dcrat | 175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-10-2024 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Size

4.9MB
MD5

303d8c66df0ffc6d289235da26a7e6d7
SHA1

6bbf1deae5b1811adb32856f563e9014b7fc9661
SHA256

175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6
SHA512

509668909753ea4a1143690b8367911195d40feb42c2e0bcfe8cbcaa796411622beb28728bbd527d4e033986703bb443c1a60b8b2caec880e8e509948f1fef00
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2052	schtasks.exe
		552	schtasks.exe
		2360	schtasks.exe
		288	schtasks.exe
		2548	schtasks.exe
		1504	schtasks.exe
		2980	schtasks.exe
		1120	schtasks.exe
		2652	schtasks.exe
		2000	schtasks.exe
		2156	schtasks.exe
		2872	schtasks.exe
		2372	schtasks.exe
		968	schtasks.exe
		2688	schtasks.exe
		2964	schtasks.exe
		2396	schtasks.exe
		2000	schtasks.exe
		2468	schtasks.exe
		964	schtasks.exe
		1964	schtasks.exe
		2492	schtasks.exe
		2112	schtasks.exe
File created	C:\Windows\addins\5940a34987c991		175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
		3008	schtasks.exe
		1524	schtasks.exe
		2468	schtasks.exe
		2400	schtasks.exe
		2828	schtasks.exe
		2372	schtasks.exe
		1732	schtasks.exe
		1676	schtasks.exe
		1764	schtasks.exe
		1920	schtasks.exe
		1640	schtasks.exe
		1992	schtasks.exe
		2504	schtasks.exe
		2616	schtasks.exe
		2848	schtasks.exe
		1960	schtasks.exe
		2704	schtasks.exe
		1624	schtasks.exe
		940	schtasks.exe
		2832	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
		2140	schtasks.exe
		1492	schtasks.exe
		2092	schtasks.exe
		2980	schtasks.exe
		2012	schtasks.exe
		1380	schtasks.exe
		2052	schtasks.exe
		1560	schtasks.exe
		1572	schtasks.exe
		1708	schtasks.exe
		1084	schtasks.exe
		2076	schtasks.exe
		2060	schtasks.exe
		2492	schtasks.exe
		3064	schtasks.exe
		2152	schtasks.exe
		2880	schtasks.exe
		1616	schtasks.exe
		1996	schtasks.exe

Process spawned unexpected child process 63 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	288	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1120	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2892	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	2892	schtasks.exe	29

UAC bypass 3 TTPs 33 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2256-2-0x000000001B2D0000-0x000000001B3FE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2844	powershell.exe
2340	powershell.exe
1384	powershell.exe
2184	powershell.exe
1104	powershell.exe
2224	powershell.exe
2900	powershell.exe
2524	powershell.exe
1740	powershell.exe
300	powershell.exe
2876	powershell.exe
1124	powershell.exe
2672	powershell.exe
2880	powershell.exe
2348	powershell.exe
2028	powershell.exe
3068	powershell.exe
628	powershell.exe
2428	powershell.exe
2960	powershell.exe
804	powershell.exe
920	powershell.exe
2464	powershell.exe
300	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
2636	conhost.exe
2780	conhost.exe
2488	conhost.exe
1724	conhost.exe
2504	conhost.exe
2328	conhost.exe
2200	conhost.exe
1868	conhost.exe
1436	conhost.exe

Checks whether UAC is enabled 1 TTPs 22 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\it-IT\powershell.exe	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\088424020bedd6	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\powershell.exe	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\conhost.exe	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\powershell.exe	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\e978f868350d50	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File created	C:\Program Files (x86)\Windows Mail\fr-FR\powershell.exe	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\e978f868350d50	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\fr-FR\powershell.exe	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\it-IT\powershell.exe	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File created	C:\Program Files\Microsoft Office\Office14\conhost.exe	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File created	C:\Program Files (x86)\Windows Portable Devices\088424020bedd6	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\powershell.exe	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File created	C:\Program Files\Microsoft Office\Office14\088424020bedd6	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File created	C:\Program Files (x86)\Windows Mail\fr-FR\e978f868350d50	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\conhost.exe	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File created	C:\Program Files (x86)\Windows Portable Devices\conhost.exe	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\powershell.exe	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File created	C:\Program Files (x86)\Windows Mail\it-IT\e978f868350d50	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\addins\dllhost.exe	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File created	C:\Windows\addins\5940a34987c991	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File opened for modification	C:\Windows\addins\RCX59DC.tmp	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File opened for modification	C:\Windows\addins\dllhost.exe	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File created	C:\Windows\Tasks\csrss.exe	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File created	C:\Windows\Tasks\886983d96e3d3e	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
File opened for modification	C:\Windows\Tasks\csrss.exe	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 63 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2832	schtasks.exe
2012	schtasks.exe
1084	schtasks.exe
1640	schtasks.exe
1960	schtasks.exe
1920	schtasks.exe
2616	schtasks.exe
2880	schtasks.exe
1504	schtasks.exe
1996	schtasks.exe
2360	schtasks.exe
2400	schtasks.exe
1732	schtasks.exe
940	schtasks.exe
1764	schtasks.exe
2468	schtasks.exe
1560	schtasks.exe
3008	schtasks.exe
2372	schtasks.exe
2092	schtasks.exe
2828	schtasks.exe
1676	schtasks.exe
2052	schtasks.exe
2504	schtasks.exe
2152	schtasks.exe
1492	schtasks.exe
1120	schtasks.exe
2000	schtasks.exe
552	schtasks.exe
2688	schtasks.exe
2396	schtasks.exe
3064	schtasks.exe
1572	schtasks.exe
2156	schtasks.exe
2468	schtasks.exe
2372	schtasks.exe
2052	schtasks.exe
1524	schtasks.exe
2060	schtasks.exe
2980	schtasks.exe
1624	schtasks.exe
2704	schtasks.exe
1708	schtasks.exe
1616	schtasks.exe
2492	schtasks.exe
2112	schtasks.exe
2848	schtasks.exe
2980	schtasks.exe
2652	schtasks.exe
2548	schtasks.exe
968	schtasks.exe
1380	schtasks.exe
1964	schtasks.exe
288	schtasks.exe
2000	schtasks.exe
2140	schtasks.exe
2076	schtasks.exe
2872	schtasks.exe
396	schtasks.exe
2492	schtasks.exe
1992	schtasks.exe
964	schtasks.exe
2964	schtasks.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
2028	powershell.exe
804	powershell.exe
920	powershell.exe
300	powershell.exe
628	powershell.exe
1384	powershell.exe
1104	powershell.exe
3068	powershell.exe
2348	powershell.exe
2464	powershell.exe
2184	powershell.exe
2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
1740	powershell.exe
2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
2340	powershell.exe
2876	powershell.exe
2224	powershell.exe
2672	powershell.exe
2428	powershell.exe
2844	powershell.exe
1124	powershell.exe
300	powershell.exe
2960	powershell.exe
2524	powershell.exe
2900	powershell.exe
2880	powershell.exe
2636	conhost.exe
2780	conhost.exe
2488	conhost.exe
2504	conhost.exe
2328	conhost.exe
2200	conhost.exe
1868	conhost.exe
1436	conhost.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Token: SeDebugPrivilege	804	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	300	powershell.exe
Token: SeDebugPrivilege	628	powershell.exe
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	300	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	2636	conhost.exe
Token: SeDebugPrivilege	2780	conhost.exe
Token: SeDebugPrivilege	2488	conhost.exe
Token: SeDebugPrivilege	2504	conhost.exe
Token: SeDebugPrivilege	2328	conhost.exe
Token: SeDebugPrivilege	2200	conhost.exe
Token: SeDebugPrivilege	1868	conhost.exe
Token: SeDebugPrivilege	1436	conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 804	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	54
PID 2256 wrote to memory of 804	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	54
PID 2256 wrote to memory of 804	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	54
PID 2256 wrote to memory of 300	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	55
PID 2256 wrote to memory of 300	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	55
PID 2256 wrote to memory of 300	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	55
PID 2256 wrote to memory of 1740	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	57
PID 2256 wrote to memory of 1740	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	57
PID 2256 wrote to memory of 1740	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	57
PID 2256 wrote to memory of 628	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	59
PID 2256 wrote to memory of 628	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	59
PID 2256 wrote to memory of 628	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	59
PID 2256 wrote to memory of 2464	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	60
PID 2256 wrote to memory of 2464	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	60
PID 2256 wrote to memory of 2464	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	60
PID 2256 wrote to memory of 3068	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	61
PID 2256 wrote to memory of 3068	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	61
PID 2256 wrote to memory of 3068	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	61
PID 2256 wrote to memory of 920	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	62
PID 2256 wrote to memory of 920	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	62
PID 2256 wrote to memory of 920	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	62
PID 2256 wrote to memory of 1104	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	63
PID 2256 wrote to memory of 1104	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	63
PID 2256 wrote to memory of 1104	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	63
PID 2256 wrote to memory of 2028	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	64
PID 2256 wrote to memory of 2028	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	64
PID 2256 wrote to memory of 2028	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	64
PID 2256 wrote to memory of 2184	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	65
PID 2256 wrote to memory of 2184	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	65
PID 2256 wrote to memory of 2184	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	65
PID 2256 wrote to memory of 1384	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	66
PID 2256 wrote to memory of 1384	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	66
PID 2256 wrote to memory of 1384	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	66
PID 2256 wrote to memory of 2348	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	67
PID 2256 wrote to memory of 2348	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	67
PID 2256 wrote to memory of 2348	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	67
PID 2256 wrote to memory of 2768	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	78
PID 2256 wrote to memory of 2768	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	78
PID 2256 wrote to memory of 2768	2256	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	78
PID 2768 wrote to memory of 2224	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	118
PID 2768 wrote to memory of 2224	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	118
PID 2768 wrote to memory of 2224	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	118
PID 2768 wrote to memory of 2900	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	119
PID 2768 wrote to memory of 2900	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	119
PID 2768 wrote to memory of 2900	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	119
PID 2768 wrote to memory of 2524	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	120
PID 2768 wrote to memory of 2524	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	120
PID 2768 wrote to memory of 2524	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	120
PID 2768 wrote to memory of 2844	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	122
PID 2768 wrote to memory of 2844	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	122
PID 2768 wrote to memory of 2844	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	122
PID 2768 wrote to memory of 2340	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	123
PID 2768 wrote to memory of 2340	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	123
PID 2768 wrote to memory of 2340	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	123
PID 2768 wrote to memory of 2428	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	124
PID 2768 wrote to memory of 2428	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	124
PID 2768 wrote to memory of 2428	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	124
PID 2768 wrote to memory of 300	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	125
PID 2768 wrote to memory of 300	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	125
PID 2768 wrote to memory of 300	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	125
PID 2768 wrote to memory of 1124	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	126
PID 2768 wrote to memory of 1124	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	126
PID 2768 wrote to memory of 1124	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	126
PID 2768 wrote to memory of 2960	2768	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe	127

System policy modification 1 TTPs 33 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
"C:\Users\Admin\AppData\Local\Temp\175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe"
1⤵
- DcRat
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Users\Admin\AppData\Local\Temp\175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe
  "C:\Users\Admin\AppData\Local\Temp\175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2880
- - C:\Program Files\Microsoft Office\Office14\conhost.exe
    "C:\Program Files\Microsoft Office\Office14\conhost.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:2636
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3de3a957-5bc9-4ddd-afd6-4900f47d6b2e.vbs"
      4⤵
      PID:2940
    - - C:\Program Files\Microsoft Office\Office14\conhost.exe
        
        "C:\Program Files\Microsoft Office\Office14\conhost.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2780
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\152c5d03-85f9-4566-a4dd-5586f92da2bf.vbs"
        6⤵
        
        PID:576
        
        C:\Program Files\Microsoft Office\Office14\conhost.exe
        
        "C:\Program Files\Microsoft Office\Office14\conhost.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a46186ad-f560-4eb8-a190-b0256e79bbe3.vbs"
        8⤵
        
        PID:1984
        
        C:\Program Files\Microsoft Office\Office14\conhost.exe
        
        "C:\Program Files\Microsoft Office\Office14\conhost.exe"
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        System policy modification
        
        PID:1724
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\796bd1ad-eadc-4b98-8fc7-fe196510f78d.vbs"
        10⤵
        
        PID:3068
        
        C:\Program Files\Microsoft Office\Office14\conhost.exe
        
        "C:\Program Files\Microsoft Office\Office14\conhost.exe"
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2504
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64315d08-c910-4ebb-8f62-61cc2d57c20f.vbs"
        12⤵
        
        PID:1904
        
        C:\Program Files\Microsoft Office\Office14\conhost.exe
        
        "C:\Program Files\Microsoft Office\Office14\conhost.exe"
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2328
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08019981-628c-4a43-aee9-79c89a5fbf3b.vbs"
        14⤵
        
        PID:1864
        
        C:\Program Files\Microsoft Office\Office14\conhost.exe
        
        "C:\Program Files\Microsoft Office\Office14\conhost.exe"
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2200
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8f582498-8ae1-42b5-8ff4-ae88c59ea1eb.vbs"
        16⤵
        
        PID:1328
        
        C:\Program Files\Microsoft Office\Office14\conhost.exe
        
        "C:\Program Files\Microsoft Office\Office14\conhost.exe"
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a95c629f-1e6e-44ae-9b8a-c081d475e565.vbs"
        18⤵
        
        PID:2100
        
        C:\Program Files\Microsoft Office\Office14\conhost.exe
        
        "C:\Program Files\Microsoft Office\Office14\conhost.exe"
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1436
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\19d05456-efa8-4886-918c-942cddabae5d.vbs"
        20⤵
        
        PID:2348
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d8192f57-55c6-41e6-9fa5-82eee9bc453b.vbs"
        20⤵
        
        PID:2400
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\53501ac7-9c32-4aa2-94af-3cc1f6bf5563.vbs"
        18⤵
        
        PID:2976
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\404bd43e-8286-4190-9c0e-b239ce147d08.vbs"
        16⤵
        
        PID:2376
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\39283ed3-cd9d-4b99-b7ea-5e8d220a1cd8.vbs"
        14⤵
        
        PID:2772
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db580472-a0d8-4117-b4d2-4ff3a92e3697.vbs"
        12⤵
        
        PID:1944
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1fe8f0d0-d0ba-4cbc-9007-241245fc2c02.vbs"
        10⤵
        
        PID:3056
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\93ec1580-6e3c-4035-a17b-33ee0ef2474c.vbs"
        8⤵
        
        PID:2244
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\989ff2f4-f7bc-470e-8478-97424543318f.vbs"
        6⤵
        
        PID:1712
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6d64a04c-e411-41b1-a662-15b7b84a21e8.vbs"
      4⤵
      PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Videos\Sample Videos\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Videos\Sample Videos\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Videos\Sample Videos\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\NetHood\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\NetHood\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\SendTo\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\SendTo\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\addins\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\addins\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\addins\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\Office14\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Office14\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jdk1.7.0_80\bin\powershell.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\bin\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jdk1.7.0_80\bin\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\powershell.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Application Data\powershell.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Users\Admin\Application Data\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Application Data\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\fr-FR\powershell.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\fr-FR\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\fr-FR\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Favorites\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Default\Favorites\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Favorites\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\Tasks\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Tasks\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\Tasks\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Videos\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Videos\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Videos\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\it-IT\powershell.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\it-IT\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\it-IT\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Office14\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\Office14\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\wininit.exe

Filesize
4.9MB

MD5
303d8c66df0ffc6d289235da26a7e6d7

SHA1
6bbf1deae5b1811adb32856f563e9014b7fc9661

SHA256
175b37895ceccd1ac88905f3c6459fc96e9f3f6172942f85b835391d24fdd6a6

SHA512
509668909753ea4a1143690b8367911195d40feb42c2e0bcfe8cbcaa796411622beb28728bbd527d4e033986703bb443c1a60b8b2caec880e8e509948f1fef00

Download Submit
C:\Users\Admin\AppData\Local\Temp\08019981-628c-4a43-aee9-79c89a5fbf3b.vbs

Filesize
730B

MD5
58ecc85eb982ae0e1a2d55aa3847dcd2

SHA1
ef4347384e966127b3ae583a3bb1b501b2fa14c7

SHA256
2ab4f69ec71b775533f3cffb532e8afd88c5989ed123eac52b628b9e09b2d75a

SHA512
ca999b8d92de9307f076cad6372e3dc224fcd12a9dd9d5e6db7db9c7f02c43e99984bf02f62c9417cb88ebe60d639b2e160c5f3cbdca1563278d5ab3aec3098f

Download Submit
C:\Users\Admin\AppData\Local\Temp\152c5d03-85f9-4566-a4dd-5586f92da2bf.vbs

Filesize
730B

MD5
074eee03f3dd5efe0a7159642400e412

SHA1
da7be9c3971eeb821cd283655b600efa95485e86

SHA256
91022f92794e654324639509bfb0d8e261d896a0a24ba37f50ff31c19c122f7b

SHA512
d607b8ec346cfff640bb23fdd602865ebe6a56ec6738a90479eee72ced27b8d1030de06ab4c7f5c416a412eab10935919def07b16ffa0c21e87c24d84c0e6af3

Download Submit
C:\Users\Admin\AppData\Local\Temp\19d05456-efa8-4886-918c-942cddabae5d.vbs

Filesize
730B

MD5
3dd3d7331eb2a0a9615f245f623c64d6

SHA1
dde2aab156a4fa5cb81828c23fcdcc601047dcbb

SHA256
a3e3aa1b81077adaf17c3811dd942d4ceac9e0be2d217c2f2949ea28c1c3a98d

SHA512
4d4b2e9e1c37a7ff2bb75a81ba438136e92a83d83bdab3fc90ae4d279fa915a213ee051b549fe898f308899522a3e6690f21343b603af3e61aea511412f331b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\3de3a957-5bc9-4ddd-afd6-4900f47d6b2e.vbs

Filesize
730B

MD5
a70e7b5480df5fc06cb838935d9839f7

SHA1
8c35ebad9560f5842018253b36070231130c59d2

SHA256
ec63598b69ef25499368cf1c62160c818ae46e6bfae9523b6a0d7b1420db1a3a

SHA512
e894f8cef4a9a5811e026ba75dacec518a9e3429cdf6e723fcac4a6dcfa1ded345ac48d126562136de6a32da972adb1c7f80da112c6d35f9cffaa5fc7da55f41

Download Submit
C:\Users\Admin\AppData\Local\Temp\64315d08-c910-4ebb-8f62-61cc2d57c20f.vbs

Filesize
730B

MD5
53549b143979d0279a025c838e17ccac

SHA1
e5ddf9c3d2384acac2f430700cc0544db33c68f0

SHA256
6af1e5e68c49acf032437a50a0f0c2d576df423e23de22dbfb378e003339fd07

SHA512
02f0e79285187c29220be832cdf1eb771c5cac66fba7a8d05d6365764520699b2d5a7ca3c28dae286bae29c306000e072ba1ca2146c5593cdca4ac3d12e74b90

Download Submit
C:\Users\Admin\AppData\Local\Temp\6d64a04c-e411-41b1-a662-15b7b84a21e8.vbs

Filesize
506B

MD5
fc9bf638509e08201aaf88f4b76d2a23

SHA1
ea50e6a627cb77fac50f1ae62c0e27f7c0e9195c

SHA256
cc3045d1b1f29b9b8989d60d9f5ccf18bfee683cddb79fc996403641c4028363

SHA512
97f9e04132fc2d626d98dd918c6b41a2b6e4c4141fc95a85a9641cf3b0f06eaaea82608fea7758ee605529020389f940ba5ef5923cb5edd413fcdf77c38aac48

Download Submit
C:\Users\Admin\AppData\Local\Temp\8f582498-8ae1-42b5-8ff4-ae88c59ea1eb.vbs

Filesize
730B

MD5
5f86e7bbb0dd769a8184934a48ae62ad

SHA1
493e6ad06136c6423d8ce0fe9ae76bf5d604306b

SHA256
60230a64031bb1f8594ea4f65d4614f8559809637d3fb5f2a11ca61af16ee35d

SHA512
7c15ed4ffbe9381c127a86de77c566a87f6c6f9924a156b059fc6194cb0261fb9893924918559be9259249245efe391e30b67526190e826d3edbd3ececbdad1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\a46186ad-f560-4eb8-a190-b0256e79bbe3.vbs

Filesize
730B

MD5
e477b68f964dea75e139cc4ea03c7009

SHA1
e4fedd6f8e4949cbd0a2525844c44c724492cd10

SHA256
3008cf06f125a6522e3f3c09ad966d7afadb4bc2e32f3d743947792be2adad1d

SHA512
01ae82d9ad577be6cf32660cb93fde1c9eeb211617a00bc30ccfb80706bf917c731a85d50e1b7556c491e89f2f4f55e78a83f65d9a317c54df0554d8be3ca99d

Download Submit
C:\Users\Admin\AppData\Local\Temp\a95c629f-1e6e-44ae-9b8a-c081d475e565.vbs

Filesize
730B

MD5
a15f8d607348fb9fa5c0588770db6863

SHA1
c5fd595daea437909b1d423e01bbd0d4c80050da

SHA256
a57134c18dcf6e85d8a0cc8fe092445ab3c29e8aad65186d7095066624d13ef6

SHA512
03d32db3dafdccd993985ef38f6013d8b6992747494f57a203b26019a6ae87a54df8c7abd46c08776b05e390e739c0b09320dd0dfc01a2ef5d3eed7208e31826

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6D05.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
62cb3a8fc11d2ea35d69375f935a70e5

SHA1
f8cf5424ddfd87770a378025b344fa91f3de0619

SHA256
3c516643fe0343fa7ed0b41e630ed2acc5d1853913abe8dc4519015256ad6a6e

SHA512
fee2b5df33ac612853c2f660bc62bbfffc9c4b2a43d743b1cea925478cc3f794ff7ff7cdebe33eb513086fb25a20e705e0ff41a236e99faab4b7cf4a29f0abee

Download Submit
memory/300-119-0x000000001B190000-0x000000001B472000-memory.dmp

Filesize
2.9MB

Download
memory/1436-382-0x0000000000160000-0x0000000000654000-memory.dmp

Filesize
5.0MB

Download
memory/1868-367-0x0000000001260000-0x0000000001754000-memory.dmp

Filesize
5.0MB

Download
memory/2028-120-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download
memory/2200-351-0x0000000001000000-0x00000000014F4000-memory.dmp

Filesize
5.0MB

Download
memory/2200-352-0x0000000000500000-0x0000000000512000-memory.dmp

Filesize
72KB

Download
memory/2256-11-0x00000000023C0000-0x00000000023CA000-memory.dmp

Filesize
40KB

Download
memory/2256-3-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download
memory/2256-115-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download
memory/2256-77-0x000007FEF5623000-0x000007FEF5624000-memory.dmp

Filesize
4KB

Download
memory/2256-16-0x000000001AB00000-0x000000001AB0C000-memory.dmp

Filesize
48KB

Download
memory/2256-15-0x000000001AAF0000-0x000000001AAF8000-memory.dmp

Filesize
32KB

Download
memory/2256-14-0x00000000023F0000-0x00000000023F8000-memory.dmp

Filesize
32KB

Download
memory/2256-1-0x0000000000810000-0x0000000000D04000-memory.dmp

Filesize
5.0MB

Download
memory/2256-2-0x000000001B2D0000-0x000000001B3FE000-memory.dmp

Filesize
1.2MB

Download
memory/2256-8-0x0000000000800000-0x0000000000810000-memory.dmp

Filesize
64KB

Download
memory/2256-13-0x00000000023E0000-0x00000000023EE000-memory.dmp

Filesize
56KB

Download
memory/2256-12-0x00000000023D0000-0x00000000023DE000-memory.dmp

Filesize
56KB

Download
memory/2256-4-0x0000000000600000-0x000000000061C000-memory.dmp

Filesize
112KB

Download
memory/2256-0-0x000007FEF5623000-0x000007FEF5624000-memory.dmp

Filesize
4KB

Download
memory/2256-5-0x0000000000620000-0x0000000000628000-memory.dmp

Filesize
32KB

Download
memory/2256-10-0x00000000023B0000-0x00000000023C2000-memory.dmp

Filesize
72KB

Download
memory/2256-6-0x0000000000630000-0x0000000000640000-memory.dmp

Filesize
64KB

Download
memory/2256-7-0x00000000007E0000-0x00000000007F6000-memory.dmp

Filesize
88KB

Download
memory/2256-9-0x00000000023A0000-0x00000000023AA000-memory.dmp

Filesize
40KB

Download
memory/2256-91-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download
memory/2328-336-0x0000000000150000-0x0000000000644000-memory.dmp

Filesize
5.0MB

Download
memory/2340-222-0x000000001B120000-0x000000001B402000-memory.dmp

Filesize
2.9MB

Download
memory/2340-224-0x00000000023B0000-0x00000000023B8000-memory.dmp

Filesize
32KB

Download
memory/2488-304-0x00000000004F0000-0x0000000000502000-memory.dmp

Filesize
72KB

Download
memory/2504-321-0x0000000000A80000-0x0000000000A92000-memory.dmp

Filesize
72KB

Download
memory/2504-320-0x00000000003A0000-0x0000000000894000-memory.dmp

Filesize
5.0MB

Download
memory/2636-275-0x00000000003D0000-0x00000000008C4000-memory.dmp

Filesize
5.0MB

Download
memory/2780-289-0x0000000001100000-0x00000000015F4000-memory.dmp

Filesize
5.0MB

Download