dcrat | 412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36f

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Size

4.9MB
MD5

6d28b82da857e5f86596ed8e27efb260
SHA1

05fb88ba2cf61b8d55fea21d273fa2f2cb6afa9a
SHA256

412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36f
SHA512

2cb1a0bef640341cf2cbda78430b18fd8218fd4f19a0801afb2a64223551902753a99892625be76a6d4aed34bb192408921206663d64b916e0298d5fa5572fdf
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2244	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2244	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2244	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2244	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2244	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2244	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2244	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2244	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	2244	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2244	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2244	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2244	schtasks.exe	30

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

dllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/2284-3-0x000000001B9E0000-0x000000001BB0E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
3004	powershell.exe
1100	powershell.exe
2032	powershell.exe
1664	powershell.exe
1528	powershell.exe
3000	powershell.exe
1068	powershell.exe
2544	powershell.exe
2984	powershell.exe
1424	powershell.exe
1916	powershell.exe
2040	powershell.exe

Executes dropped EXE 11 IoCs

Processes:

dllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exe

pid	Process
2392	dllhost.exe
2928	dllhost.exe
2912	dllhost.exe
1164	dllhost.exe
2708	dllhost.exe
804	dllhost.exe
1480	dllhost.exe
2432	dllhost.exe
2204	dllhost.exe
2740	dllhost.exe
2516	dllhost.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

dllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe

Drops file in Program Files directory 4 IoCs

Processes:

412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\Idle.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6ccacd8608530f	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\RCXD98E.tmp	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\Idle.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe

Drops file in Windows directory 4 IoCs

Processes:

412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe

description	ioc	Process
File opened for modification	C:\Windows\TAPI\dllhost.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Windows\TAPI\dllhost.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Windows\TAPI\5940a34987c991	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Windows\TAPI\RCXE037.tmp	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
2820	schtasks.exe
2964	schtasks.exe
2636	schtasks.exe
2672	schtasks.exe
2396	schtasks.exe
2512	schtasks.exe
2204	schtasks.exe
2896	schtasks.exe
2892	schtasks.exe
2916	schtasks.exe
2832	schtasks.exe
2184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exe

pid	Process
2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
1424	powershell.exe
1528	powershell.exe
2544	powershell.exe
1100	powershell.exe
2984	powershell.exe
2032	powershell.exe
1068	powershell.exe
2040	powershell.exe
3004	powershell.exe
1664	powershell.exe
1916	powershell.exe
3000	powershell.exe
2392	dllhost.exe
2928	dllhost.exe
2912	dllhost.exe
1164	dllhost.exe
2708	dllhost.exe
804	dllhost.exe
1480	dllhost.exe
2432	dllhost.exe
2204	dllhost.exe
2740	dllhost.exe
2516	dllhost.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

description	pid	Process
Token: SeDebugPrivilege	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	1528	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	2392	dllhost.exe
Token: SeDebugPrivilege	2928	dllhost.exe
Token: SeDebugPrivilege	2912	dllhost.exe
Token: SeDebugPrivilege	1164	dllhost.exe
Token: SeDebugPrivilege	2708	dllhost.exe
Token: SeDebugPrivilege	804	dllhost.exe
Token: SeDebugPrivilege	1480	dllhost.exe
Token: SeDebugPrivilege	2432	dllhost.exe
Token: SeDebugPrivilege	2204	dllhost.exe
Token: SeDebugPrivilege	2740	dllhost.exe
Token: SeDebugPrivilege	2516	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exedllhost.exeWScript.exedllhost.exeWScript.exedllhost.exeWScript.exe

description	pid	Process	procid_target
PID 2284 wrote to memory of 3004	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	44
PID 2284 wrote to memory of 3004	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	44
PID 2284 wrote to memory of 3004	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	44
PID 2284 wrote to memory of 2984	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	45
PID 2284 wrote to memory of 2984	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	45
PID 2284 wrote to memory of 2984	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	45
PID 2284 wrote to memory of 1424	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	46
PID 2284 wrote to memory of 1424	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	46
PID 2284 wrote to memory of 1424	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	46
PID 2284 wrote to memory of 1100	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	47
PID 2284 wrote to memory of 1100	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	47
PID 2284 wrote to memory of 1100	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	47
PID 2284 wrote to memory of 1916	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	48
PID 2284 wrote to memory of 1916	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	48
PID 2284 wrote to memory of 1916	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	48
PID 2284 wrote to memory of 2032	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	49
PID 2284 wrote to memory of 2032	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	49
PID 2284 wrote to memory of 2032	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	49
PID 2284 wrote to memory of 1664	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	50
PID 2284 wrote to memory of 1664	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	50
PID 2284 wrote to memory of 1664	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	50
PID 2284 wrote to memory of 1528	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	51
PID 2284 wrote to memory of 1528	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	51
PID 2284 wrote to memory of 1528	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	51
PID 2284 wrote to memory of 3000	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	52
PID 2284 wrote to memory of 3000	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	52
PID 2284 wrote to memory of 3000	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	52
PID 2284 wrote to memory of 2040	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	53
PID 2284 wrote to memory of 2040	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	53
PID 2284 wrote to memory of 2040	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	53
PID 2284 wrote to memory of 1068	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	54
PID 2284 wrote to memory of 1068	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	54
PID 2284 wrote to memory of 1068	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	54
PID 2284 wrote to memory of 2544	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	55
PID 2284 wrote to memory of 2544	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	55
PID 2284 wrote to memory of 2544	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	55
PID 2284 wrote to memory of 2392	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	68
PID 2284 wrote to memory of 2392	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	68
PID 2284 wrote to memory of 2392	2284	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	68
PID 2392 wrote to memory of 2808	2392	dllhost.exe	69
PID 2392 wrote to memory of 2808	2392	dllhost.exe	69
PID 2392 wrote to memory of 2808	2392	dllhost.exe	69
PID 2392 wrote to memory of 1900	2392	dllhost.exe	70
PID 2392 wrote to memory of 1900	2392	dllhost.exe	70
PID 2392 wrote to memory of 1900	2392	dllhost.exe	70
PID 2808 wrote to memory of 2928	2808	WScript.exe	71
PID 2808 wrote to memory of 2928	2808	WScript.exe	71
PID 2808 wrote to memory of 2928	2808	WScript.exe	71
PID 2928 wrote to memory of 904	2928	dllhost.exe	72
PID 2928 wrote to memory of 904	2928	dllhost.exe	72
PID 2928 wrote to memory of 904	2928	dllhost.exe	72
PID 2928 wrote to memory of 2360	2928	dllhost.exe	73
PID 2928 wrote to memory of 2360	2928	dllhost.exe	73
PID 2928 wrote to memory of 2360	2928	dllhost.exe	73
PID 904 wrote to memory of 2912	904	WScript.exe	74
PID 904 wrote to memory of 2912	904	WScript.exe	74
PID 904 wrote to memory of 2912	904	WScript.exe	74
PID 2912 wrote to memory of 1376	2912	dllhost.exe	75
PID 2912 wrote to memory of 1376	2912	dllhost.exe	75
PID 2912 wrote to memory of 1376	2912	dllhost.exe	75
PID 2912 wrote to memory of 860	2912	dllhost.exe	76
PID 2912 wrote to memory of 860	2912	dllhost.exe	76
PID 2912 wrote to memory of 860	2912	dllhost.exe	76
PID 1376 wrote to memory of 1164	1376	WScript.exe	77

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

Processes:

dllhost.exedllhost.exedllhost.exedllhost.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
"C:\Users\Admin\AppData\Local\Temp\412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Windows\TAPI\dllhost.exe
  "C:\Windows\TAPI\dllhost.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2392
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8fe721bd-053d-4d7a-9388-44bcdadc5e9c.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\TAPI\dllhost.exe
      C:\Windows\TAPI\dllhost.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2928
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ccec6719-5ff0-43af-82f6-9922c17c8f87.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:904
      - C:\Windows\TAPI\dllhost.exe
        
        C:\Windows\TAPI\dllhost.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2912
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e3ffbeb-d408-4903-bc88-0fd0bd5a827f.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1376
        
        C:\Windows\TAPI\dllhost.exe
        
        C:\Windows\TAPI\dllhost.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1164
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c3f6463e-acb9-4dc1-af2c-4a75f7f65242.vbs"
        9⤵
        
        PID:3048
        
        C:\Windows\TAPI\dllhost.exe
        
        C:\Windows\TAPI\dllhost.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2708
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64aa95f9-2f1a-4852-86f6-49b72daf1a30.vbs"
        11⤵
        
        PID:1476
        
        C:\Windows\TAPI\dllhost.exe
        
        C:\Windows\TAPI\dllhost.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:804
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ebf1d5c-42a1-423e-a269-2e779538e38b.vbs"
        13⤵
        
        PID:3044
        
        C:\Windows\TAPI\dllhost.exe
        
        C:\Windows\TAPI\dllhost.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1480
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bf693db0-cca3-48a2-a155-7d3e7b2129fb.vbs"
        15⤵
        
        PID:1004
        
        C:\Windows\TAPI\dllhost.exe
        
        C:\Windows\TAPI\dllhost.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c968ee8-9dd5-42d1-81f8-bd5f33011e85.vbs"
        17⤵
        
        PID:2404
        
        C:\Windows\TAPI\dllhost.exe
        
        C:\Windows\TAPI\dllhost.exe
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2204
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1bc43297-a4f1-412d-9ddc-b7996f0a01af.vbs"
        19⤵
        
        PID:2896
        
        C:\Windows\TAPI\dllhost.exe
        
        C:\Windows\TAPI\dllhost.exe
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2740
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1280c17-ba59-44a7-94fa-9255a2cf2505.vbs"
        21⤵
        
        PID:336
        
        C:\Windows\TAPI\dllhost.exe
        
        C:\Windows\TAPI\dllhost.exe
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2516
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3371ca00-a359-40c9-b283-11e5ba33e822.vbs"
        23⤵
        
        PID:2524
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b1d0dcd2-d265-4c9f-b910-0af355339076.vbs"
        23⤵
        
        PID:1716
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c95b15b-1e63-426b-8bb7-3ea6821393f4.vbs"
        21⤵
        
        PID:928
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e41794ba-3601-4b22-ad02-c7102b2fd673.vbs"
        19⤵
        
        PID:2924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5620469d-8e95-4c96-a0ad-7d5310bc1242.vbs"
        17⤵
        
        PID:2980
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0ac80e61-c093-477a-8b1f-78865e981d7c.vbs"
        15⤵
        
        PID:1820
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00451fbf-6fdd-44fd-a61a-37deebad2b68.vbs"
        13⤵
        
        PID:692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\921bdb95-29c2-4db5-8f28-73e0cf3f60ac.vbs"
        11⤵
        
        PID:576
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cf78a21a-6280-4aa0-9b34-a31634df0f1e.vbs"
        9⤵
        
        PID:1488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b32024ba-86d0-4b8d-947d-7c5f278a9048.vbs"
        7⤵
        
        PID:860
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04e518ec-0373-4820-923a-dcd3dfa069bd.vbs"
        5⤵
        
        PID:2360
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df6aaecc-af6b-45fd-8b91-e124a37510ec.vbs"
    3⤵
    PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\TAPI\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\TAPI\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\TAPI\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\Idle.exe

Filesize
4.9MB

MD5
6d28b82da857e5f86596ed8e27efb260

SHA1
05fb88ba2cf61b8d55fea21d273fa2f2cb6afa9a

SHA256
412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36f

SHA512
2cb1a0bef640341cf2cbda78430b18fd8218fd4f19a0801afb2a64223551902753a99892625be76a6d4aed34bb192408921206663d64b916e0298d5fa5572fdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\1bc43297-a4f1-412d-9ddc-b7996f0a01af.vbs

Filesize
703B

MD5
214cc568fe39dd4efccd6ce9af174200

SHA1
3c66e1ede304cb748460154b2c363770aafeff1d

SHA256
8f7ad69778aaef79591ee05db88155f1af21fa1da69b642b21eb5e2ff15b2dad

SHA512
a8df78bc4e31a88c6ef6786dd8ceec606c8d4e5f6a069d64aba83314d123939aef9a9570429d7a6b21bd27ff3b1546196f63afdb0f070ddeec8d38f03416d457

Download Submit
C:\Users\Admin\AppData\Local\Temp\3371ca00-a359-40c9-b283-11e5ba33e822.vbs

Filesize
703B

MD5
f6f4868c4bef1694a0db25c162a248af

SHA1
1e2ade229f460bcf9115ee69133e22ea8649cb19

SHA256
775d97a3e45280676584aec6134bce92cd12601a3f057e84fe1c3cdd47e875fd

SHA512
005fcaa1adc4a7178fd5fe8a14c287b0cab2c267553defa35e2974f0b72215a2341c96b8d4afa7ef0ae51c9c1fdf902841c8b988d302d9337b9557dda9de0495

Download Submit
C:\Users\Admin\AppData\Local\Temp\4ebf1d5c-42a1-423e-a269-2e779538e38b.vbs

Filesize
702B

MD5
4f73724583515ed887424f450a8aba2f

SHA1
c361ab80d5fcb9bc7c438c8a3a30dc4bbd469f46

SHA256
829a43e4b6d369ad4764ea40f7f81fa99c472c62f535c31eb28773b9a345b7c8

SHA512
b940adf1dde018132d52ddc5519e1b850bbc49249712c6586055743048e73e92635296887cbe8d5715bc2969cf0084e5b7e5be41b20f8f77b4bc4d22ffe75cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\64aa95f9-2f1a-4852-86f6-49b72daf1a30.vbs

Filesize
703B

MD5
a6a8e1f838b27f71dae3a8dc5dd99963

SHA1
38cda0f65d3f194ed5d89c24e59032650523caa7

SHA256
0ce772860aa0268d832417790519272360acf980b82b0a7155a3f53c3d44267f

SHA512
e4dc37be98e3fa3965c8898e65569b894f468ace9a1fcf7cea764fbeb6311566ef7356f9867b67e776c145f24522e0b89ab05f76757218af9056a7fad6e2fc22

Download Submit
C:\Users\Admin\AppData\Local\Temp\6e3ffbeb-d408-4903-bc88-0fd0bd5a827f.vbs

Filesize
703B

MD5
84ae5efa7e9f2ea989d63bce1c312925

SHA1
10ac4b25de8ae4a69e4ce2f91cf9a36fc973ab5b

SHA256
f25b9837b4d3ecc009e6be90d50d754cbb541f9c3ed5c150468513a2c9b6957a

SHA512
d7559b2e6ae8189737b6d05b3bc1cb4837818b1d995d5c1d1340fd6d3847ecabfa0c83a3c522e9010b56f3e7175326ee435401744e507a3f379f14f1d975050d

Download Submit
C:\Users\Admin\AppData\Local\Temp\8c968ee8-9dd5-42d1-81f8-bd5f33011e85.vbs

Filesize
703B

MD5
b1159a39b519721f26bb1009146f4b4b

SHA1
8d630d7750451e2404dfd9704cdccd522050085a

SHA256
aeed18f3ed1e5252e5820ab1c92f06fc1086946fd0bc4d5e2932bdfe701c4377

SHA512
b80690392dd0a1abf26dad333ae55e96ebbf86d357870dc5f918a869280941f25f8ebc4008d44689f83ffc1b62a9afa3075764bf03471106c6f0f8ac0fd9830e

Download Submit
C:\Users\Admin\AppData\Local\Temp\8fe721bd-053d-4d7a-9388-44bcdadc5e9c.vbs

Filesize
703B

MD5
ba4faf9a9e53681dad84b8030b92c7bc

SHA1
8447f054f5b4279043ae161018ed65c8b15cd1da

SHA256
1e4cc9c79dad24c5624c9a055472b9941ae00edd4b6d06a2988a8593096253c6

SHA512
fe0d950ea97e5221b359d6bd3efb78b80dc4fff4eb9179d78b89747a9fe88b5f9d3088b9bf9e1f6dd4770b50cc55fd7bca7c0dd192e82afdb19ef6c266d9ec96

Download Submit
C:\Users\Admin\AppData\Local\Temp\bf693db0-cca3-48a2-a155-7d3e7b2129fb.vbs

Filesize
703B

MD5
681988c008e6a8aa4a057b7e5b29d319

SHA1
a8393985969de2932c7561d54bf4297caf7da95b

SHA256
f7d434582178513f3086433a8daf92eafa60dda16173e15680f7755c28459f07

SHA512
0de2a658fdf7150b1c8ac08d631f272d7dbf187250a77ba26ef32f040690323a7c36a38884c5c7937a0bb5e69d69acac36a01d55658319b23dd70355201ee25b

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3f6463e-acb9-4dc1-af2c-4a75f7f65242.vbs

Filesize
703B

MD5
b0a49e3b574ae52dafbacdf51668468e

SHA1
367eb4e24334c9a7be162edd03d5d4a4ba7c173c

SHA256
340ef318291d21940268c0889c496dc390b1ca81ab0889bfcb25c520e840b021

SHA512
35115af00cbd12c1f652d87722c895f72dd361778aa67bccbcd2755fbe3ed0625f60ef175f2f8b1e2bf81724cedf44da095e7e0556d25d7f5511037af82da37a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ccec6719-5ff0-43af-82f6-9922c17c8f87.vbs

Filesize
703B

MD5
1114df5b049dd4e78940de7263b2f6b0

SHA1
d858b2b5530a5c6397c939200a760be21f8e721c

SHA256
5cdd9f5637e4a5e1b5f0e466ca410b95ea48fcdaf558608c715e3e0e81a09295

SHA512
d7fb5de5a48654892339044faba662a59a2035f04ad2c1ea27ef72bbe21f5357779acff8bb27e42ed81fc702c18dd7d919cc895e05eb3a1ab7bfb283207c3bbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\df6aaecc-af6b-45fd-8b91-e124a37510ec.vbs

Filesize
479B

MD5
09a12f262b857066909cc2ff1f07fd9e

SHA1
238f2dec2cbf4137f96722026d183c48942014db

SHA256
d0bd3578e7b412cfcbaeb27ebab3dad1a631de0929dc5b3eba66d1d96e7c3654

SHA512
a51c62c96e8f91e14e7a6660c4f359455684263a00255b43ef35afdbbd6ab4f313397887472ec0afdb6c5c6551aaad6218332338eacb5107b3555c4996866e48

Download Submit
C:\Users\Admin\AppData\Local\Temp\f1280c17-ba59-44a7-94fa-9255a2cf2505.vbs

Filesize
703B

MD5
cc6a9e97ab2b44ade8cd7c88c1d1b92b

SHA1
a5304d0a29f4e1d97b8dd41bca2c497094639896

SHA256
f8bbf6a3969f3e4df86cd0a01b892e9f1a695683f1bd18fc86b10f26e16de76f

SHA512
7a8b32a58140527383d7d5ee50e08a70f91121614ea22a91c7f28ee2474571773b2e8941b330b8f4f207f09e736094fd858f2083d150aebbee9fc04bb5703e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF2E7.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b862cd7321773f03a76cfe92818504d8

SHA1
a6377bfd3ea2835d1bb1bbb84a58c6f783f52eab

SHA256
4d50a90d702071e339b874f1556bd0914b2ad7d11472324c9b2dd5a0459b9e85

SHA512
f488548f2782954455f511f15b45d7d809c7558554da06b5c9f51f376f651b75da61b734b74982fa8ccce3cdb29805361eaaedee8bc8fd54a2caab9195bd1d6e

Download Submit
C:\Windows\TAPI\dllhost.exe

Filesize
4.9MB

MD5
463ec47a880a52327fa42e534f9e2481

SHA1
c0da12a73e0d63c270e2dde3b5b71c33dde2973d

SHA256
695e8eaab65760c240d19c12491156a7bcd4b6328023e41acbaa68f9add86f4c

SHA512
902a53bcb6d0624b1bc4002deb80f78d2d5c46459d4473495bd0e6bf1646f2050ef90cd9da58dcb982677ab622e05935fc5922e3f436b25eee4653f250049d2b

Download Submit
memory/804-190-0x0000000000FD0000-0x00000000014C4000-memory.dmp

Filesize
5.0MB

Download
memory/1164-160-0x0000000000240000-0x0000000000734000-memory.dmp

Filesize
5.0MB

Download
memory/1424-65-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/1424-83-0x0000000002300000-0x0000000002308000-memory.dmp

Filesize
32KB

Download
memory/1480-205-0x0000000001050000-0x0000000001544000-memory.dmp

Filesize
5.0MB

Download
memory/1480-206-0x0000000000C60000-0x0000000000C72000-memory.dmp

Filesize
72KB

Download
memory/2204-235-0x0000000001350000-0x0000000001844000-memory.dmp

Filesize
5.0MB

Download
memory/2284-11-0x0000000000D20000-0x0000000000D2A000-memory.dmp

Filesize
40KB

Download
memory/2284-10-0x0000000000D10000-0x0000000000D22000-memory.dmp

Filesize
72KB

Download
memory/2284-1-0x00000000011A0000-0x0000000001694000-memory.dmp

Filesize
5.0MB

Download
memory/2284-15-0x0000000000E60000-0x0000000000E68000-memory.dmp

Filesize
32KB

Download
memory/2284-2-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download
memory/2284-16-0x0000000000E70000-0x0000000000E7C000-memory.dmp

Filesize
48KB

Download
memory/2284-14-0x0000000000E50000-0x0000000000E58000-memory.dmp

Filesize
32KB

Download
memory/2284-13-0x0000000000E40000-0x0000000000E4E000-memory.dmp

Filesize
56KB

Download
memory/2284-12-0x0000000000E30000-0x0000000000E3E000-memory.dmp

Filesize
56KB

Download
memory/2284-3-0x000000001B9E0000-0x000000001BB0E000-memory.dmp

Filesize
1.2MB

Download
memory/2284-0-0x000007FEF57F3000-0x000007FEF57F4000-memory.dmp

Filesize
4KB

Download
memory/2284-117-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download
memory/2284-9-0x0000000000D00000-0x0000000000D0A000-memory.dmp

Filesize
40KB

Download
memory/2284-8-0x0000000000CF0000-0x0000000000D00000-memory.dmp

Filesize
64KB

Download
memory/2284-7-0x0000000000CD0000-0x0000000000CE6000-memory.dmp

Filesize
88KB

Download
memory/2284-6-0x0000000000C00000-0x0000000000C10000-memory.dmp

Filesize
64KB

Download
memory/2284-5-0x0000000000BF0000-0x0000000000BF8000-memory.dmp

Filesize
32KB

Download
memory/2284-4-0x0000000000420000-0x000000000043C000-memory.dmp

Filesize
112KB

Download
memory/2392-116-0x0000000001300000-0x00000000017F4000-memory.dmp

Filesize
5.0MB

Download
memory/2708-175-0x00000000009B0000-0x0000000000EA4000-memory.dmp

Filesize
5.0MB

Download
memory/2928-131-0x0000000000620000-0x0000000000632000-memory.dmp

Filesize
72KB

Download