dcrat | c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afd

Analysis

max time kernel
120s
max time network
113s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
Size

4.9MB
MD5

a6c5b160e71e3b8abcb03a9f36e34210
SHA1

6d0cf47836c615a7904dafb524aefe90ff905292
SHA256

c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afd
SHA512

db124269161a7fa1cb49c10ce3cfb37af71eff5d5596075f0edc55379622fe33fd048b93c5a42c7c56ded9600594022a8c991c75cca513431f0f9c30514c2b68
SSDEEP

49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2708	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2708	schtasks.exe

UAC bypass 3 TTPs 30 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/2512-3-0x000000001AE30000-0x000000001AF5E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
872	powershell.exe
1032	powershell.exe
1724	powershell.exe
1264	powershell.exe
292	powershell.exe
2456	powershell.exe
2420	powershell.exe
1584	powershell.exe
2536	powershell.exe
1736	powershell.exe
1588	powershell.exe
3024	powershell.exe

Executes dropped EXE 9 IoCs

Processes:

WmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exe

pid	process
1660	WmiPrvSE.exe
1904	WmiPrvSE.exe
528	WmiPrvSE.exe
2988	WmiPrvSE.exe
2624	WmiPrvSE.exe
2912	WmiPrvSE.exe
3024	WmiPrvSE.exe
352	WmiPrvSE.exe
2640	WmiPrvSE.exe

Checks whether UAC is enabled 1 TTPs 20 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

WmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exec9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe

Drops file in Program Files directory 20 IoCs

Processes:

c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\Idle.exe	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\f3b6ecef712a24	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX934C.tmp	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\RCXA6C7.tmp	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\taskhost.exe	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\6ccacd8608530f	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\smss.exe	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\spoolsv.exe	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\RCX99C6.tmp	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\RCXA03E.tmp	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\5940a34987c991	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\b75386f1303e64	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\smss.exe	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\taskhost.exe	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\RCXA4C3.tmp	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\spoolsv.exe	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\69ddcba757bf72	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\Idle.exe	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe

Drops file in Windows directory 4 IoCs

Processes:

c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe

description	ioc	process
File created	C:\Windows\Resources\Themes\dllhost.exe	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File opened for modification	C:\Windows\Resources\Themes\dllhost.exe	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File created	C:\Windows\Resources\Themes\5940a34987c991	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
File opened for modification	C:\Windows\Resources\Themes\RCX9148.tmp	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	process
2968	schtasks.exe
2500	schtasks.exe
2000	schtasks.exe
1256	schtasks.exe
2852	schtasks.exe
2804	schtasks.exe
2104	schtasks.exe
1828	schtasks.exe
1876	schtasks.exe
2816	schtasks.exe
2060	schtasks.exe
2964	schtasks.exe
2924	schtasks.exe
2624	schtasks.exe
2560	schtasks.exe
2772	schtasks.exe
1788	schtasks.exe
980	schtasks.exe
1744	schtasks.exe
1740	schtasks.exe
832	schtasks.exe
1916	schtasks.exe
2760	schtasks.exe
2252	schtasks.exe
2600	schtasks.exe
2628	schtasks.exe
2032	schtasks.exe
2824	schtasks.exe
1484	schtasks.exe
2912	schtasks.exe
2724	schtasks.exe
2128	schtasks.exe
2376	schtasks.exe
3036	schtasks.exe
2204	schtasks.exe
1172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exe

pid	process
2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
2420	powershell.exe
1584	powershell.exe
872	powershell.exe
3024	powershell.exe
1588	powershell.exe
1264	powershell.exe
1032	powershell.exe
2536	powershell.exe
1724	powershell.exe
2456	powershell.exe
292	powershell.exe
1736	powershell.exe
1660	WmiPrvSE.exe
1904	WmiPrvSE.exe
528	WmiPrvSE.exe
2988	WmiPrvSE.exe
2624	WmiPrvSE.exe
2912	WmiPrvSE.exe
3024	WmiPrvSE.exe
352	WmiPrvSE.exe
2640	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	872	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	1032	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	292	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	1660	WmiPrvSE.exe
Token: SeDebugPrivilege	1904	WmiPrvSE.exe
Token: SeDebugPrivilege	528	WmiPrvSE.exe
Token: SeDebugPrivilege	2988	WmiPrvSE.exe
Token: SeDebugPrivilege	2624	WmiPrvSE.exe
Token: SeDebugPrivilege	2912	WmiPrvSE.exe
Token: SeDebugPrivilege	3024	WmiPrvSE.exe
Token: SeDebugPrivilege	352	WmiPrvSE.exe
Token: SeDebugPrivilege	2640	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.execmd.exeWmiPrvSE.exeWScript.exeWmiPrvSE.exeWScript.exeWmiPrvSE.exe

description	pid	process	target process
PID 2512 wrote to memory of 292	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 292	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 292	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 872	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 872	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 872	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1032	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1032	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1032	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 3024	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 3024	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 3024	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 2456	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 2456	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 2456	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 2420	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 2420	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 2420	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1584	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1584	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1584	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1588	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1588	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1588	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1724	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1724	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1724	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 2536	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 2536	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 2536	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1736	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1736	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1736	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1264	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1264	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 1264	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	powershell.exe
PID 2512 wrote to memory of 2852	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	cmd.exe
PID 2512 wrote to memory of 2852	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	cmd.exe
PID 2512 wrote to memory of 2852	2512	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe	cmd.exe
PID 2852 wrote to memory of 1836	2852	cmd.exe	w32tm.exe
PID 2852 wrote to memory of 1836	2852	cmd.exe	w32tm.exe
PID 2852 wrote to memory of 1836	2852	cmd.exe	w32tm.exe
PID 2852 wrote to memory of 1660	2852	cmd.exe	WmiPrvSE.exe
PID 2852 wrote to memory of 1660	2852	cmd.exe	WmiPrvSE.exe
PID 2852 wrote to memory of 1660	2852	cmd.exe	WmiPrvSE.exe
PID 1660 wrote to memory of 2476	1660	WmiPrvSE.exe	WScript.exe
PID 1660 wrote to memory of 2476	1660	WmiPrvSE.exe	WScript.exe
PID 1660 wrote to memory of 2476	1660	WmiPrvSE.exe	WScript.exe
PID 1660 wrote to memory of 2192	1660	WmiPrvSE.exe	WScript.exe
PID 1660 wrote to memory of 2192	1660	WmiPrvSE.exe	WScript.exe
PID 1660 wrote to memory of 2192	1660	WmiPrvSE.exe	WScript.exe
PID 2476 wrote to memory of 1904	2476	WScript.exe	WmiPrvSE.exe
PID 2476 wrote to memory of 1904	2476	WScript.exe	WmiPrvSE.exe
PID 2476 wrote to memory of 1904	2476	WScript.exe	WmiPrvSE.exe
PID 1904 wrote to memory of 1996	1904	WmiPrvSE.exe	WScript.exe
PID 1904 wrote to memory of 1996	1904	WmiPrvSE.exe	WScript.exe
PID 1904 wrote to memory of 1996	1904	WmiPrvSE.exe	WScript.exe
PID 1904 wrote to memory of 2584	1904	WmiPrvSE.exe	WScript.exe
PID 1904 wrote to memory of 2584	1904	WmiPrvSE.exe	WScript.exe
PID 1904 wrote to memory of 2584	1904	WmiPrvSE.exe	WScript.exe
PID 1996 wrote to memory of 528	1996	WScript.exe	WmiPrvSE.exe
PID 1996 wrote to memory of 528	1996	WScript.exe	WmiPrvSE.exe
PID 1996 wrote to memory of 528	1996	WScript.exe	WmiPrvSE.exe
PID 528 wrote to memory of 2292	528	WmiPrvSE.exe	WScript.exe

System policy modification 1 TTPs 30 IoCs

evasion

Modify Registry

T1112

Processes:

WmiPrvSE.exeWmiPrvSE.exec9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe
"C:\Users\Admin\AppData\Local\Temp\c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afdN.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\r0EWGHzCIP.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1836
- - C:\MSOCache\All Users\WmiPrvSE.exe
    "C:\MSOCache\All Users\WmiPrvSE.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1660
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2786dacc-0393-4220-8e6c-fdbfa4d1350d.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2476
    - - C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1904
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2bae6b14-23b5-4fbd-bd08-c28c948c7370.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:528
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e4bb1fe2-b873-4e08-9216-acd832214c3a.vbs"
        8⤵
        
        PID:2292
        
        C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bef3fb44-0561-40b6-a995-15f3e55e6c85.vbs"
        10⤵
        
        PID:2840
        
        C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2624
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\82542388-681b-48ba-b220-28eb6a937b69.vbs"
        12⤵
        
        PID:1556
        
        C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2912
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a00469c4-e828-4788-9a48-0119b2dad775.vbs"
        14⤵
        
        PID:1484
        
        C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3024
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c60a263e-7079-40d9-beba-7e01605fa710.vbs"
        16⤵
        
        PID:668
        
        C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:352
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3bdb74fe-235f-44ca-b104-65dc2402a796.vbs"
        18⤵
        
        PID:1512
        
        C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fca2a3fe-11a0-44b1-9c70-1c24fffeaa56.vbs"
        20⤵
        
        PID:604
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\55249ae7-d4ae-4360-97a0-0e83bdc4c5c8.vbs"
        20⤵
        
        PID:2664
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ff92bf01-f392-4e07-b387-d3d2fd7cfba7.vbs"
        18⤵
        
        PID:3052
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\87d979bd-16fd-4d93-9e75-c2074b879d20.vbs"
        16⤵
        
        PID:3008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c98d05ce-e468-4edb-8958-8ac558272957.vbs"
        14⤵
        
        PID:2856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f68e610b-6981-4136-88c2-8564f43a242c.vbs"
        12⤵
        
        PID:2284
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38b7b354-cd24-43e9-96fa-44d8be124755.vbs"
        10⤵
        
        PID:2208
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e55635cf-989f-4ec5-9395-8c245ef2b32d.vbs"
        8⤵
        
        PID:2348
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\275d10d4-6d84-40b6-a29b-685d3fd6dde3.vbs"
        6⤵
        
        PID:2584
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7ee5e38-d430-4386-9a77-7125dfcce039.vbs"
      4⤵
      PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\Resources\Themes\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Resources\Themes\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\Resources\Themes\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\en-US\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\en-US\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Videos\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Videos\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Videos\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jdk1.7.0_80\jre\lib\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\jre\lib\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jdk1.7.0_80\jre\lib\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Downloads\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Admin\Downloads\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Downloads\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\Office14\1033\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\Office14\1033\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\RCX95BE.tmp

Filesize
4.9MB

MD5
d03b2a5d370c742c330276d0c576ca79

SHA1
499285c28bbc64919b8b9630ac9f4f8e4ac84655

SHA256
0756d787245f529adc5f8ef3e4208aa89af47eefa99e27c4a8fb38cc07eb99d0

SHA512
aa1b5779481d09328f5096ed2099391ba79e9ccf26f286d041feef492b1fed6ae92efcb8f702826e5443df0a515142a449cd30f9a2821d41c8fea92a1b0a3757

Download Submit
C:\Program Files\Windows Photo Viewer\en-US\taskhost.exe

Filesize
4.9MB

MD5
a6c5b160e71e3b8abcb03a9f36e34210

SHA1
6d0cf47836c615a7904dafb524aefe90ff905292

SHA256
c9699c0c052533b14fc3e6fb7fd5f5d7d816de3be73b28e735abb577dc806afd

SHA512
db124269161a7fa1cb49c10ce3cfb37af71eff5d5596075f0edc55379622fe33fd048b93c5a42c7c56ded9600594022a8c991c75cca513431f0f9c30514c2b68

Download Submit
C:\Users\Admin\AppData\Local\Temp\2786dacc-0393-4220-8e6c-fdbfa4d1350d.vbs

Filesize
710B

MD5
98c58b358cf1b7551e3ac1e132f17bbd

SHA1
27283903beff0385cb509ad290e85289dddf550d

SHA256
977a5a3050a504169b1296b85dcfdff4686405bc76f15a33083c4c9f7fd12e78

SHA512
eb1bf47b499929db22416e0b1455af9b85fb3672fe410d4d42761a1d8673793327f7a4ab7d438bba3d0f5419b2ec90bd20e118fbae07f1a27d55cebe7d16c969

Download Submit
C:\Users\Admin\AppData\Local\Temp\2bae6b14-23b5-4fbd-bd08-c28c948c7370.vbs

Filesize
710B

MD5
3f2c037656d3a0b16141e478f8496acf

SHA1
6e5a1161278c6af828e3962b20389c54b260f491

SHA256
f363b280af59aae68b5a98d8c187267557704107ace4bb615d95befcad1ffae5

SHA512
093a2a0b75a6d09ee272fc525635753b31d325188b0727be35bc31a43b201ef26318addc7a10731c28af4f7052423d64039962a4db72a11308710046910ae5fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\3bdb74fe-235f-44ca-b104-65dc2402a796.vbs

Filesize
709B

MD5
13e3245cd52ab424298563c4f102bca5

SHA1
04d1abab01619d760c89be2e618ad7654a4464c2

SHA256
92233a27bc8c3c961bc0bb9f2e6f81c529ffb2e95e82b612b7ae4aa16c1d8bdb

SHA512
85e26a45d0dbaba17fc8eb8d909dda732c933c3a6334969ae32d7cdab1e111cbd6cfa9f6e9cfc454bc222244600b47f4b600a053ed539f93ac531bdd2d027127

Download Submit
C:\Users\Admin\AppData\Local\Temp\82542388-681b-48ba-b220-28eb6a937b69.vbs

Filesize
710B

MD5
6b486f160b0ded8d39d1ce989095740f

SHA1
d2f36d24fbb6cef93f28694e8ae98c62ebeec560

SHA256
e9a4262e9c13dc04c87533ad517889275d8df6eb29542a1b43c885c33790d884

SHA512
a14fb360a91b2085ed6517fbd101f347b0caa6cb4d745af69047e03c8aaaea8cd12b64a572b884f2e6d66880d024c9ed4de9e6ec18dd2107b95928a363ea426e

Download Submit
C:\Users\Admin\AppData\Local\Temp\a00469c4-e828-4788-9a48-0119b2dad775.vbs

Filesize
710B

MD5
147a854764cb115fac50ecfe4637df87

SHA1
2411bd6914755eb2862b6dd97557c09c22bd4b86

SHA256
49719b8565913f20a48e6b5bb0cd0e2b381289f5b401f25906fe757c090ff3e9

SHA512
c528b2f07b67f1ca05c2308954ae93481622d37ea9d287767734efe4ff0a2d8b30a8f350477dab3b58629f6fdb6138a79b628a2943cce0b746331b6510cffe7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\a7ee5e38-d430-4386-9a77-7125dfcce039.vbs

Filesize
486B

MD5
2c32ac171fb89bd33609ec98af8545e6

SHA1
ef2e2d07059d3c96025694fa994992f4b05fca2b

SHA256
ccc8250c2abb2921790b300d113ef9a877cac0afdbf1ebb3a8d4313a462b6c03

SHA512
988cabedb43f7bfff5c0a00a013a8864cfd89dca98b15dce9df01b41205e8e414cf539dec4f2448f32912b3170f0de8e52897f7fb7e798eb57c761cdcb682457

Download Submit
C:\Users\Admin\AppData\Local\Temp\bef3fb44-0561-40b6-a995-15f3e55e6c85.vbs

Filesize
710B

MD5
2561d7455f6d1f293cd2098c342fd2a4

SHA1
4fec3c23dc644513b47cdda2f75d165834f97697

SHA256
a31cdaf68c0f3263d80993072bc38760f8fd7f010690feb2ca5ed93a0c0b28f3

SHA512
93dde03516bc47d801350c5dd80479fb63276c5d3e2786b1904667028961bacfcd03eda1c64888aaf909c028eadb202a42b68aebb38b0eb892a94dba4c296190

Download Submit
C:\Users\Admin\AppData\Local\Temp\c60a263e-7079-40d9-beba-7e01605fa710.vbs

Filesize
710B

MD5
d0c1a0c296ce9a5b221636489f8519e3

SHA1
1d44294fef6e1555fc0953e85117fcd92b47b656

SHA256
1bab601e6e16179396cdd306b710686f495b7b08bc41851df594dfaab1572a23

SHA512
85834a4b63e2e0d7deb57ed82adc6ed0b944533212904eb265590dc76ece907b54acd45ad102f579e039d397a242c637da4fea834d946a057ee4339e82070a5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\e4bb1fe2-b873-4e08-9216-acd832214c3a.vbs

Filesize
709B

MD5
9cb5d069d1d3dc0889209369da145f8b

SHA1
352857186e301a490f27921df4d86f6888de03e0

SHA256
223280839d089a1076569da84ad105603996fd18e719014e93998ccd25f4af83

SHA512
9689915834380519939724a41a8bae7632295953a7597f7e1bf984d276524c6291c9999326d3c4c318e5472be1610f84c3103b88739c68dc096530ebcc194492

Download Submit
C:\Users\Admin\AppData\Local\Temp\fca2a3fe-11a0-44b1-9c70-1c24fffeaa56.vbs

Filesize
710B

MD5
ad1733d97cb95cadb9d5d43e20ed4147

SHA1
0d396315f63ce524d763a3d6fdc519b520697b18

SHA256
aa04d07f46223ed3d199fb0f9ff00ebedde68429e4707090537f49f508a73813

SHA512
661f315771484c8a099cc83bdd60db5043b16c4bdd2c3d4a0d47a9f71ed408c3f26815f0266934eb1b4f7cced1b5611d07e2182b6c4ca7b29b77345ebc67299c

Download Submit
C:\Users\Admin\AppData\Local\Temp\r0EWGHzCIP.bat

Filesize
199B

MD5
67ee3994278b7f86c53d4614f672a007

SHA1
9e05771079de5e3a514328a2818dd6f3a0b5161e

SHA256
6b6b75893be620a18517153f2a35d81d6ff00aa36fe590a1854d405eed024645

SHA512
89c96cc29fb3d16f35aaeafefd8478fc555d4f1f43b19fd72f961a9ea723fb2ab1b499e85e8dd2fa56c70c846bad5de528e6a9a92bb96e460cd9e029f9d7c4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCE47.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b673edcd44dc4eaa9b50a397d6000938

SHA1
421a1e3a4dd191d0205ad95fb2243b7b29eaef27

SHA256
c1266803f3c8561a63320e402673ab853b7ed68b988700d0ecbc454821119a24

SHA512
4d1aa61faadd6aedfbb61cb2c5464a3675ee1f33d1ae3164d0ae712660af5cdcaeaca43374aeb15f98aebbf2110ea56c5d2f54f8ea7c9653f232eb6adb71d1d6

Download Submit
memory/352-301-0x00000000011F0000-0x00000000016E4000-memory.dmp

Filesize
5.0MB

Download
memory/528-228-0x0000000000B40000-0x0000000001034000-memory.dmp

Filesize
5.0MB

Download
memory/1584-194-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/1584-193-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/1660-198-0x0000000001290000-0x0000000001784000-memory.dmp

Filesize
5.0MB

Download
memory/1904-213-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/1904-212-0x00000000002B0000-0x00000000007A4000-memory.dmp

Filesize
5.0MB

Download
memory/2512-14-0x000000001AFA0000-0x000000001AFA8000-memory.dmp

Filesize
32KB

Download
memory/2512-10-0x000000001AF60000-0x000000001AF72000-memory.dmp

Filesize
72KB

Download
memory/2512-7-0x0000000002510000-0x0000000002526000-memory.dmp

Filesize
88KB

Download
memory/2512-6-0x0000000002380000-0x0000000002390000-memory.dmp

Filesize
64KB

Download
memory/2512-1-0x0000000000220000-0x0000000000714000-memory.dmp

Filesize
5.0MB

Download
memory/2512-9-0x0000000002530000-0x000000000253A000-memory.dmp

Filesize
40KB

Download
memory/2512-0-0x000007FEF4FC3000-0x000007FEF4FC4000-memory.dmp

Filesize
4KB

Download
memory/2512-15-0x000000001AFB0000-0x000000001AFB8000-memory.dmp

Filesize
32KB

Download
memory/2512-8-0x0000000002390000-0x00000000023A0000-memory.dmp

Filesize
64KB

Download
memory/2512-12-0x000000001AF80000-0x000000001AF8E000-memory.dmp

Filesize
56KB

Download
memory/2512-13-0x000000001AF90000-0x000000001AF9E000-memory.dmp

Filesize
56KB

Download
memory/2512-132-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

Filesize
9.9MB

Download
memory/2512-11-0x000000001AF70000-0x000000001AF7A000-memory.dmp

Filesize
40KB

Download
memory/2512-2-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

Filesize
9.9MB

Download
memory/2512-5-0x0000000000B20000-0x0000000000B28000-memory.dmp

Filesize
32KB

Download
memory/2512-16-0x000000001AFC0000-0x000000001AFCC000-memory.dmp

Filesize
48KB

Download
memory/2512-4-0x0000000002360000-0x000000000237C000-memory.dmp

Filesize
112KB

Download
memory/2512-3-0x000000001AE30000-0x000000001AF5E000-memory.dmp

Filesize
1.2MB

Download
memory/2624-258-0x0000000000BF0000-0x00000000010E4000-memory.dmp

Filesize
5.0MB

Download
memory/2912-273-0x0000000000EA0000-0x0000000001394000-memory.dmp

Filesize
5.0MB

Download
memory/2988-243-0x0000000000360000-0x0000000000854000-memory.dmp

Filesize
5.0MB

Download