dcrat | 1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
Size

4.9MB
MD5

24d32f5bdea255704c0e4d3335268460
SHA1

db9240d03c8851ba034cf951a2d15be9076530af
SHA256

1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042b
SHA512

b52ad12cb44891460a30a040b3290e17c18592d1a8167f15c1df4a1ccec654270f0711d915b099359907079d3118c09294bf00b95fdc7f8d6a74778a969c98fc
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	304	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2852	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	2852	schtasks.exe	30

UAC bypass 3 TTPs 27 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/3004-3-0x000000001B630000-0x000000001B75E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1552	powershell.exe
2888	powershell.exe
1168	powershell.exe
2188	powershell.exe
844	powershell.exe
2156	powershell.exe
664	powershell.exe
2008	powershell.exe
2040	powershell.exe
588	powershell.exe
2180	powershell.exe
3012	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
2752	dllhost.exe
3068	dllhost.exe
2952	dllhost.exe
1996	dllhost.exe
3012	dllhost.exe
2420	dllhost.exe
2828	dllhost.exe
1312	dllhost.exe

Checks whether UAC is enabled 1 TTPs 18 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File created	C:\Program Files\Java\6cb0b6c459d5d3	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\c5b4cb5e9653cc	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\RCX5717.tmp	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\dwm.exe	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\RCX61A8.tmp	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File created	C:\Program Files\Java\dwm.exe	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\services.exe	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File opened for modification	C:\Program Files\Java\RCX54A6.tmp	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\WmiPrvSE.exe	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File opened for modification	C:\Program Files\Windows Journal\RCX5B9D.tmp	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File opened for modification	C:\Program Files\Windows Journal\lsm.exe	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File created	C:\Program Files\Windows Journal\lsm.exe	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File created	C:\Program Files\Internet Explorer\en-US\24dbde2999530e	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\dwm.exe	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\6cb0b6c459d5d3	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\RCX5DA0.tmp	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\RCX5FA4.tmp	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File created	C:\Program Files\Internet Explorer\en-US\WmiPrvSE.exe	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File created	C:\Program Files\Windows Journal\101b941d020240	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\5940a34987c991	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\services.exe	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
File opened for modification	C:\Program Files\Java\dwm.exe	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2316	schtasks.exe
1632	schtasks.exe
2712	schtasks.exe
2488	schtasks.exe
1724	schtasks.exe
800	schtasks.exe
2452	schtasks.exe
2948	schtasks.exe
2500	schtasks.exe
2476	schtasks.exe
2620	schtasks.exe
1424	schtasks.exe
2568	schtasks.exe
2556	schtasks.exe
1856	schtasks.exe
2624	schtasks.exe
304	schtasks.exe
872	schtasks.exe
1948	schtasks.exe
776	schtasks.exe
2004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
3012	powershell.exe
2180	powershell.exe
844	powershell.exe
2156	powershell.exe
1552	powershell.exe
2188	powershell.exe
664	powershell.exe
2008	powershell.exe
2888	powershell.exe
588	powershell.exe
2040	powershell.exe
1168	powershell.exe
2752	dllhost.exe
3068	dllhost.exe
2952	dllhost.exe
1996	dllhost.exe
3012	dllhost.exe
2420	dllhost.exe
2828	dllhost.exe
1312	dllhost.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	844	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	664	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	588	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	2752	dllhost.exe
Token: SeDebugPrivilege	3068	dllhost.exe
Token: SeDebugPrivilege	2952	dllhost.exe
Token: SeDebugPrivilege	1996	dllhost.exe
Token: SeDebugPrivilege	3012	dllhost.exe
Token: SeDebugPrivilege	2420	dllhost.exe
Token: SeDebugPrivilege	2828	dllhost.exe
Token: SeDebugPrivilege	1312	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2188	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	52
PID 3004 wrote to memory of 2188	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	52
PID 3004 wrote to memory of 2188	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	52
PID 3004 wrote to memory of 2180	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	53
PID 3004 wrote to memory of 2180	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	53
PID 3004 wrote to memory of 2180	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	53
PID 3004 wrote to memory of 3012	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	54
PID 3004 wrote to memory of 3012	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	54
PID 3004 wrote to memory of 3012	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	54
PID 3004 wrote to memory of 2156	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	55
PID 3004 wrote to memory of 2156	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	55
PID 3004 wrote to memory of 2156	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	55
PID 3004 wrote to memory of 664	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	56
PID 3004 wrote to memory of 664	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	56
PID 3004 wrote to memory of 664	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	56
PID 3004 wrote to memory of 2008	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	57
PID 3004 wrote to memory of 2008	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	57
PID 3004 wrote to memory of 2008	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	57
PID 3004 wrote to memory of 844	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	58
PID 3004 wrote to memory of 844	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	58
PID 3004 wrote to memory of 844	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	58
PID 3004 wrote to memory of 2040	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	59
PID 3004 wrote to memory of 2040	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	59
PID 3004 wrote to memory of 2040	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	59
PID 3004 wrote to memory of 1552	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	60
PID 3004 wrote to memory of 1552	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	60
PID 3004 wrote to memory of 1552	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	60
PID 3004 wrote to memory of 588	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	61
PID 3004 wrote to memory of 588	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	61
PID 3004 wrote to memory of 588	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	61
PID 3004 wrote to memory of 2888	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	62
PID 3004 wrote to memory of 2888	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	62
PID 3004 wrote to memory of 2888	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	62
PID 3004 wrote to memory of 1168	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	63
PID 3004 wrote to memory of 1168	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	63
PID 3004 wrote to memory of 1168	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	63
PID 3004 wrote to memory of 2752	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	76
PID 3004 wrote to memory of 2752	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	76
PID 3004 wrote to memory of 2752	3004	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe	76
PID 2752 wrote to memory of 2500	2752	dllhost.exe	77
PID 2752 wrote to memory of 2500	2752	dllhost.exe	77
PID 2752 wrote to memory of 2500	2752	dllhost.exe	77
PID 2752 wrote to memory of 2764	2752	dllhost.exe	78
PID 2752 wrote to memory of 2764	2752	dllhost.exe	78
PID 2752 wrote to memory of 2764	2752	dllhost.exe	78
PID 2500 wrote to memory of 3068	2500	WScript.exe	79
PID 2500 wrote to memory of 3068	2500	WScript.exe	79
PID 2500 wrote to memory of 3068	2500	WScript.exe	79
PID 3068 wrote to memory of 2416	3068	dllhost.exe	80
PID 3068 wrote to memory of 2416	3068	dllhost.exe	80
PID 3068 wrote to memory of 2416	3068	dllhost.exe	80
PID 3068 wrote to memory of 2728	3068	dllhost.exe	81
PID 3068 wrote to memory of 2728	3068	dllhost.exe	81
PID 3068 wrote to memory of 2728	3068	dllhost.exe	81
PID 2416 wrote to memory of 2952	2416	WScript.exe	83
PID 2416 wrote to memory of 2952	2416	WScript.exe	83
PID 2416 wrote to memory of 2952	2416	WScript.exe	83
PID 2952 wrote to memory of 1696	2952	dllhost.exe	84
PID 2952 wrote to memory of 1696	2952	dllhost.exe	84
PID 2952 wrote to memory of 1696	2952	dllhost.exe	84
PID 2952 wrote to memory of 1936	2952	dllhost.exe	85
PID 2952 wrote to memory of 1936	2952	dllhost.exe	85
PID 2952 wrote to memory of 1936	2952	dllhost.exe	85
PID 1696 wrote to memory of 1996	1696	WScript.exe	86

System policy modification 1 TTPs 27 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe
"C:\Users\Admin\AppData\Local\Temp\1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042bN.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe
  "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2752
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3aa559d-19a3-4601-9ce4-ba056bf1f7a0.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe
      "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3068
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0ad7b3e1-c45e-4e67-a3ad-b3eab34a9aed.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2416
      - C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\664dd73d-839d-4b8e-98a2-0e01411c105d.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\209f308c-3ef0-4079-b558-c17deb9ff4cb.vbs"
        9⤵
        
        PID:1776
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ccd0e85e-d3c7-4b8f-abbe-e92cf2fe9f78.vbs"
        11⤵
        
        PID:2700
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2420
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e82bf3fa-b3ec-4ac0-be4f-0f9accf0cb7f.vbs"
        13⤵
        
        PID:2704
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2828
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bbe2b50f-71ff-4cfe-954b-f54a9725e709.vbs"
        15⤵
        
        PID:2044
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1312
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a549b5e-56e9-4760-858a-b64a6be951fc.vbs"
        17⤵
        
        PID:3016
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db37172f-ac54-4be2-9a69-5d80ec8be025.vbs"
        17⤵
        
        PID:2272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f93bc289-e269-47cd-8589-09fcbb9e217d.vbs"
        15⤵
        
        PID:484
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43863918-97a6-48d8-b000-0591b13592be.vbs"
        13⤵
        
        PID:2332
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9f7f9b0-f261-4fe2-b365-7d75ec89da79.vbs"
        11⤵
        
        PID:892
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd07a02a-0a39-4717-90b0-e054c41ff77d.vbs"
        9⤵
        
        PID:1992
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef432259-0e3d-415c-b6c8-49c66aa5a93d.vbs"
        7⤵
        
        PID:1936
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78394bcd-0255-4b01-891c-c885b8858e40.vbs"
        5⤵
        
        PID:2728
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0fcea6e3-900c-4397-8884-c88d2bc57b0d.vbs"
    3⤵
    PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Java\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\en-US\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\en-US\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\en-US\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Music\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Music\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Music\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Journal\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Journal\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe

Filesize
4.9MB

MD5
c3b4acb826fd271105719fa2ce6733c3

SHA1
dc92fe457a498190e948a07428910c88497724ec

SHA256
42ead80aacdd90f3bb83f45667c4919e9285998c5388b58fc84a02b370631ba6

SHA512
37940208c3c14eac834a1e0b5845837104718ec2492efe9f677b9cb0dc5779437536d0aba083bbb987e549363fbf014305173278ee322335dea6342306a5bab9

Download Submit
C:\Program Files\Windows Photo Viewer\fr-FR\dwm.exe

Filesize
4.9MB

MD5
24d32f5bdea255704c0e4d3335268460

SHA1
db9240d03c8851ba034cf951a2d15be9076530af

SHA256
1c576ac232fa52e44ddc12fcefa1a5803750c5efd1d9e82176b7a0f54d40042b

SHA512
b52ad12cb44891460a30a040b3290e17c18592d1a8167f15c1df4a1ccec654270f0711d915b099359907079d3118c09294bf00b95fdc7f8d6a74778a969c98fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\0ad7b3e1-c45e-4e67-a3ad-b3eab34a9aed.vbs

Filesize
758B

MD5
a3951787b94bd77a2f9b949701fad490

SHA1
c7634b5a4e60b5b307442e649608363f58e35c13

SHA256
70b9309edd83067ea9b362cd3d469120007f32f8ef545cfc17e51806d1ed0e25

SHA512
070261bfe7801d39f5a49c4e67e783ccbea1228c6e91e890a6b053241dd8c7fbbb6ca3035b965a3d4def179e51cf010f68de79a42c7c1106194558282a0eca70

Download Submit
C:\Users\Admin\AppData\Local\Temp\0fcea6e3-900c-4397-8884-c88d2bc57b0d.vbs

Filesize
534B

MD5
d78837a42b1eb92b79cabdcc2c2be10a

SHA1
5c4eb7616b05d2e63a116a85d8dae847b9c4f7d5

SHA256
291b50c150525e2518e15aa6dc090a46fc67877fb82b4ca866a2a5bfd4dffe2b

SHA512
62b781a2ce7d4b804259994ee51a1a68b4dd72708ca759b99c93226d4580624ffdf27a7f4dee8ffa62a7b00ab9476a0bbe90c9d7b06e9e401f553fa945c1c22f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1a549b5e-56e9-4760-858a-b64a6be951fc.vbs

Filesize
758B

MD5
b5ba2847305c913f92c81caea4ffd23a

SHA1
215b3a790075f5214b2b2d5ce381a9fad99fb747

SHA256
aab4624805c7d22b4676f53e463f4d3c4207bcd183cf57ac8d234976dfbc93c6

SHA512
47233e3b397f505141c39fe32a616b0207776120a5f51d5be6d37124732bdb72f018ff567e855a5308bb4c58bbf98e786957da7deb06b3d156dacddf22461d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\209f308c-3ef0-4079-b558-c17deb9ff4cb.vbs

Filesize
758B

MD5
f12124d3c912981d98fa02856c020c69

SHA1
050e833257ffc3fdaeb14f3896f07129a393525b

SHA256
8f09d42313ae381fbc2d6f429fdcf57a52ced607ab6b6b35b58b9c21b38ee2ee

SHA512
d0325604e396ccd53262141a048f7b3f2499f9dcd84f0dabde23c8fbeae083afe625a41ccc21951835fef22eb8d5108f4e23b73d6ff28ae970ece27d8ec2330c

Download Submit
C:\Users\Admin\AppData\Local\Temp\664dd73d-839d-4b8e-98a2-0e01411c105d.vbs

Filesize
758B

MD5
fa3471740f21bf2cdc709c1b1de283d5

SHA1
e2150345c9a2d036308ca6af19a086eaab8b0c87

SHA256
d7dc549afcd85a8d4e6bd20c7a27d852cb6a677bfe5465f4b22182c12b2312bd

SHA512
fd644899dfd456bc93119d97a3ccfa083a3553ac7193878432c9713cbe1ce13fb2d2ba73b0868015e8852cb82e2ee937d5025cae880211b0b8ec50790b70ef88

Download Submit
C:\Users\Admin\AppData\Local\Temp\bbe2b50f-71ff-4cfe-954b-f54a9725e709.vbs

Filesize
758B

MD5
e618bd23297c4044b6c69f9813916e26

SHA1
2de29d7a35adb149e4603746172ba8834e2d3e9b

SHA256
8eba699dc83781fab164e6a1a6142479a7aa4e75eeb81c37d82874251e1e4c47

SHA512
3bea465494e79772e339e24eec59e56acad5f8276fd6df40d2f838b219321d86a4f2344e47ad6c346b7b66927c7ebdb42226a1045d612e4d5287f6fed098b923

Download Submit
C:\Users\Admin\AppData\Local\Temp\ccd0e85e-d3c7-4b8f-abbe-e92cf2fe9f78.vbs

Filesize
758B

MD5
a5a051a6b1db97b39c0e11da78a397ff

SHA1
77f061ac7dc2dd9a69a2fc24ac5ec6c184ef0d38

SHA256
45e05f8626433eb996f3958b4797afcf51d0fa626abe9ed2983de6ae152069fd

SHA512
4ab71f2b0a90a844aaaae2843beee3b304ab074941224ae07a68a50341f40dfa6be4e0f530f29b7cfab955d10aef87151e9efe7730cd74b3766ffb286f575b67

Download Submit
C:\Users\Admin\AppData\Local\Temp\e3aa559d-19a3-4601-9ce4-ba056bf1f7a0.vbs

Filesize
758B

MD5
1f1e011389c1680d4a5e00c76e56b5c4

SHA1
c636090955f914e19f07a899da0efe289f77ccf5

SHA256
02a1916c3287b2a99ddac5a0fce65202ee91b857b780d574fb36e67f38bb8fec

SHA512
1b4093a9a676ede707569abd5ebb538ced931c338fb99fe1996ab98608a23ac01e2aeb1c1adb53bcd0d3ab4ddcb339bec31938b0f0fe8834a5b5a7eb18636519

Download Submit
C:\Users\Admin\AppData\Local\Temp\e82bf3fa-b3ec-4ac0-be4f-0f9accf0cb7f.vbs

Filesize
758B

MD5
f03d0460ae14d7eebca4610c5473f1ab

SHA1
423dd3167b0ed740e80abbdde46cdf4e0c960f9b

SHA256
5d1a93a8255c9959ac1c298705bb32204109935d38861dfb8ed98a3cb821801e

SHA512
85892f2fec0c6c27c853878efe7213c50e159e2918a68eb4a396a0165983be894157acdade4a3cdf64fdf3dc31340c13cb21fc9144e45c4ea0d7267e79d2b4ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7697.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f258f7b186c7b1554b2dd4a4f3bdafdf

SHA1
e5ccc9b7ae7862795cdb59ba283ff7344e14e66f

SHA256
efcd7bb3f1fce90e3609717e2837d48cc313346ca5d68c2199aeefb230eb46c8

SHA512
08e6c1796066ec8c17cdd03285d4d57569e7e8da7482145bfa318ffda605fba78648e9ba7c369ff73cb113337497260941b397880d7f81a7e021f93bb5b5eac9

Download Submit
memory/1312-250-0x0000000000290000-0x0000000000784000-memory.dmp

Filesize
5.0MB

Download
memory/1996-192-0x0000000000660000-0x0000000000672000-memory.dmp

Filesize
72KB

Download
memory/2420-221-0x0000000001150000-0x0000000001644000-memory.dmp

Filesize
5.0MB

Download
memory/2752-142-0x0000000001100000-0x00000000015F4000-memory.dmp

Filesize
5.0MB

Download
memory/2752-149-0x0000000000BC0000-0x0000000000BD2000-memory.dmp

Filesize
72KB

Download
memory/3004-5-0x00000000001A0000-0x00000000001A8000-memory.dmp

Filesize
32KB

Download
memory/3004-8-0x00000000005F0000-0x0000000000600000-memory.dmp

Filesize
64KB

Download
memory/3004-11-0x00000000023D0000-0x00000000023DA000-memory.dmp

Filesize
40KB

Download
memory/3004-1-0x0000000000830000-0x0000000000D24000-memory.dmp

Filesize
5.0MB

Download
memory/3004-0-0x000007FEF5A23000-0x000007FEF5A24000-memory.dmp

Filesize
4KB

Download
memory/3004-12-0x00000000023E0000-0x00000000023EE000-memory.dmp

Filesize
56KB

Download
memory/3004-10-0x00000000023C0000-0x00000000023D2000-memory.dmp

Filesize
72KB

Download
memory/3004-9-0x0000000000820000-0x000000000082A000-memory.dmp

Filesize
40KB

Download
memory/3004-159-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/3004-14-0x0000000002400000-0x0000000002408000-memory.dmp

Filesize
32KB

Download
memory/3004-7-0x00000000005D0000-0x00000000005E6000-memory.dmp

Filesize
88KB

Download
memory/3004-6-0x0000000000420000-0x0000000000430000-memory.dmp

Filesize
64KB

Download
memory/3004-16-0x0000000002420000-0x000000000242C000-memory.dmp

Filesize
48KB

Download
memory/3004-13-0x00000000023F0000-0x00000000023FE000-memory.dmp

Filesize
56KB

Download
memory/3004-4-0x00000000005B0000-0x00000000005CC000-memory.dmp

Filesize
112KB

Download
memory/3004-15-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/3004-3-0x000000001B630000-0x000000001B75E000-memory.dmp

Filesize
1.2MB

Download
memory/3004-2-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/3012-99-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/3012-148-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download