dcrat | 8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
Size

4.9MB
MD5

88f7bc75464f6ac36d3f2f02b02bce70
SHA1

6c7f6a07e89aaa94f683021571ba198f18518410
SHA256

8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005
SHA512

fe4a35f4c6f916483248bf28860402866647f4f080b7bf29ad2057ef06c7a3944cd31408cc8dfb43b2ef0bb95ad70df0d674bb31795e8260bb0017ebdb81063c
SSDEEP

49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	576	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	344	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2684	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2684	schtasks.exe	31

UAC bypass 3 TTPs 30 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1920-3-0x000000001B3E0000-0x000000001B50E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2244	powershell.exe
1984	powershell.exe
1240	powershell.exe
1852	powershell.exe
800	powershell.exe
1376	powershell.exe
684	powershell.exe
2016	powershell.exe
1348	powershell.exe
600	powershell.exe
1040	powershell.exe
1744	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
1892	winlogon.exe
1300	winlogon.exe
1716	winlogon.exe
1648	winlogon.exe
2936	winlogon.exe
884	winlogon.exe
896	winlogon.exe
2236	winlogon.exe
2848	winlogon.exe

Checks whether UAC is enabled 1 TTPs 20 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Drops file in Program Files directory 36 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\images\cc11b995f2a76d	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Program Files (x86)\Common Files\56085415360792	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files\Windows Sidebar\RCXF0B0.tmp	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files (x86)\Common Files\RCX40A.tmp	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Program Files\Windows Defender\fr-FR\886983d96e3d3e	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXEEAC.tmp	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\System.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files (x86)\Common Files\wininit.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\56085415360792	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Program Files\Windows Defender\fr-FR\csrss.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\lsass.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Program Files (x86)\Windows Mail\es-ES\b75386f1303e64	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\es-ES\taskhost.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\RCXFF57.tmp	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\csrss.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Program Files\Windows Sidebar\Idle.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\886983d96e3d3e	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files\Internet Explorer\images\winlogon.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\RCXFAC3.tmp	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\RCX1E7.tmp	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\es-ES\RCXEAA4.tmp	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files\Windows Sidebar\Idle.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Program Files (x86)\Windows Mail\es-ES\taskhost.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\27d1bcfc3c54e0	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\RCXE14C.tmp	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\System.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Program Files (x86)\Common Files\wininit.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files\Internet Explorer\images\RCXE833.tmp	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Program Files\Internet Explorer\images\winlogon.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Program Files (x86)\Windows Mail\lsass.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Program Files (x86)\Windows Mail\6203df4a6bafc7	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Program Files\Windows Sidebar\6ccacd8608530f	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\services.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Windows\Fonts\lsm.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Windows\Fonts\lsm.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Windows\Fonts\101b941d020240	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Windows\Fonts\services.exe	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File created	C:\Windows\Fonts\c5b4cb5e9653cc	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Windows\Fonts\RCXDF49.tmp	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
File opened for modification	C:\Windows\Fonts\RCXF4B7.tmp	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
344	schtasks.exe
876	schtasks.exe
2260	schtasks.exe
2436	schtasks.exe
2812	schtasks.exe
772	schtasks.exe
2192	schtasks.exe
624	schtasks.exe
1796	schtasks.exe
1348	schtasks.exe
740	schtasks.exe
3060	schtasks.exe
1064	schtasks.exe
2820	schtasks.exe
2424	schtasks.exe
2268	schtasks.exe
1912	schtasks.exe
2088	schtasks.exe
1724	schtasks.exe
2928	schtasks.exe
2400	schtasks.exe
2068	schtasks.exe
2916	schtasks.exe
1276	schtasks.exe
2980	schtasks.exe
2744	schtasks.exe
2076	schtasks.exe
2960	schtasks.exe
2868	schtasks.exe
2036	schtasks.exe
1096	schtasks.exe
2136	schtasks.exe
576	schtasks.exe
2788	schtasks.exe
2596	schtasks.exe
1872	schtasks.exe
2032	schtasks.exe
2096	schtasks.exe
2624	schtasks.exe
2644	schtasks.exe
1440	schtasks.exe
1236	schtasks.exe
2936	schtasks.exe
1692	schtasks.exe
2808	schtasks.exe
2732	schtasks.exe
2468	schtasks.exe
2792	schtasks.exe
1876	schtasks.exe
1036	schtasks.exe
1624	schtasks.exe
2160	schtasks.exe
2028	schtasks.exe
2552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
600	powershell.exe
1240	powershell.exe
1376	powershell.exe
1852	powershell.exe
2016	powershell.exe
684	powershell.exe
1040	powershell.exe
2244	powershell.exe
1984	powershell.exe
1744	powershell.exe
800	powershell.exe
1348	powershell.exe
1892	winlogon.exe
1300	winlogon.exe
1716	winlogon.exe
1648	winlogon.exe
2936	winlogon.exe
884	winlogon.exe
896	winlogon.exe
2236	winlogon.exe
2848	winlogon.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
Token: SeDebugPrivilege	600	powershell.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	684	powershell.exe
Token: SeDebugPrivilege	1040	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	800	powershell.exe
Token: SeDebugPrivilege	1348	powershell.exe
Token: SeDebugPrivilege	1892	winlogon.exe
Token: SeDebugPrivilege	1300	winlogon.exe
Token: SeDebugPrivilege	1716	winlogon.exe
Token: SeDebugPrivilege	1648	winlogon.exe
Token: SeDebugPrivilege	2936	winlogon.exe
Token: SeDebugPrivilege	884	winlogon.exe
Token: SeDebugPrivilege	896	winlogon.exe
Token: SeDebugPrivilege	2236	winlogon.exe
Token: SeDebugPrivilege	2848	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 800	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	86
PID 1920 wrote to memory of 800	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	86
PID 1920 wrote to memory of 800	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	86
PID 1920 wrote to memory of 1376	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	87
PID 1920 wrote to memory of 1376	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	87
PID 1920 wrote to memory of 1376	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	87
PID 1920 wrote to memory of 1040	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	89
PID 1920 wrote to memory of 1040	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	89
PID 1920 wrote to memory of 1040	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	89
PID 1920 wrote to memory of 600	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	90
PID 1920 wrote to memory of 600	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	90
PID 1920 wrote to memory of 600	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	90
PID 1920 wrote to memory of 1348	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	92
PID 1920 wrote to memory of 1348	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	92
PID 1920 wrote to memory of 1348	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	92
PID 1920 wrote to memory of 684	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	93
PID 1920 wrote to memory of 684	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	93
PID 1920 wrote to memory of 684	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	93
PID 1920 wrote to memory of 1852	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	95
PID 1920 wrote to memory of 1852	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	95
PID 1920 wrote to memory of 1852	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	95
PID 1920 wrote to memory of 1240	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	96
PID 1920 wrote to memory of 1240	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	96
PID 1920 wrote to memory of 1240	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	96
PID 1920 wrote to memory of 1984	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	97
PID 1920 wrote to memory of 1984	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	97
PID 1920 wrote to memory of 1984	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	97
PID 1920 wrote to memory of 2244	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	98
PID 1920 wrote to memory of 2244	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	98
PID 1920 wrote to memory of 2244	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	98
PID 1920 wrote to memory of 1744	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	99
PID 1920 wrote to memory of 1744	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	99
PID 1920 wrote to memory of 1744	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	99
PID 1920 wrote to memory of 2016	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	100
PID 1920 wrote to memory of 2016	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	100
PID 1920 wrote to memory of 2016	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	100
PID 1920 wrote to memory of 3024	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	110
PID 1920 wrote to memory of 3024	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	110
PID 1920 wrote to memory of 3024	1920	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe	110
PID 3024 wrote to memory of 2984	3024	cmd.exe	112
PID 3024 wrote to memory of 2984	3024	cmd.exe	112
PID 3024 wrote to memory of 2984	3024	cmd.exe	112
PID 3024 wrote to memory of 1892	3024	cmd.exe	113
PID 3024 wrote to memory of 1892	3024	cmd.exe	113
PID 3024 wrote to memory of 1892	3024	cmd.exe	113
PID 1892 wrote to memory of 1116	1892	winlogon.exe	114
PID 1892 wrote to memory of 1116	1892	winlogon.exe	114
PID 1892 wrote to memory of 1116	1892	winlogon.exe	114
PID 1892 wrote to memory of 1516	1892	winlogon.exe	115
PID 1892 wrote to memory of 1516	1892	winlogon.exe	115
PID 1892 wrote to memory of 1516	1892	winlogon.exe	115
PID 1116 wrote to memory of 1300	1116	WScript.exe	116
PID 1116 wrote to memory of 1300	1116	WScript.exe	116
PID 1116 wrote to memory of 1300	1116	WScript.exe	116
PID 1300 wrote to memory of 1520	1300	winlogon.exe	117
PID 1300 wrote to memory of 1520	1300	winlogon.exe	117
PID 1300 wrote to memory of 1520	1300	winlogon.exe	117
PID 1300 wrote to memory of 2552	1300	winlogon.exe	118
PID 1300 wrote to memory of 2552	1300	winlogon.exe	118
PID 1300 wrote to memory of 2552	1300	winlogon.exe	118
PID 1520 wrote to memory of 1716	1520	WScript.exe	119
PID 1520 wrote to memory of 1716	1520	WScript.exe	119
PID 1520 wrote to memory of 1716	1520	WScript.exe	119
PID 1716 wrote to memory of 2868	1716	winlogon.exe	120

System policy modification 1 TTPs 30 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe
"C:\Users\Admin\AppData\Local\Temp\8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005N.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lRBQoi3P75.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2984
- - C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe
    "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1892
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d554410-dc5c-49df-acc2-d9026c6dd0cb.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1116
    - - C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1300
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\29fba611-e900-4bb0-ba78-407df433cd68.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1716
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9c7c8978-7a83-47dc-87b9-e0f9f36dcb62.vbs"
        8⤵
        
        PID:2868
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe"
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1648
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e69c3dc2-4ec0-4c57-acad-4485f7ffb917.vbs"
        10⤵
        
        PID:2880
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe"
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2936
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d894dd5d-b1d9-425f-8e6c-26ee91aa4b52.vbs"
        12⤵
        
        PID:1508
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe"
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52feefe2-3649-481e-85f5-3f42f5f1f2f1.vbs"
        14⤵
        
        PID:2768
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe"
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:896
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4028070d-49ff-4feb-9f62-2df579614eee.vbs"
        16⤵
        
        PID:1064
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe"
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2236
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f126d279-5598-488c-b0d8-bd4028fdde1f.vbs"
        18⤵
        
        PID:1928
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe"
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df08c8c4-42c5-4373-8960-5eed314ffa96.vbs"
        20⤵
        
        PID:2116
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\01c6521f-a107-440f-af40-487c1ba00d37.vbs"
        20⤵
        
        PID:2352
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8a84244-dcac-4c28-a222-0f73eee17ba0.vbs"
        18⤵
        
        PID:480
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\710f7172-4f35-485c-8e3f-bcefcee2548c.vbs"
        16⤵
        
        PID:2952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ebf266cb-2c2c-4e82-a44d-c06e38a4feec.vbs"
        14⤵
        
        PID:2060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1b20df2-15be-4dac-8b27-070e5ef2d4f8.vbs"
        12⤵
        
        PID:2252
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\509a8e4e-267a-404e-a92e-b7ff14665cad.vbs"
        10⤵
        
        PID:2764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a243845a-f7fa-46c6-86c8-a003f29c13fb.vbs"
        8⤵
        
        PID:1584
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e97be89-35eb-418f-b66d-d17fdcc66b16.vbs"
        6⤵
        
        PID:2552
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c6dccf1-fc84-49f2-9fd5-5ae4d8916fd0.vbs"
      4⤵
      PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Windows\Fonts\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\Fonts\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Windows\Fonts\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\images\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\images\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\es-ES\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\es-ES\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\es-ES\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Windows\Fonts\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Fonts\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\Fonts\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\Office14\1033\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\Office14\1033\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Defender\fr-FR\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\fr-FR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\fr-FR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\WMIADAP.exe

Filesize
4.9MB

MD5
43ef2b9e06aceb2c879f5df0ded25c11

SHA1
2ef135bc4cf85be1e3fd5b68b47128a56698cf5e

SHA256
0cf689b94f4809d71eadad8174e7a8434e724ea58823dca6ed2268462e4721d6

SHA512
0453624dd71fc16b8f24cc81c74e79573bd1ddcdb61baaed9846856a474141341c8451fad4683caf1b206118c60449b978133eb350b19d5abc0d30ff4d84e4a0

Download Submit
C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe

Filesize
4.9MB

MD5
d126524f8fe334dc27dd8afaee60428a

SHA1
9bd7d823a005db540082f275851c0a7c43619256

SHA256
3b8dfb78eabc292225dfd76059d1488c4033e793840e292d79c4e2a6f7172c32

SHA512
51a7ca649b0aa2edec7aabbba5d2e167d26e25cf4cabc883d88e5a3b644b87491f64d3a71cb5f8303bc78f097879f7f2282ed2f3f44348cd7d6f42dd31848c4a

Download Submit
C:\Program Files\Internet Explorer\images\winlogon.exe

Filesize
4.9MB

MD5
88f7bc75464f6ac36d3f2f02b02bce70

SHA1
6c7f6a07e89aaa94f683021571ba198f18518410

SHA256
8c372da489d2df3e057fc7732f05f3752bea32059805ed27db2f6bd4945e1005

SHA512
fe4a35f4c6f916483248bf28860402866647f4f080b7bf29ad2057ef06c7a3944cd31408cc8dfb43b2ef0bb95ad70df0d674bb31795e8260bb0017ebdb81063c

Download Submit
C:\Program Files\Microsoft Office\Office14\1033\RCXFAC3.tmp

Filesize
4.9MB

MD5
94c945a2aec54aaa4287ba9fc1867887

SHA1
54bf2362332ff9fe061cf32ee73761d5cee5303d

SHA256
253ebc35ef09412024b578397ae83370e04fb34d63458bf5fbc57c348fa12fb9

SHA512
06eb6946841c1b5507c807c1ac6e00d98ff17d463fe9d3327fa21575391d00c3fef88dd07a9ae6505dac843656cf939f70002d3a3b9e44e43044a111b266293a

Download Submit
C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\smss.exe

Filesize
4.9MB

MD5
c51c8bc9b45099b32f1f1362054b68bc

SHA1
2d1b69ee54a8a5231c365c2a8d683c0cae116fb7

SHA256
adcf3cff4acea0e9fbfc5a963ba7b78a75a25f1f86c81f37695cdfe0c7b77594

SHA512
e78b4124a245dfde07b7284adb5ae7e9455dce1158628422fa5cc135674dd6630a850ef87dd190436fec48e46a702ffcee77d14ecb6c518fe5cc45a95f8e841d

Download Submit
C:\Users\Admin\AppData\Local\Temp\29fba611-e900-4bb0-ba78-407df433cd68.vbs

Filesize
751B

MD5
bc1bd4be891b295195135e01559a566c

SHA1
9092961812154e9dff00d2f1f96a099698b15dd0

SHA256
00e384f36b3b472a3b8c9a064fbbf4810ef84104605e88993ae1b3b9eb7f200f

SHA512
64fcca7ff1b0f873226bcda0965d0b04b35907af060cbfdad5428aff118e2fda9d8b6bb47e76524fded2be4ffb470736e3079a273a9a5acfee0b900526e67734

Download Submit
C:\Users\Admin\AppData\Local\Temp\4028070d-49ff-4feb-9f62-2df579614eee.vbs

Filesize
750B

MD5
abea442230daab68db5513b62e33f1bb

SHA1
7e47547e9c5ddf5315be9a3c0f2907720cb5dd8f

SHA256
d9cb6d38570bbcca0ceec9be82f0e34874f9cfd772079531e9f92396a8df8664

SHA512
1c91042728ae1be0afc958d25d7eb6548c862138474f05d52fdbd96d40fae2f6c284d96c92582e0e6d6dc09f712bce2df2f3d6ab8a9085587a4678188bff951e

Download Submit
C:\Users\Admin\AppData\Local\Temp\52feefe2-3649-481e-85f5-3f42f5f1f2f1.vbs

Filesize
750B

MD5
390792804316f7393b298e9c95549a8a

SHA1
a1a74d1ba088ec0afed2aee85ba7fab27e49c9cf

SHA256
862d5719ba9d8eb7222a2b469e76554bd89a20950196b47e0a655c62229ddc8f

SHA512
e2d922c0108fb3e82baa12b02271caecbbe91ac504bc7c086c28e8ad3e0f8fb6a77fe9e2cfd16286d3fdd1ffdf73510eeec323b302b51aa4a8c35e75745f5f75

Download Submit
C:\Users\Admin\AppData\Local\Temp\5c6dccf1-fc84-49f2-9fd5-5ae4d8916fd0.vbs

Filesize
527B

MD5
8207ec08841fb350549e1a972a661b68

SHA1
6f24868f6838108e5e8332cbf20a7d2050f7c564

SHA256
2026a52b7ad63b15f10a106d3482285c5d9b8a3cc5d908fd18305f03268933f1

SHA512
0f92b8adc8e0d146080363cecf3bf8e0a96ab52274c496b2dfc6eb8c95772c41a6f7f914d13ef596c09307d0960260ab2ffeb3fccb5d665571c81f3fa709f6dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\8d554410-dc5c-49df-acc2-d9026c6dd0cb.vbs

Filesize
751B

MD5
a0e9065162fd71b23ac08b362e364f30

SHA1
ced6a93babf2ff79d6486d63e3fd7ea3f09f6feb

SHA256
a1a991f3c0c2d47e3158f99aa4d338efc359159fad8cdad098635dc7095d348d

SHA512
4d609ff0ca2e995ac7cd1cd3927c35410be89221e19bf6588114c7dff3d97a3b57f19c5e703762bbe406886e82bd16788b5ee856c57437b5a1135a5c7bf6a200

Download Submit
C:\Users\Admin\AppData\Local\Temp\9c7c8978-7a83-47dc-87b9-e0f9f36dcb62.vbs

Filesize
751B

MD5
7833e0afc113c3069d27247389cbf349

SHA1
c5803eed69e1802ae1fc6f0e70b2ef7f290117df

SHA256
af38b828169765a01fc1f6c9e7dda1d551f549257fd6da9217542bc34040e4dd

SHA512
3ce1f279a5a9b3359c5552c85f1d2298bbd0c3c61f844f636e90fc7b6c98e8f21bbea2202a001a5cb12f0fbd3f5d75b04ae51a1c782b8f297ad577d30f9610b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\d894dd5d-b1d9-425f-8e6c-26ee91aa4b52.vbs

Filesize
751B

MD5
aacb659d8bec1f64e90d592370145587

SHA1
8b9439e17b3cea4a9532dd2c392520a5ee0b5f01

SHA256
0989578b4f544297690dbbe5b0a73f9449fc17f1f773c4fd36b1e78b830cb7d9

SHA512
62c49abc8ba32754258e7a9f6b5d8cb829b1dcfffd3ea679e65ade42013b2edab5d0681fbf8404528e4e8be22728a7643359a89ca6f00aae0450be0845a23461

Download Submit
C:\Users\Admin\AppData\Local\Temp\df08c8c4-42c5-4373-8960-5eed314ffa96.vbs

Filesize
751B

MD5
57bd456459fbf4cdd796fc6268f98daa

SHA1
5239366437248975cf8cd03cb86fedd90c33432e

SHA256
77c146dba852eb52bd203c1093a2798158ba11e3c8a66423b40b6d57881f1a02

SHA512
0f3fd842dd58b4858140b8a0d5d13ce34adaf3c655f0925917c24161464bc1a22bfd53e7d5b56ceba84c3062170e72140c48a633915cb4a795c2c9a0ea7c8ced

Download Submit
C:\Users\Admin\AppData\Local\Temp\e69c3dc2-4ec0-4c57-acad-4485f7ffb917.vbs

Filesize
751B

MD5
62cfd6f939f40e48de661ff234fe5e2d

SHA1
4e83bcbc36c1d3e92d7c8878c0ddcacd78411ce1

SHA256
337e53182d408a0f771c4bc07e4c76aa0239b81e85dee4d8cb8ccf99f3e955a6

SHA512
14d4124f89e7c74f412ba400b4fa20c01f61148bf607b0201a567e2b9148268c8c207b6be2c14970c2a156863fe1cbd4b4bb5f65553fc1d22a63be955ca2cc90

Download Submit
C:\Users\Admin\AppData\Local\Temp\f126d279-5598-488c-b0d8-bd4028fdde1f.vbs

Filesize
751B

MD5
70be4c0b0e2164bc04282591ea9e3e21

SHA1
6c44a24804b71a018f3e1f22f5298432a3c8712b

SHA256
54b9a3ab884130b090f2c724c50c83abc13fcf3389e5f837c1d84379ff08817e

SHA512
a800420d19a7bedbba8d79a6ff52f356dc23c61624444c7ac8ef4a1bc8e70c2b10b72a0926d848b8aa8fba0e4fee9f6c02bc349cd3c93d0cfc919dc87957f4e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\lRBQoi3P75.bat

Filesize
240B

MD5
c62c340e962a9f2ca812a0c0d1034802

SHA1
ebfbc1b4cf0d01e15fb30614c099ebad1eadb630

SHA256
790d795fee1106f5d411a920961d439d58421e8cbf28a1a86176b8dba1c32735

SHA512
c1f0677ad7ea97a1351ff291059aa7b874242f6852b9f254cb87430ddea27803ef7e27335a9dfb29fa0ff1224d97e766a20e386f944de82eb4ae975f1e90d80a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp29EE.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
c8eb4c9ad915bf0b8ea475e62e93d8d1

SHA1
3c9955d8068076f6dce40212fa0111420d853e04

SHA256
3d4b40a14285849402500f5b5b65cd654469c4c9e2da53bbef33891bb46370e3

SHA512
23c303bb132fc51893ef367af2c0b1993e9c470bc072a7be8b154c2fa2f97d510b51c8d91c5b021274d5d26e71513b7904092fb6cf3fcf3dc4f2471941bd2a61

Download Submit
memory/600-197-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/600-196-0x000000001B780000-0x000000001BA62000-memory.dmp

Filesize
2.9MB

Download
memory/1300-264-0x00000000011B0000-0x00000000016A4000-memory.dmp

Filesize
5.0MB

Download
memory/1716-280-0x0000000000510000-0x0000000000522000-memory.dmp

Filesize
72KB

Download
memory/1716-279-0x00000000012A0000-0x0000000001794000-memory.dmp

Filesize
5.0MB

Download
memory/1892-250-0x0000000000620000-0x0000000000632000-memory.dmp

Filesize
72KB

Download
memory/1892-249-0x0000000001020000-0x0000000001514000-memory.dmp

Filesize
5.0MB

Download
memory/1920-10-0x0000000000CD0000-0x0000000000CE2000-memory.dmp

Filesize
72KB

Download
memory/1920-147-0x000007FEF5EE3000-0x000007FEF5EE4000-memory.dmp

Filesize
4KB

Download
memory/1920-12-0x0000000000DF0000-0x0000000000DFE000-memory.dmp

Filesize
56KB

Download
memory/1920-11-0x0000000000CE0000-0x0000000000CEA000-memory.dmp

Filesize
40KB

Download
memory/1920-13-0x0000000000E00000-0x0000000000E0E000-memory.dmp

Filesize
56KB

Download
memory/1920-161-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download
memory/1920-16-0x0000000000E30000-0x0000000000E3C000-memory.dmp

Filesize
48KB

Download
memory/1920-9-0x0000000000C40000-0x0000000000C4A000-memory.dmp

Filesize
40KB

Download
memory/1920-0-0x000007FEF5EE3000-0x000007FEF5EE4000-memory.dmp

Filesize
4KB

Download
memory/1920-14-0x0000000000E10000-0x0000000000E18000-memory.dmp

Filesize
32KB

Download
memory/1920-8-0x0000000000C30000-0x0000000000C40000-memory.dmp

Filesize
64KB

Download
memory/1920-198-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download
memory/1920-15-0x0000000000E20000-0x0000000000E28000-memory.dmp

Filesize
32KB

Download
memory/1920-7-0x0000000000C10000-0x0000000000C26000-memory.dmp

Filesize
88KB

Download
memory/1920-6-0x0000000000C00000-0x0000000000C10000-memory.dmp

Filesize
64KB

Download
memory/1920-1-0x0000000001370000-0x0000000001864000-memory.dmp

Filesize
5.0MB

Download
memory/1920-5-0x0000000000BF0000-0x0000000000BF8000-memory.dmp

Filesize
32KB

Download
memory/1920-4-0x0000000000520000-0x000000000053C000-memory.dmp

Filesize
112KB

Download
memory/1920-3-0x000000001B3E0000-0x000000001B50E000-memory.dmp

Filesize
1.2MB

Download
memory/1920-2-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download
memory/2848-366-0x00000000001D0000-0x00000000006C4000-memory.dmp

Filesize
5.0MB

Download
memory/2936-309-0x00000000006E0000-0x00000000006F2000-memory.dmp

Filesize
72KB

Download