000-0x000000001B160000-memory.dmp

Download

memory/2204-14-0x000000001B140000-0x000000001B148000-memory.dmp

Download

memory/2204-8-0x00000000025B0000-0x00000000025B8000-memory.dmp

Download

memory/2204-9-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/2204-1-0x00000000001F0000-0x000000000054A000-memory.dmp

Download

memory/2204-13-0x000000001B160000-0x000000001B16C000-memory.dmp

Download

memory/2204-10-0x00000000025D0000-0x00000000025E6000-memory.dmp

Download

memory/2204-12-0x000000001B130000-0x000000001B142000-memory.dmp

Download

memory/2204-2-0x00007FFEAD820000-0x00007FFEAE2E1000-memory.dmp

Download

memory/2204-11-0x00000000025F0000-0x00000000025F8000-memory.dmp

Download

memory/2204-7-0x000000001B0E0000-0x000000001B130000-memory.dmp

Download

memory/2204-5-0x0000000002580000-0x0000000002588000-memory.dmp

Download

memory/2204-6-0x0000000002590000-0x00000000025AC000-memory.dmp

Download

memory/2204-4-0x0000000002570000-0x000000000257E000-memory.dmp

Download

memory/2204-3-0x0000000002550000-0x000000000255E000-memory.dmp

Download

memory/2972-117-0x000000001BFE0000-0x000000001BFF2000-memory.dmp

Download

memory/3980-211-0x000000001BF80000-0x000000001BF92000-memory.dmp

Download

memory/4928-141-0x000000001CDB0000-0x000000001CE06000-memory.dmp

Download

memory/5060-188-0x000000001CDA0000-0x000000001CDB2000-memory.dmp

Download