dcrat | 26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Size

4.9MB
MD5

60562837aa924e28dab54be5c6decd4a
SHA1

29e02ab31f9d2b86b2fe3b3bea05adbbaaa87990
SHA256

26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae
SHA512

a45d9d38a47b590e051ab9057d89d2f8abd00f4b148fa2c0bc77e0284bdb9ce0833ff3c0f7c7ae5cbbc80b181184e294e2c23d9bcaa41e3970af959c079c2b52
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat 49 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	pid	Process
		2732	schtasks.exe
		2180	schtasks.exe
		2776	schtasks.exe
		792	schtasks.exe
		1968	schtasks.exe
		2376	schtasks.exe
		2904	schtasks.exe
		1504	schtasks.exe
		2632	schtasks.exe
File created	C:\Program Files\7-Zip\Lang\886983d96e3d3e		26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
		1284	schtasks.exe
		2072	schtasks.exe
		2372	schtasks.exe
		2924	schtasks.exe
		2076	schtasks.exe
		2840	schtasks.exe
		2848	schtasks.exe
		1672	schtasks.exe
		2672	schtasks.exe
		2948	schtasks.exe
		3020	schtasks.exe
		2620	schtasks.exe
		2880	schtasks.exe
		444	schtasks.exe
		1572	schtasks.exe
		2320	schtasks.exe
File created	C:\Windows\ModemLogs\27d1bcfc3c54e0		26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
		2740	schtasks.exe
File created	C:\Windows\SysWOW64\NetworkList\Icons\StockIcons\5940a34987c991		26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\c5b4cb5e9653cc		26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
		2768	schtasks.exe
		1660	schtasks.exe
		1692	schtasks.exe
		2396	schtasks.exe
		2432	schtasks.exe
		468	schtasks.exe
		688	schtasks.exe
		2088	schtasks.exe
		2700	schtasks.exe
		2752	schtasks.exe
		536	schtasks.exe
		2040	schtasks.exe
		2708	schtasks.exe
		2836	schtasks.exe
		2632	schtasks.exe
		1732	schtasks.exe
		1680	schtasks.exe
		568	schtasks.exe
		2292	schtasks.exe

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	792	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2260	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2260	schtasks.exe	30

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.execsrss.execsrss.execsrss.execsrss.execsrss.exe26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/2068-2-0x000000001B610000-0x000000001B73E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
780	powershell.exe
1932	powershell.exe
1784	powershell.exe
576	powershell.exe
1508	powershell.exe
2688	powershell.exe
2680	powershell.exe
2920	powershell.exe
832	powershell.exe
2856	powershell.exe
2604	powershell.exe
1704	powershell.exe
2680	powershell.exe
2404	powershell.exe
1524	powershell.exe
1596	powershell.exe
1068	powershell.exe
664	powershell.exe
2676	powershell.exe
2964	powershell.exe
1640	powershell.exe
2340	powershell.exe
928	powershell.exe
1580	powershell.exe

Executes dropped EXE 12 IoCs

Processes:

26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

pid	Process
620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
2904	csrss.exe
2264	csrss.exe
2068	csrss.exe
2892	csrss.exe
1864	csrss.exe
1520	csrss.exe
3036	csrss.exe
2448	csrss.exe
2140	csrss.exe
1428	csrss.exe
1772	csrss.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe

Drops file in System32 directory 4 IoCs

Processes:

26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\NetworkList\Icons\StockIcons\dllhost.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File created	C:\Windows\SysWOW64\NetworkList\Icons\StockIcons\5940a34987c991	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File opened for modification	C:\Windows\SysWOW64\NetworkList\Icons\StockIcons\RCXA804.tmp	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File opened for modification	C:\Windows\SysWOW64\NetworkList\Icons\StockIcons\dllhost.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe

Drops file in Program Files directory 17 IoCs

Processes:

26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\csrss.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\WmiPrvSE.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\c5b4cb5e9653cc	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\RCXAA75.tmp	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File created	C:\Program Files (x86)\Microsoft.NET\wininit.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\wininit.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File created	C:\Program Files (x86)\Microsoft.NET\56085415360792	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\886983d96e3d3e	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File created	C:\Program Files\7-Zip\Lang\csrss.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\services.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\WmiPrvSE.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\services.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File created	C:\Program Files\7-Zip\Lang\886983d96e3d3e	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCXAE7E.tmp	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\24dbde2999530e	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe

Drops file in Windows directory 10 IoCs

Processes:

26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe

description	ioc	Process
File created	C:\Windows\TAPI\0a1fd5f707cd16	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File created	C:\Windows\ModemLogs\6203df4a6bafc7	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File opened for modification	C:\Windows\TAPI\sppsvc.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File opened for modification	C:\Windows\ModemLogs\lsass.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File created	C:\Windows\ModemLogs\27d1bcfc3c54e0	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File opened for modification	C:\Windows\ModemLogs\RCXAC7A.tmp	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File created	C:\Windows\TAPI\sppsvc.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File created	C:\Windows\ModemLogs\lsass.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File created	C:\Windows\ModemLogs\System.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
File opened for modification	C:\Windows\ModemLogs\System.exe	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
2840	schtasks.exe
2632	schtasks.exe
444	schtasks.exe
2432	schtasks.exe
2376	schtasks.exe
2292	schtasks.exe
2180	schtasks.exe
2040	schtasks.exe
1284	schtasks.exe
1732	schtasks.exe
2076	schtasks.exe
2848	schtasks.exe
2372	schtasks.exe
1692	schtasks.exe
468	schtasks.exe
2836	schtasks.exe
2740	schtasks.exe
1680	schtasks.exe
688	schtasks.exe
2396	schtasks.exe
1968	schtasks.exe
1572	schtasks.exe
2752	schtasks.exe
2708	schtasks.exe
2732	schtasks.exe
2088	schtasks.exe
2904	schtasks.exe
2924	schtasks.exe
2776	schtasks.exe
2632	schtasks.exe
1660	schtasks.exe
2072	schtasks.exe
792	schtasks.exe
2320	schtasks.exe
568	schtasks.exe
1672	schtasks.exe
3020	schtasks.exe
2620	schtasks.exe
2880	schtasks.exe
2768	schtasks.exe
2700	schtasks.exe
1504	schtasks.exe
2948	schtasks.exe
2672	schtasks.exe
536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

pid	Process
2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
1704	powershell.exe
1508	powershell.exe
780	powershell.exe
664	powershell.exe
1932	powershell.exe
2688	powershell.exe
2680	powershell.exe
1596	powershell.exe
1784	powershell.exe
1068	powershell.exe
2856	powershell.exe
576	powershell.exe
620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
1580	powershell.exe
2404	powershell.exe
2964	powershell.exe
2680	powershell.exe
1524	powershell.exe
2920	powershell.exe
2340	powershell.exe
1640	powershell.exe
2676	powershell.exe
832	powershell.exe
928	powershell.exe
2604	powershell.exe
2904	csrss.exe
2264	csrss.exe
2068	csrss.exe
2892	csrss.exe
1864	csrss.exe
1520	csrss.exe
3036	csrss.exe
2448	csrss.exe
2140	csrss.exe
1428	csrss.exe
1772	csrss.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

description	pid	Process
Token: SeDebugPrivilege	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	780	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	664	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	576	powershell.exe
Token: SeDebugPrivilege	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	832	powershell.exe
Token: SeDebugPrivilege	928	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	2904	csrss.exe
Token: SeDebugPrivilege	2264	csrss.exe
Token: SeDebugPrivilege	2068	csrss.exe
Token: SeDebugPrivilege	2892	csrss.exe
Token: SeDebugPrivilege	1864	csrss.exe
Token: SeDebugPrivilege	1520	csrss.exe
Token: SeDebugPrivilege	3036	csrss.exe
Token: SeDebugPrivilege	2448	csrss.exe
Token: SeDebugPrivilege	2140	csrss.exe
Token: SeDebugPrivilege	1428	csrss.exe
Token: SeDebugPrivilege	1772	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe

description	pid	Process	procid_target
PID 2068 wrote to memory of 1596	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	46
PID 2068 wrote to memory of 1596	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	46
PID 2068 wrote to memory of 1596	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	46
PID 2068 wrote to memory of 1068	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	47
PID 2068 wrote to memory of 1068	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	47
PID 2068 wrote to memory of 1068	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	47
PID 2068 wrote to memory of 1704	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	48
PID 2068 wrote to memory of 1704	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	48
PID 2068 wrote to memory of 1704	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	48
PID 2068 wrote to memory of 780	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	49
PID 2068 wrote to memory of 780	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	49
PID 2068 wrote to memory of 780	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	49
PID 2068 wrote to memory of 1932	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	50
PID 2068 wrote to memory of 1932	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	50
PID 2068 wrote to memory of 1932	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	50
PID 2068 wrote to memory of 1784	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	51
PID 2068 wrote to memory of 1784	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	51
PID 2068 wrote to memory of 1784	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	51
PID 2068 wrote to memory of 664	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	52
PID 2068 wrote to memory of 664	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	52
PID 2068 wrote to memory of 664	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	52
PID 2068 wrote to memory of 576	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	53
PID 2068 wrote to memory of 576	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	53
PID 2068 wrote to memory of 576	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	53
PID 2068 wrote to memory of 1508	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	54
PID 2068 wrote to memory of 1508	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	54
PID 2068 wrote to memory of 1508	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	54
PID 2068 wrote to memory of 2856	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	55
PID 2068 wrote to memory of 2856	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	55
PID 2068 wrote to memory of 2856	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	55
PID 2068 wrote to memory of 2688	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	56
PID 2068 wrote to memory of 2688	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	56
PID 2068 wrote to memory of 2688	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	56
PID 2068 wrote to memory of 2680	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	57
PID 2068 wrote to memory of 2680	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	57
PID 2068 wrote to memory of 2680	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	57
PID 2068 wrote to memory of 620	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	70
PID 2068 wrote to memory of 620	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	70
PID 2068 wrote to memory of 620	2068	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	70
PID 620 wrote to memory of 2680	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	102
PID 620 wrote to memory of 2680	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	102
PID 620 wrote to memory of 2680	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	102
PID 620 wrote to memory of 2676	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	103
PID 620 wrote to memory of 2676	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	103
PID 620 wrote to memory of 2676	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	103
PID 620 wrote to memory of 832	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	104
PID 620 wrote to memory of 832	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	104
PID 620 wrote to memory of 832	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	104
PID 620 wrote to memory of 1524	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	106
PID 620 wrote to memory of 1524	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	106
PID 620 wrote to memory of 1524	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	106
PID 620 wrote to memory of 2604	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	108
PID 620 wrote to memory of 2604	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	108
PID 620 wrote to memory of 2604	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	108
PID 620 wrote to memory of 2404	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	109
PID 620 wrote to memory of 2404	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	109
PID 620 wrote to memory of 2404	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	109
PID 620 wrote to memory of 2964	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	110
PID 620 wrote to memory of 2964	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	110
PID 620 wrote to memory of 2964	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	110
PID 620 wrote to memory of 1580	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	111
PID 620 wrote to memory of 1580	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	111
PID 620 wrote to memory of 1580	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	111
PID 620 wrote to memory of 928	620	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe	112

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

Processes:

csrss.execsrss.exe26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.execsrss.execsrss.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
"C:\Users\Admin\AppData\Local\Temp\26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe"
1⤵
- DcRat
- UAC bypass
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Users\Admin\AppData\Local\Temp\26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe
  "C:\Users\Admin\AppData\Local\Temp\26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OVO2yVWNDR.bat"
    3⤵
    PID:1704
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:2532
  - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:2904
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\625c9c6d-0c6f-438f-a484-4b5c5a2a302b.vbs"
        5⤵
        
        PID:1320
      - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2264
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\708ef985-95e5-4de0-9c0b-211041a6229f.vbs"
        7⤵
        
        PID:2200
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d7296721-0235-48fa-9447-2966b4c6ce85.vbs"
        9⤵
        
        PID:1164
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2892
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a11239df-4c32-4ae2-bebb-ccfa3140b37a.vbs"
        11⤵
        
        PID:2108
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1864
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d980f05-9c5f-4a55-8031-86f4ac6f5e0f.vbs"
        13⤵
        
        PID:2936
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1520
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d961368d-0ab1-4d75-b5ce-43a9ecc89065.vbs"
        15⤵
        
        PID:576
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6dad400d-20c9-491d-b717-78d6790b75e5.vbs"
        17⤵
        
        PID:1764
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe"
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2448
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7675369e-ad9b-4d40-9e49-afc903048fd0.vbs"
        19⤵
        
        PID:1164
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe"
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2140
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\568aa2d1-9a98-47aa-9bef-b18e7e2044a3.vbs"
        21⤵
        
        PID:856
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe"
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1428
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\07ccb2c0-20e1-4256-ba07-ec7c30022424.vbs"
        23⤵
        
        PID:2912
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe"
        24⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1772
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a3a772b4-3270-4052-9c98-31dd28a4ea1e.vbs"
        25⤵
        
        PID:3008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\63f0e6bf-fc16-4b1b-b85e-bee3a91b5d61.vbs"
        25⤵
        
        PID:1524
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a5adedd-c9eb-4045-959a-0893224b31c3.vbs"
        23⤵
        
        PID:2444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8ef212e-5e0f-4498-9b57-9cd425c48fb5.vbs"
        21⤵
        
        PID:2780
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a500a2aa-147e-426c-868a-729984e493a2.vbs"
        19⤵
        
        PID:2892
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fc9fbdf4-fc12-4506-bc41-2ef220f868a3.vbs"
        17⤵
        
        PID:1708
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\401fe871-92fe-4620-9d44-b8d9778629ce.vbs"
        15⤵
        
        PID:108
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c68e5f8c-b0b3-410a-9047-8f9234adca0f.vbs"
        13⤵
        
        PID:2324
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c9e57f60-641d-4576-bf19-5c149095e0b8.vbs"
        11⤵
        
        PID:688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94a987c9-a562-4438-9ff6-af7620c27519.vbs"
        9⤵
        
        PID:1800
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a46830c0-b7e6-4eca-aaa0-43c04a872c80.vbs"
        7⤵
        
        PID:2776
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a90b3f9-fd7b-4ac6-ab6e-75c59112ae02.vbs"
        5⤵
        
        PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\SysWOW64\NetworkList\Icons\StockIcons\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\SysWOW64\NetworkList\Icons\StockIcons\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\SysWOW64\NetworkList\Icons\StockIcons\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\ModemLogs\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\ModemLogs\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\ModemLogs\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Windows\TAPI\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\TAPI\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Windows\TAPI\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Documents\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\Documents\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Documents\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\ModemLogs\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\ModemLogs\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Windows\ModemLogs\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\csrss.exe

Filesize
4.9MB

MD5
60562837aa924e28dab54be5c6decd4a

SHA1
29e02ab31f9d2b86b2fe3b3bea05adbbaaa87990

SHA256
26ea7d480a77e3f9aaa9b52aaaa2e028fea4e286c53905b3e304ec96a34027ae

SHA512
a45d9d38a47b590e051ab9057d89d2f8abd00f4b148fa2c0bc77e0284bdb9ce0833ff3c0f7c7ae5cbbc80b181184e294e2c23d9bcaa41e3970af959c079c2b52

Download Submit
C:\Users\Admin\AppData\Local\Temp\07ccb2c0-20e1-4256-ba07-ec7c30022424.vbs

Filesize
751B

MD5
1d69eac21766d43e718389f70c76ddd7

SHA1
fa6fe5899cec70a8a564304ae6cb711cd23748d6

SHA256
5cea696970218eda937f893b59f8621bbebe1aeb5820e3c31e177ab35da648fc

SHA512
2e29266ae0982e96188624dfb813ed2e3c26db52ac0fb3a93797825a3c80b9ac2c669825c34d13364879c995c4531e14335a858f013bbab54177ff8c1fdfa5f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\568aa2d1-9a98-47aa-9bef-b18e7e2044a3.vbs

Filesize
751B

MD5
ff980a58db450630311321795de4307b

SHA1
5132b5ad5acdfe62aa7153fdc778db96f6ce924d

SHA256
3e555240bc9ea44833fab6779ef7c2bcedb29131d4dc1d8d0dc85eaf6a9d3a6f

SHA512
2e7c35082ad1bbb9ef8cdd9628c0673f0e3adba56c3823657c4ed515737e9e835a67257eed3dcfaa7f72390d52fc4418dd06090009d6649b53799e2853c0deeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\5d980f05-9c5f-4a55-8031-86f4ac6f5e0f.vbs

Filesize
751B

MD5
70fb67267c9990d74de40a53ecf5d914

SHA1
448b7c5d4313703987934515d724cdb98e321f8d

SHA256
c7e1b37d738305e698bce60bc629626dd922eddbc0039f1021965151c1f28e5e

SHA512
569a4c5256558e5b890fff717ccb748171fbd17ffeabf7ba6bc7c545375e9150bdbfd01d3e7f82f15071c5a825a1b6d5b78ed4f670d99015c1394d8646b4993a

Download Submit
C:\Users\Admin\AppData\Local\Temp\625c9c6d-0c6f-438f-a484-4b5c5a2a302b.vbs

Filesize
751B

MD5
64b80fb67a82691f6cf6547ee47fcd4d

SHA1
720cc445d79d7cc175a908ffd716304e9bb97376

SHA256
6e4b64344aafd5ef2cb4717144d6e285a858e5c8a4f4b21a7d8fe0f6a48cf648

SHA512
d4efa7530bd284eef86e9fabbcd14c546c5a7aed924e451554a92b614c03b3c31220e73b202009b0616b60c21061b95c2d0b92dfac3caf87788b8a2721822755

Download Submit
C:\Users\Admin\AppData\Local\Temp\6dad400d-20c9-491d-b717-78d6790b75e5.vbs

Filesize
751B

MD5
f2c6b6a4f42603be8711aa6beb3dcf24

SHA1
d29a8400678327dd3316eb28f90f25e3d5f5089f

SHA256
07afd2d9af71472c5f224f3344ec76ad295a36cec6acb29645811468b30531cd

SHA512
dc87b3712ea3c87c2e9925fe665fd1cff39f5d0e21d4ee413d8c085e517174e503202da26daeb1211cd2e6e3b9ddfc2e6998a5acced3084a1ae504bf2e83ef1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\708ef985-95e5-4de0-9c0b-211041a6229f.vbs

Filesize
751B

MD5
5056057f45159931d0a39b16b007eb68

SHA1
09246c54c32a90fb2c7a5f1126f38f10163cac30

SHA256
018e2b4b35f94fd3042c380a6df3d4968466391d2b86fadd013727d03fa54bf0

SHA512
cf67b7fda422fca3699677bfaa4d2a7de8b80a713ebf62e6091a2fb76a4c26a2c24b7e927119b850d6147b514a9661270b80eee3252c91ed86451ec17d984ecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7675369e-ad9b-4d40-9e49-afc903048fd0.vbs

Filesize
751B

MD5
1655016e2b1f5f91f694b3aa67fce40c

SHA1
2550803687ad5767a89fac1c68534caa20dfbb74

SHA256
e04b06894acab0887c290e9e87e2dbe27193d9a4cb54bf999af35072df87cc5e

SHA512
d1ef5f59eb4d8c95d46940813a480aa4ceb501e8ccbcbc72fcfb7ac38de104140c7cc370559285750503ce658e1bee831a3f1d1f8ccaba161c277386ce2ec303

Download Submit
C:\Users\Admin\AppData\Local\Temp\7a90b3f9-fd7b-4ac6-ab6e-75c59112ae02.vbs

Filesize
527B

MD5
f4fb0ee0ce5a7781228efd95619f02f0

SHA1
336df09fef651d71a5f92cbed8c7b98e6e4852ca

SHA256
85338e10702b90f322ce7c32e683559b1ce56f0e81edf753bdf9455ca36f024f

SHA512
42de79f376af58f696a6b60d48ff72291737bfe862845ff2d143bbaec7cb2b49592b9bd46a55991f27ae9d4c1ed4eaef5b27f271aa4ac3defbb4de9f9c969994

Download Submit
C:\Users\Admin\AppData\Local\Temp\OVO2yVWNDR.bat

Filesize
240B

MD5
60a99a6fd4d6b028ae3b2197ed833849

SHA1
471ecce46f6969306d2387c14f744ce119b91a4b

SHA256
a8b5b7675a1441bc7eb19da9fe0f2da93b44769dfe0cb3435e5cac6e0682ba4a

SHA512
8855be9d3ffe03686762b8500dcc88b396ef1f864e9c7910219800dbfc405e9011c00e27e76a64d9da7ce8fdde5b9e58e41c28f5f09e22fcb95ccf51629781a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\a11239df-4c32-4ae2-bebb-ccfa3140b37a.vbs

Filesize
751B

MD5
b3db9cd1b3f5542f48017f836718dd84

SHA1
e91d01f80852512d27dbbd01c9f6b8c20757414f

SHA256
34257720093a96a991e5e386db9eefabc754b89ea37c3ae22310d4a9c9539776

SHA512
379cdeeae5e224a7abbd493ea9b28029fa4ecd0c8bd1eba608fd512fc0ec6d8bb3a876e00a6089bb4dc816e4ca69cff0a135ede80133076e315567c469af1231

Download Submit
C:\Users\Admin\AppData\Local\Temp\d7296721-0235-48fa-9447-2966b4c6ce85.vbs

Filesize
751B

MD5
5c70a61598f08ee819f0177660309742

SHA1
f18474661cea5beba6c195925776faca1864cd03

SHA256
d7d47b87c801ece07415cd87341c4446eabf5717b7dd6db9b8237418b1eeb23d

SHA512
1db1f39e48711a6e6642112d10192cfef7c07f11999019c2f3a13be403e5a4852617bde7024df1429a82f0f8761e0c0a8d40e5f095d92d7388e68316a376a686

Download Submit
C:\Users\Admin\AppData\Local\Temp\d961368d-0ab1-4d75-b5ce-43a9ecc89065.vbs

Filesize
751B

MD5
d5a9ab25559cbba7e04b37679d1f5524

SHA1
5339a298e273a7a2755d9bfb31bd307504d1ba0a

SHA256
217646dc1877f9c12712b86b57ac9b9556d437a8a8cf65352a67d5512a79c2b6

SHA512
f39445aa50b5aa90e7ed0f16466818855c54de05a34daa3b470ead7bb661fe2a58f50c571963e32b50b0c4f9be076ac86beb07b416b2b00093d4bbc1a46edd58

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC236.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
c02df87aef6b174b223c05c7bea76c46

SHA1
9692618ad78a6ad409fbb426cd3414589fe70f81

SHA256
bb34f99f6fd4711ed07035fa7dcd90e150183934e07912d9d2bdbd2c294030a4

SHA512
ab531178a389b2ac52c403af0353b41f6803610a3aed2b0247e8200e058570a32725de4f2b2c17be5603e354548ca16b1975d12157344bf4f217338090bbddd1

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1580-208-0x0000000002060000-0x0000000002068000-memory.dmp

Filesize
32KB

Download
memory/1580-190-0x000000001B7F0000-0x000000001BAD2000-memory.dmp

Filesize
2.9MB

Download
memory/1704-78-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/1704-89-0x00000000026D0000-0x00000000026D8000-memory.dmp

Filesize
32KB

Download
memory/1864-305-0x0000000000B40000-0x0000000000B52000-memory.dmp

Filesize
72KB

Download
memory/1864-304-0x00000000011E0000-0x00000000016D4000-memory.dmp

Filesize
5.0MB

Download
memory/2068-0-0x000007FEF5923000-0x000007FEF5924000-memory.dmp

Filesize
4KB

Download
memory/2068-4-0x0000000000530000-0x000000000054C000-memory.dmp

Filesize
112KB

Download
memory/2068-77-0x000007FEF5920000-0x000007FEF630C000-memory.dmp

Filesize
9.9MB

Download
memory/2068-12-0x0000000000B60000-0x0000000000B6E000-memory.dmp

Filesize
56KB

Download
memory/2068-11-0x0000000000AD0000-0x0000000000ADA000-memory.dmp

Filesize
40KB

Download
memory/2068-1-0x0000000001090000-0x0000000001584000-memory.dmp

Filesize
5.0MB

Download
memory/2068-13-0x0000000000B70000-0x0000000000B7E000-memory.dmp

Filesize
56KB

Download
memory/2068-10-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Filesize
72KB

Download
memory/2068-2-0x000000001B610000-0x000000001B73E000-memory.dmp

Filesize
1.2MB

Download
memory/2068-9-0x0000000000AB0000-0x0000000000ABA000-memory.dmp

Filesize
40KB

Download
memory/2068-273-0x0000000000860000-0x0000000000D54000-memory.dmp

Filesize
5.0MB

Download
memory/2068-5-0x0000000000550000-0x0000000000558000-memory.dmp

Filesize
32KB

Download
memory/2068-3-0x000007FEF5920000-0x000007FEF630C000-memory.dmp

Filesize
9.9MB

Download
memory/2068-16-0x0000000000BA0000-0x0000000000BAC000-memory.dmp

Filesize
48KB

Download
memory/2068-7-0x0000000000570000-0x0000000000586000-memory.dmp

Filesize
88KB

Download
memory/2068-14-0x0000000000B80000-0x0000000000B88000-memory.dmp

Filesize
32KB

Download
memory/2068-15-0x0000000000B90000-0x0000000000B98000-memory.dmp

Filesize
32KB

Download
memory/2068-8-0x0000000000AA0000-0x0000000000AB0000-memory.dmp

Filesize
64KB

Download
memory/2068-6-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/2264-258-0x00000000003B0000-0x00000000008A4000-memory.dmp

Filesize
5.0MB

Download
memory/2448-348-0x0000000001150000-0x0000000001644000-memory.dmp

Filesize
5.0MB

Download
memory/2448-349-0x0000000000BB0000-0x0000000000BC2000-memory.dmp

Filesize
72KB

Download
memory/2892-289-0x00000000023D0000-0x00000000023E2000-memory.dmp

Filesize
72KB

Download
memory/2892-288-0x00000000003F0000-0x00000000008E4000-memory.dmp

Filesize
5.0MB

Download
memory/2904-244-0x0000000000ED0000-0x00000000013C4000-memory.dmp

Filesize
5.0MB

Download