dcrat | 24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
Size

4.9MB
MD5

d8d7c64dcdd9a4cd64ba109c53e2ad60
SHA1

f09ef22d84d9d1dfafbb921e0c96d561a980988d
SHA256

24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945
SHA512

16840d35e62c73b271f29a89b90b4c2df6d976d39cdcc9f06b6f0f796168eddc8359642ee28ef64ff8513d9e13cefeb2c1c847927d3ba7bdbbc350813439041f
SSDEEP

49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2776	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2776	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2776	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2776	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2776	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2776	schtasks.exe	30

UAC bypass 3 TTPs 33 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/2200-3-0x000000001AB90000-0x000000001ACBE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2588	powershell.exe
2584	powershell.exe
2604	powershell.exe
2664	powershell.exe
2432	powershell.exe
2144	powershell.exe
2168	powershell.exe
2244	powershell.exe
1520	powershell.exe
2900	powershell.exe
2620	powershell.exe
2652	powershell.exe

Executes dropped EXE 10 IoCs

Processes:

System.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exe

pid	Process
2196	System.exe
3060	System.exe
2456	System.exe
1096	System.exe
1408	System.exe
2332	System.exe
676	System.exe
2360	System.exe
1932	System.exe
1156	System.exe

Checks whether UAC is enabled 1 TTPs 22 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

System.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exe24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe

Drops file in Program Files directory 4 IoCs

Processes:

24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browser\features\27d1bcfc3c54e0	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\RCXAF25.tmp	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\System.exe	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\System.exe	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe

Drops file in Windows directory 4 IoCs

Processes:

24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\ScanFile\RCXAD22.tmp	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
File created	C:\Windows\SoftwareDistribution\ScanFile\wininit.exe	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
File opened for modification	C:\Windows\SoftwareDistribution\ScanFile\wininit.exe	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
File created	C:\Windows\SoftwareDistribution\ScanFile\56085415360792	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
2596	schtasks.exe
3016	schtasks.exe
2424	schtasks.exe
2728	schtasks.exe
2844	schtasks.exe
2848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exe

pid	Process
2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
2604	powershell.exe
2652	powershell.exe
2664	powershell.exe
2432	powershell.exe
2620	powershell.exe
2584	powershell.exe
2588	powershell.exe
2144	powershell.exe
2900	powershell.exe
2244	powershell.exe
2168	powershell.exe
1520	powershell.exe
2196	System.exe
3060	System.exe
2456	System.exe
1096	System.exe
1408	System.exe
2332	System.exe
676	System.exe
2360	System.exe
1932	System.exe
1156	System.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

description	pid	Process
Token: SeDebugPrivilege	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	2196	System.exe
Token: SeDebugPrivilege	3060	System.exe
Token: SeDebugPrivilege	2456	System.exe
Token: SeDebugPrivilege	1096	System.exe
Token: SeDebugPrivilege	1408	System.exe
Token: SeDebugPrivilege	2332	System.exe
Token: SeDebugPrivilege	676	System.exe
Token: SeDebugPrivilege	2360	System.exe
Token: SeDebugPrivilege	1932	System.exe
Token: SeDebugPrivilege	1156	System.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exeSystem.exeWScript.exeSystem.exeWScript.exeSystem.exeWScript.exe

description	pid	Process	procid_target
PID 2200 wrote to memory of 1520	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	37
PID 2200 wrote to memory of 1520	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	37
PID 2200 wrote to memory of 1520	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	37
PID 2200 wrote to memory of 2900	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	38
PID 2200 wrote to memory of 2900	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	38
PID 2200 wrote to memory of 2900	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	38
PID 2200 wrote to memory of 2588	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	39
PID 2200 wrote to memory of 2588	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	39
PID 2200 wrote to memory of 2588	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	39
PID 2200 wrote to memory of 2584	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	40
PID 2200 wrote to memory of 2584	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	40
PID 2200 wrote to memory of 2584	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	40
PID 2200 wrote to memory of 2604	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	41
PID 2200 wrote to memory of 2604	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	41
PID 2200 wrote to memory of 2604	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	41
PID 2200 wrote to memory of 2620	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	42
PID 2200 wrote to memory of 2620	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	42
PID 2200 wrote to memory of 2620	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	42
PID 2200 wrote to memory of 2652	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	43
PID 2200 wrote to memory of 2652	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	43
PID 2200 wrote to memory of 2652	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	43
PID 2200 wrote to memory of 2664	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	44
PID 2200 wrote to memory of 2664	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	44
PID 2200 wrote to memory of 2664	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	44
PID 2200 wrote to memory of 2432	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	45
PID 2200 wrote to memory of 2432	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	45
PID 2200 wrote to memory of 2432	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	45
PID 2200 wrote to memory of 2144	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	46
PID 2200 wrote to memory of 2144	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	46
PID 2200 wrote to memory of 2144	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	46
PID 2200 wrote to memory of 2168	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	47
PID 2200 wrote to memory of 2168	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	47
PID 2200 wrote to memory of 2168	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	47
PID 2200 wrote to memory of 2244	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	48
PID 2200 wrote to memory of 2244	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	48
PID 2200 wrote to memory of 2244	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	48
PID 2200 wrote to memory of 2196	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	61
PID 2200 wrote to memory of 2196	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	61
PID 2200 wrote to memory of 2196	2200	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe	61
PID 2196 wrote to memory of 2348	2196	System.exe	62
PID 2196 wrote to memory of 2348	2196	System.exe	62
PID 2196 wrote to memory of 2348	2196	System.exe	62
PID 2196 wrote to memory of 3020	2196	System.exe	63
PID 2196 wrote to memory of 3020	2196	System.exe	63
PID 2196 wrote to memory of 3020	2196	System.exe	63
PID 2348 wrote to memory of 3060	2348	WScript.exe	65
PID 2348 wrote to memory of 3060	2348	WScript.exe	65
PID 2348 wrote to memory of 3060	2348	WScript.exe	65
PID 3060 wrote to memory of 2128	3060	System.exe	66
PID 3060 wrote to memory of 2128	3060	System.exe	66
PID 3060 wrote to memory of 2128	3060	System.exe	66
PID 3060 wrote to memory of 2544	3060	System.exe	67
PID 3060 wrote to memory of 2544	3060	System.exe	67
PID 3060 wrote to memory of 2544	3060	System.exe	67
PID 2128 wrote to memory of 2456	2128	WScript.exe	68
PID 2128 wrote to memory of 2456	2128	WScript.exe	68
PID 2128 wrote to memory of 2456	2128	WScript.exe	68
PID 2456 wrote to memory of 2152	2456	System.exe	69
PID 2456 wrote to memory of 2152	2456	System.exe	69
PID 2456 wrote to memory of 2152	2456	System.exe	69
PID 2456 wrote to memory of 2520	2456	System.exe	70
PID 2456 wrote to memory of 2520	2456	System.exe	70
PID 2456 wrote to memory of 2520	2456	System.exe	70
PID 2152 wrote to memory of 1096	2152	WScript.exe	71

System policy modification 1 TTPs 33 IoCs

evasion

Modify Registry

T1112

Processes:

System.exe24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exeSystem.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe
"C:\Users\Admin\AppData\Local\Temp\24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945N.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Program Files\Mozilla Firefox\browser\features\System.exe
  "C:\Program Files\Mozilla Firefox\browser\features\System.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2196
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\24bf6c9f-099f-4a24-b44c-39f524386da9.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Program Files\Mozilla Firefox\browser\features\System.exe
      "C:\Program Files\Mozilla Firefox\browser\features\System.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3060
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e96b726-0674-4c6c-ba94-68987b5b9de8.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2128
      - C:\Program Files\Mozilla Firefox\browser\features\System.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\System.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2456
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d73ccb25-3971-40c8-acb1-36194743c050.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Program Files\Mozilla Firefox\browser\features\System.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\System.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1096
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26566f50-52a1-4970-a89c-528ac8a20460.vbs"
        9⤵
        
        PID:2676
        
        C:\Program Files\Mozilla Firefox\browser\features\System.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\System.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1408
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8497e2eb-9b01-40eb-b793-5cf144d755e1.vbs"
        11⤵
        
        PID:1848
        
        C:\Program Files\Mozilla Firefox\browser\features\System.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\System.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2332
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1bd8bf5d-3122-4b71-a4ac-e0990fb10cd3.vbs"
        13⤵
        
        PID:836
        
        C:\Program Files\Mozilla Firefox\browser\features\System.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\System.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:676
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\807eadac-2cab-45f1-a6ab-9d3655157455.vbs"
        15⤵
        
        PID:2292
        
        C:\Program Files\Mozilla Firefox\browser\features\System.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\System.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2360
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e40802c8-6e64-47ef-a095-f00f0c91b65b.vbs"
        17⤵
        
        PID:2592
        
        C:\Program Files\Mozilla Firefox\browser\features\System.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\System.exe"
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1932
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\caed1c49-b55b-483d-a2d6-bdb230ce07cb.vbs"
        19⤵
        
        PID:2304
        
        C:\Program Files\Mozilla Firefox\browser\features\System.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\System.exe"
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1156
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be4c0457-8e9a-4960-b303-6b489f5e1c99.vbs"
        21⤵
        
        PID:2240
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\18fd9079-740a-4a55-9063-3bda61e17fab.vbs"
        21⤵
        
        PID:2052
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1342a692-2657-435c-a296-bf89dc96a71a.vbs"
        19⤵
        
        PID:1916
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e7611c8-80df-4784-802b-7812cbdc1e15.vbs"
        17⤵
        
        PID:884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9c5526bd-10de-4945-a17c-1c32f1009511.vbs"
        15⤵
        
        PID:1044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6f190d91-20b6-4bff-bdd4-01d4ce10559c.vbs"
        13⤵
        
        PID:3004
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72e76b00-3604-481c-b2ff-6ba41b624e02.vbs"
        11⤵
        
        PID:2740
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aa5a6561-4fb0-4092-9c4e-65b3376c4344.vbs"
        9⤵
        
        PID:2244
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e97b27a0-8b98-4f0f-8d3d-f509b47b96a2.vbs"
        7⤵
        
        PID:2520
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a8e4bcc-02b1-4a7d-b904-7b8a341134fc.vbs"
        5⤵
        
        PID:2544
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0388078-cb26-4971-bbb3-2fdbedf74f82.vbs"
    3⤵
    PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\SoftwareDistribution\ScanFile\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\ScanFile\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\SoftwareDistribution\ScanFile\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\browser\features\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\features\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\browser\features\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mozilla Firefox\browser\features\System.exe

Filesize
4.9MB

MD5
18670f9d826f10ca5890f67a328fcb31

SHA1
c6d44cb37a1bc0128432f15b2de69a7defd6befa

SHA256
42be5bba32ff785927c5edf6821ee4cfece45cc76db7eb2b9703d352f734c898

SHA512
d2f314f639b7f92049802f73137a025e66cac5d3de8c1548cbecce4a7c7ff6b1f02be4e99bf13ca7384d4f1d89608d6bfc48ea4808912be71863798e83390c06

Download Submit
C:\Users\Admin\AppData\Local\Temp\0e96b726-0674-4c6c-ba94-68987b5b9de8.vbs

Filesize
736B

MD5
6facd43888a2da35d76d336ba3bd1a92

SHA1
5349548644b30812aabedd6d49176d15eb895fea

SHA256
437a02f4aa67064f95a7f81df3dfebcca60548cb0e05520a2f2ec982b7742fd7

SHA512
1fd8ab3b4937c0aa10e904eec4678dcf0d1775dc1bf3dda9e3f74060684413296c9498c7d4620fe7a99916bde0eca95a423f5184b7d1fcf6a50f036490bfd784

Download Submit
C:\Users\Admin\AppData\Local\Temp\1bd8bf5d-3122-4b71-a4ac-e0990fb10cd3.vbs

Filesize
736B

MD5
f31c03cad1ac5a81d9f405d3947765bc

SHA1
57c8b6c8cd66f94ce326df562c8d1399f0d8eb26

SHA256
35bcf2575f3a6c582c49bf6dda5ba5ffcf09e221e933d311956f1bb376970d1c

SHA512
5062c31f557cbff3a263beb0e1ede883c98f12b78403d4801a2bd4afe9b1ad80cd7b72a044c191a73db2bcac5dd2ddfce7bdfba55bb4589ef1b102778702e624

Download Submit
C:\Users\Admin\AppData\Local\Temp\24bf6c9f-099f-4a24-b44c-39f524386da9.vbs

Filesize
736B

MD5
344e4f3725280c406bd9b3d4c7c696c9

SHA1
e43b364d5c4a7c5bfa429a9f8791d6f920f6d0e5

SHA256
c2fa7822063565f7bd4e5e677052db1798d3f6a8eae46ce28093f632d4104c21

SHA512
c3b2db58a8fc112fded28489f9eb53fb3c70cbcaebaa9a2d47ea0e6c4617046d25462c1258a2161c3d60c2cd508d70145831f079460b69f165d005770651e0f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\26566f50-52a1-4970-a89c-528ac8a20460.vbs

Filesize
736B

MD5
1a62abda435014559c2460e5073d8dd7

SHA1
9d8ab4c39c0dec385b7ff93c464b14c101339a6d

SHA256
c5acd98cf75ce09e6ecc04f3d4d314cf797126b6b7272a005fa1e47d1588b2d2

SHA512
926bcd1d25911a2b04f39bfc0f1bd19eff629ed5835ac6a189271d5ef5032892c7b3f12f743b67d82c8b6eebed0528e206cf851e91d672b3c5a83aeee6592f27

Download Submit
C:\Users\Admin\AppData\Local\Temp\807eadac-2cab-45f1-a6ab-9d3655157455.vbs

Filesize
735B

MD5
61ec4f795b6b5a2971b0b34c57885f49

SHA1
bb48150252d7f99ea37640ae4610c6f84a277286

SHA256
16667d712845851db74055f0962f9cd6d1d14a2d253d057287ded9281b9aa3ac

SHA512
7fc2d63c0954fc1b34b00096c12f9048862ca95880e3e57bdab02a94f5af3cfe30220b42d6c067cae03b608e0b727aed91e1d2ff8c0cd3e4e8ef9fb2ecd426e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\8497e2eb-9b01-40eb-b793-5cf144d755e1.vbs

Filesize
736B

MD5
9f8b1093db057ab2a138436f70b8afca

SHA1
1a318a97fce89e4b4220e131fe4104765a5648e4

SHA256
b218b5bb2733fdbdb6246db95c4c60a22a303f16ffbf58766b400d63d7fe97b7

SHA512
2e4df65387435cbbcd0fb817370d379cb4a50d8d0746478c0a9cfbe78df26ff6278e2e7bd48601140419c635aee3bd94900e393b30167fca5ec64280c403c891

Download Submit
C:\Users\Admin\AppData\Local\Temp\be4c0457-8e9a-4960-b303-6b489f5e1c99.vbs

Filesize
736B

MD5
a368bb267380e3baa497dcdc546af8ff

SHA1
cc7a9ab5d2bdee62412d8c1d85f0d386c0eb5b99

SHA256
62cffb89f7750cbb5430d16544f745d442b4b0b404202f3c85d913b08b301df4

SHA512
d55f07546cc9e850eaecd4d94495fea9c641f36abed3b6472acaa9ed133a7953122d882576444ab2c7645ef39ab89072b21806c1de133612f35bf3bc030398d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\c0388078-cb26-4971-bbb3-2fdbedf74f82.vbs

Filesize
512B

MD5
07f5bc7cc2b486e107fff9956d75c31c

SHA1
a24c4a01906173fa7bc76352ede71c99378606c4

SHA256
a180bab10809ca0e00f36c801c0d9d61467e11f7c8f60efe6b49a2bfb2eb8179

SHA512
1305c7c186ead5d34aed1b86359c49f5ad1950632a95e687052affa085f81014cb871e7b4bc809cdde1e77e4eafeb4df0a3ba1ba0e2ef7ab3986c65e8b4345fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\caed1c49-b55b-483d-a2d6-bdb230ce07cb.vbs

Filesize
736B

MD5
0803628a03f06dbbcb6a0f30b1fce399

SHA1
4d2c06e3998fab1e0093f406f32b5cf263115834

SHA256
e0eff503c02bd61c54adc82a870a8b36ac0ff74f3d2899dbc167598d64224f4f

SHA512
a19fa7b2332c7265f7d49ec288024f5e8b295039e1f2956a28687478d65d7ba0d831d99ada6ddc3baa88db3f92af8b1ec3b1ccbcb33518f351c9ddc92586cda2

Download Submit
C:\Users\Admin\AppData\Local\Temp\d73ccb25-3971-40c8-acb1-36194743c050.vbs

Filesize
736B

MD5
b50af35458c97fab964a0c8d57212d53

SHA1
482e215288d8bccdd4c386373427e28b6a173280

SHA256
fe04326a849ea823e1c4beb59917eef795d19171889f8e9e220ab124a53ea673

SHA512
25da52f2e2a65694ae0130ca524b858109a6316443c1c616bf4c002076432bc92a13f8866e90636c0af9b13deb0f967700ea67679928790ed63d6b25a3898855

Download Submit
C:\Users\Admin\AppData\Local\Temp\e40802c8-6e64-47ef-a095-f00f0c91b65b.vbs

Filesize
736B

MD5
6076d377e6e49129ccb5126979721efc

SHA1
657c078b143d5ba6d4cc26558c5de0161f2ff025

SHA256
0bd6050443f40cc9f6034c7111225194bf33b44decfc79c1739a232806e30324

SHA512
6dc3760aa88fdcb04b798106eb60cb9d79cd76e2c8351665e6672f63a82fbf564e1c59372abc8b7d98b7d2f305bf290a5978b4a6ed310fb37f18d973a4e4e422

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC5DE.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f8791b6df5e1803288ed01c84dc1c1b7

SHA1
0c03dc2da7a2d13bc1633dff467973a00a4c9a79

SHA256
ef183ebb7e314539ecf48c46e2e3d7b386ff685d32a183c19b382aaca7991830

SHA512
1c4dcc017b9dccc3f6aea26765fd8aabe17624980895ad303317856081e43d5755726e5fc413d5f8d56b9da26ea9a06eb1e5a83e34c7320875789df0020b8c5e

Download Submit
C:\Windows\SoftwareDistribution\ScanFile\wininit.exe

Filesize
4.9MB

MD5
d8d7c64dcdd9a4cd64ba109c53e2ad60

SHA1
f09ef22d84d9d1dfafbb921e0c96d561a980988d

SHA256
24eff6797c0f6a3cc5399d94e03039212e18c33cd698e19ad312a3a7171e1945

SHA512
16840d35e62c73b271f29a89b90b4c2df6d976d39cdcc9f06b6f0f796168eddc8359642ee28ef64ff8513d9e13cefeb2c1c847927d3ba7bdbbc350813439041f

Download Submit
memory/676-193-0x0000000001170000-0x0000000001664000-memory.dmp

Filesize
5.0MB

Download
memory/1156-236-0x00000000003F0000-0x00000000008E4000-memory.dmp

Filesize
5.0MB

Download
memory/1156-237-0x0000000000C20000-0x0000000000C32000-memory.dmp

Filesize
72KB

Download
memory/2196-107-0x0000000000520000-0x0000000000532000-memory.dmp

Filesize
72KB

Download
memory/2196-106-0x00000000012A0000-0x0000000001794000-memory.dmp

Filesize
5.0MB

Download
memory/2200-10-0x0000000000DB0000-0x0000000000DC2000-memory.dmp

Filesize
72KB

Download
memory/2200-0-0x000007FEF6113000-0x000007FEF6114000-memory.dmp

Filesize
4KB

Download
memory/2200-1-0x0000000001290000-0x0000000001784000-memory.dmp

Filesize
5.0MB

Download
memory/2200-105-0x000007FEF6110000-0x000007FEF6AFC000-memory.dmp

Filesize
9.9MB

Download
memory/2200-16-0x000000001ACC0000-0x000000001ACCC000-memory.dmp

Filesize
48KB

Download
memory/2200-15-0x0000000001280000-0x0000000001288000-memory.dmp

Filesize
32KB

Download
memory/2200-14-0x0000000000DF0000-0x0000000000DF8000-memory.dmp

Filesize
32KB

Download
memory/2200-13-0x0000000000DE0000-0x0000000000DEE000-memory.dmp

Filesize
56KB

Download
memory/2200-12-0x0000000000DD0000-0x0000000000DDE000-memory.dmp

Filesize
56KB

Download
memory/2200-2-0x000007FEF6110000-0x000007FEF6AFC000-memory.dmp

Filesize
9.9MB

Download
memory/2200-11-0x0000000000DC0000-0x0000000000DCA000-memory.dmp

Filesize
40KB

Download
memory/2200-3-0x000000001AB90000-0x000000001ACBE000-memory.dmp

Filesize
1.2MB

Download
memory/2200-9-0x0000000000AB0000-0x0000000000ABA000-memory.dmp

Filesize
40KB

Download
memory/2200-4-0x00000000005A0000-0x00000000005BC000-memory.dmp

Filesize
112KB

Download
memory/2200-8-0x0000000000600000-0x0000000000610000-memory.dmp

Filesize
64KB

Download
memory/2200-7-0x00000000005E0000-0x00000000005F6000-memory.dmp

Filesize
88KB

Download
memory/2200-6-0x00000000005D0000-0x00000000005E0000-memory.dmp

Filesize
64KB

Download
memory/2200-5-0x00000000005C0000-0x00000000005C8000-memory.dmp

Filesize
32KB

Download
memory/2332-178-0x0000000000080000-0x0000000000574000-memory.dmp

Filesize
5.0MB

Download
memory/2456-135-0x00000000005A0000-0x00000000005B2000-memory.dmp

Filesize
72KB

Download
memory/2652-58-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/2652-52-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download