dcrat | 3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14

Analysis

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
Size

4.9MB
MD5

a6c4e2d077ec90e6c69325b0da5adb1b
SHA1

945d07aac7c54ca5560ba5cb1e05b0e6c25f8a0d
SHA256

3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14
SHA512

d0fb442b6b0b846193a63abd8cf7084de8c435a7670a6065edd720464897af8ea969f7d452c99457075d9ac06b05e27623fd992b76cf9d26885d8e91ad9ea918
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	576	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	264	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2688	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	2688	schtasks.exe	31

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2416-3-0x000000001B2E0000-0x000000001B40E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2292	powershell.exe
2224	powershell.exe
2172	powershell.exe
2392	powershell.exe
1368	powershell.exe
2108	powershell.exe
1864	powershell.exe
1736	powershell.exe
2408	powershell.exe
2084	powershell.exe
2348	powershell.exe
1440	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
1648	OSPPSVC.exe
1428	OSPPSVC.exe
2792	OSPPSVC.exe
1980	OSPPSVC.exe
916	OSPPSVC.exe
972	OSPPSVC.exe
2796	OSPPSVC.exe
872	OSPPSVC.exe
1924	OSPPSVC.exe
2672	OSPPSVC.exe
1424	OSPPSVC.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\spoolsv.exe	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
File created	C:\Program Files\Windows Media Player\f3b6ecef712a24	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
File opened for modification	C:\Program Files\Windows Media Player\RCXF513.tmp	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
File opened for modification	C:\Program Files\Windows Media Player\spoolsv.exe	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Help\OEM\smss.exe	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
File created	C:\Windows\Vss\Writers\System.exe	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
File created	C:\Windows\Vss\Writers\27d1bcfc3c54e0	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
File created	C:\Windows\Help\OEM\69ddcba757bf72	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
File opened for modification	C:\Windows\Vss\Writers\RCXE812.tmp	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
File opened for modification	C:\Windows\Resources\RCXEE8B.tmp	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
File opened for modification	C:\Windows\Resources\csrss.exe	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
File created	C:\Windows\Resources\csrss.exe	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
File created	C:\Windows\Resources\886983d96e3d3e	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
File created	C:\Windows\Help\OEM\smss.exe	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
File opened for modification	C:\Windows\Vss\Writers\System.exe	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
File opened for modification	C:\Windows\Help\OEM\RCXF717.tmp	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
576	schtasks.exe
2276	schtasks.exe
2788	schtasks.exe
2568	schtasks.exe
2536	schtasks.exe
1412	schtasks.exe
2304	schtasks.exe
2560	schtasks.exe
1656	schtasks.exe
1588	schtasks.exe
2824	schtasks.exe
708	schtasks.exe
1604	schtasks.exe
264	schtasks.exe
2748	schtasks.exe
2672	schtasks.exe
2828	schtasks.exe
2400	schtasks.exe
2228	schtasks.exe
2428	schtasks.exe
1944	schtasks.exe
2812	schtasks.exe
1876	schtasks.exe
848	schtasks.exe
2376	schtasks.exe
2852	schtasks.exe
2964	schtasks.exe
1900	schtasks.exe
2588	schtasks.exe
1688	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
1440	powershell.exe
2292	powershell.exe
2084	powershell.exe
1864	powershell.exe
1368	powershell.exe
2348	powershell.exe
2172	powershell.exe
2108	powershell.exe
2224	powershell.exe
2408	powershell.exe
2392	powershell.exe
1736	powershell.exe
1648	OSPPSVC.exe
1428	OSPPSVC.exe
2792	OSPPSVC.exe
1980	OSPPSVC.exe
916	OSPPSVC.exe
972	OSPPSVC.exe
2796	OSPPSVC.exe
872	OSPPSVC.exe
1924	OSPPSVC.exe
2672	OSPPSVC.exe
1424	OSPPSVC.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	1648	OSPPSVC.exe
Token: SeDebugPrivilege	1428	OSPPSVC.exe
Token: SeDebugPrivilege	2792	OSPPSVC.exe
Token: SeDebugPrivilege	1980	OSPPSVC.exe
Token: SeDebugPrivilege	916	OSPPSVC.exe
Token: SeDebugPrivilege	972	OSPPSVC.exe
Token: SeDebugPrivilege	2796	OSPPSVC.exe
Token: SeDebugPrivilege	872	OSPPSVC.exe
Token: SeDebugPrivilege	1924	OSPPSVC.exe
Token: SeDebugPrivilege	2672	OSPPSVC.exe
Token: SeDebugPrivilege	1424	OSPPSVC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2292	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	62
PID 2416 wrote to memory of 2292	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	62
PID 2416 wrote to memory of 2292	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	62
PID 2416 wrote to memory of 1440	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	64
PID 2416 wrote to memory of 1440	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	64
PID 2416 wrote to memory of 1440	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	64
PID 2416 wrote to memory of 2348	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	65
PID 2416 wrote to memory of 2348	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	65
PID 2416 wrote to memory of 2348	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	65
PID 2416 wrote to memory of 1368	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	66
PID 2416 wrote to memory of 1368	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	66
PID 2416 wrote to memory of 1368	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	66
PID 2416 wrote to memory of 2224	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	67
PID 2416 wrote to memory of 2224	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	67
PID 2416 wrote to memory of 2224	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	67
PID 2416 wrote to memory of 2084	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	68
PID 2416 wrote to memory of 2084	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	68
PID 2416 wrote to memory of 2084	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	68
PID 2416 wrote to memory of 2408	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	72
PID 2416 wrote to memory of 2408	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	72
PID 2416 wrote to memory of 2408	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	72
PID 2416 wrote to memory of 2392	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	73
PID 2416 wrote to memory of 2392	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	73
PID 2416 wrote to memory of 2392	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	73
PID 2416 wrote to memory of 1736	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	75
PID 2416 wrote to memory of 1736	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	75
PID 2416 wrote to memory of 1736	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	75
PID 2416 wrote to memory of 1864	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	76
PID 2416 wrote to memory of 1864	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	76
PID 2416 wrote to memory of 1864	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	76
PID 2416 wrote to memory of 2172	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	78
PID 2416 wrote to memory of 2172	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	78
PID 2416 wrote to memory of 2172	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	78
PID 2416 wrote to memory of 2108	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	79
PID 2416 wrote to memory of 2108	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	79
PID 2416 wrote to memory of 2108	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	79
PID 2416 wrote to memory of 2988	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	86
PID 2416 wrote to memory of 2988	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	86
PID 2416 wrote to memory of 2988	2416	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe	86
PID 2988 wrote to memory of 2068	2988	cmd.exe	88
PID 2988 wrote to memory of 2068	2988	cmd.exe	88
PID 2988 wrote to memory of 2068	2988	cmd.exe	88
PID 2988 wrote to memory of 1648	2988	cmd.exe	89
PID 2988 wrote to memory of 1648	2988	cmd.exe	89
PID 2988 wrote to memory of 1648	2988	cmd.exe	89
PID 1648 wrote to memory of 2432	1648	OSPPSVC.exe	90
PID 1648 wrote to memory of 2432	1648	OSPPSVC.exe	90
PID 1648 wrote to memory of 2432	1648	OSPPSVC.exe	90
PID 1648 wrote to memory of 1872	1648	OSPPSVC.exe	91
PID 1648 wrote to memory of 1872	1648	OSPPSVC.exe	91
PID 1648 wrote to memory of 1872	1648	OSPPSVC.exe	91
PID 2432 wrote to memory of 1428	2432	WScript.exe	92
PID 2432 wrote to memory of 1428	2432	WScript.exe	92
PID 2432 wrote to memory of 1428	2432	WScript.exe	92
PID 1428 wrote to memory of 2400	1428	OSPPSVC.exe	93
PID 1428 wrote to memory of 2400	1428	OSPPSVC.exe	93
PID 1428 wrote to memory of 2400	1428	OSPPSVC.exe	93
PID 1428 wrote to memory of 2680	1428	OSPPSVC.exe	94
PID 1428 wrote to memory of 2680	1428	OSPPSVC.exe	94
PID 1428 wrote to memory of 2680	1428	OSPPSVC.exe	94
PID 2400 wrote to memory of 2792	2400	WScript.exe	95
PID 2400 wrote to memory of 2792	2400	WScript.exe	95
PID 2400 wrote to memory of 2792	2400	WScript.exe	95
PID 2792 wrote to memory of 2084	2792	OSPPSVC.exe	96

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe
"C:\Users\Admin\AppData\Local\Temp\3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AFF5hliR7g.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2068
- - C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe
    "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1648
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ff2042f-7aa2-422a-8ad2-f69b4f2b1742.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2432
    - - C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1428
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\77892324-5378-4ab7-a789-804b6b635052.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2792
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9d004ac1-e7ae-4b11-99ca-fe935a20e383.vbs"
        8⤵
        
        PID:2084
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe"
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1980
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8432e54f-7ac3-4532-86fb-2267f970d0a1.vbs"
        10⤵
        
        PID:1992
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe"
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:916
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e9c5462-d701-400b-96ae-35068648214e.vbs"
        12⤵
        
        PID:2496
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe"
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\834b9c3b-348a-4d1f-8196-a022c59b02ce.vbs"
        14⤵
        
        PID:2200
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe"
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2796
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36bc0ea7-757a-4d1f-b3c2-6078be533d5f.vbs"
        16⤵
        
        PID:2156
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe"
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:872
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\39093eef-fdec-4ddf-bff0-3da412dba89b.vbs"
        18⤵
        
        PID:1632
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe"
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\68dfcbf7-de19-40aa-800e-b494078e0b51.vbs"
        20⤵
        
        PID:2152
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe"
        21⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2672
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c92f21e-30fb-41aa-bd89-cba13c5a1c38.vbs"
        22⤵
        
        PID:1120
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe"
        23⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1424
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4ab4f6a-6614-4673-9e75-66b0683487af.vbs"
        24⤵
        
        PID:1848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e67ef2b-8811-4bdf-b810-4972551a87cd.vbs"
        24⤵
        
        PID:2608
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\66b3baf8-7a5a-47e4-8f2a-fc9d55e96535.vbs"
        22⤵
        
        PID:1864
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\185d66f6-a1a8-4d64-9b42-bdba9d9b3267.vbs"
        20⤵
        
        PID:2008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f0e8056-263b-4ada-b4f4-17d8944e0468.vbs"
        18⤵
        
        PID:1220
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\46928c02-5f8c-46d3-ac37-59fac964c5c8.vbs"
        16⤵
        
        PID:2376
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc24b49b-485f-4dcd-8fc4-71e124a165d4.vbs"
        14⤵
        
        PID:1840
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5190a995-155b-4449-b3ee-d3f0693e279c.vbs"
        12⤵
        
        PID:2320
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3aae1ecd-f509-4d51-bdef-7b76ee4aa96c.vbs"
        10⤵
        
        PID:2012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e0228604-1920-44b1-afe7-2765795442e4.vbs"
        8⤵
        
        PID:1584
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3531124a-e591-4032-b756-c41c0989387e.vbs"
        6⤵
        
        PID:2680
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\641c7f2c-94aa-4f3f-9cca-93cc8b6c99e6.vbs"
      4⤵
      PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Windows\Vss\Writers\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\Vss\Writers\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\Default\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Default\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\Resources\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Resources\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\Resources\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Downloads\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Downloads\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Downloads\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Media Player\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\Help\OEM\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Help\OEM\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\Help\OEM\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe

Filesize
4.9MB

MD5
a6c4e2d077ec90e6c69325b0da5adb1b

SHA1
945d07aac7c54ca5560ba5cb1e05b0e6c25f8a0d

SHA256
3ef212171dd23bbe21457d28cf98c3eed80aeabd231cac6ba9878762543bda14

SHA512
d0fb442b6b0b846193a63abd8cf7084de8c435a7670a6065edd720464897af8ea969f7d452c99457075d9ac06b05e27623fd992b76cf9d26885d8e91ad9ea918

Download Submit
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe

Filesize
4.9MB

MD5
eb69867c11abb12a8e26da0695a65fd9

SHA1
de031eec9f340fe39c32d5a337a0ebad3b0f4b2f

SHA256
685b97b2626b5cb4e8eca8688a6e9f2e193727e6b80cb27fa1c12c87b3688086

SHA512
00b7f10661693f3d450e0198d6d34b3f6afd9f88949204b17cd087c99e5bdffc6b89965fbda4d0cab880b756df80286529bd401de10d622eede95256a0d95a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1ff2042f-7aa2-422a-8ad2-f69b4f2b1742.vbs

Filesize
750B

MD5
8e27336a95cad0f47cfe4ff85a695ff9

SHA1
5d71673d21ea929d99d61297a4fd4870c95cfbec

SHA256
de5270e3761ea2d4a787503b3dcc10d4dad40759046719b06b0b0bf690d1ec79

SHA512
d26a77ffc5551123c6d5fbfef8bb72687d3067b18cea6841ddb07b5732be97311cbdfa58c00e1a53c862840e0ea62307d653870ab11ee62ab7fcdd54d08845f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\36bc0ea7-757a-4d1f-b3c2-6078be533d5f.vbs

Filesize
750B

MD5
aded57784bbf74e62eea5c800111aee4

SHA1
2e80f37c455dc3df6d2049f1f4bc04bcfcdf79a9

SHA256
bb89c57908ddbf0cc5c5f56db2c941f779f79f2518dbac062f25864fdd545f1b

SHA512
cebd6c32e503bd30030d30cf46b4a8a50aee02c7ea0b8ed31bb23764fd3d5710b56d06e0a91eaf8f94541df1040b8d30f6cb4fae7f2b4a8999bdc90bba7b8914

Download Submit
C:\Users\Admin\AppData\Local\Temp\39093eef-fdec-4ddf-bff0-3da412dba89b.vbs

Filesize
749B

MD5
274211e05c64f79d0e24da998177ca85

SHA1
9e1093628d8a5b986ff1d0569b4d4653cdd05beb

SHA256
8ef03d58290969d3d73ce6f99561c2ca8f012718e84a095abfc887dfa612bddc

SHA512
0b70226db8dd6ea4d2e85a4ec7a51f05ebac34dffaf9a1831687f20abeb97a8042e6047c15128401fc2459ebb5d9e79d6f32ccd0ea2265fe9500323039f32a29

Download Submit
C:\Users\Admin\AppData\Local\Temp\3e9c5462-d701-400b-96ae-35068648214e.vbs

Filesize
749B

MD5
27f4cad8ed3a9d86492eab1162836ed0

SHA1
2d292074b8d7adee10da86f589255b7716033e5c

SHA256
36c4cf84e9e8d601fd9e31ffc78fd1f2a0c2c472e7cf4045f1c34effacaedc66

SHA512
1e4484c1e1ee34f94e995eb2a3476fb4934a70beb22826b8587ba494f0df3b6a7ae4de4c6469e71fc4d25fe4d6278d38727cc32959c3e821b59d051bc2ece626

Download Submit
C:\Users\Admin\AppData\Local\Temp\641c7f2c-94aa-4f3f-9cca-93cc8b6c99e6.vbs

Filesize
526B

MD5
d53c6314c2f2a5a1bb2ab9154260fc98

SHA1
3b10e4736fe2f8ee5667c2dc4dcd70fc3218b0fa

SHA256
4aaad711803969c7a587cf1fd97beca919ca67af3ea897e313a654666a39287e

SHA512
ff2da259968772324eda2005cff9d09ff1b70b2b54c1818c618cc096fabe8175b74d25b0e4e86fd57dcce4fe14bb617b82796027abf46086a00acd7711b7d7d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\68dfcbf7-de19-40aa-800e-b494078e0b51.vbs

Filesize
750B

MD5
80b8bddb9a352a269fc0dc25e6b9f93f

SHA1
8a6d4886413a35c6b91666508c532dd8feb11592

SHA256
87d8551909827960ca7d861a5e0d731ac73248f4dcc6a71ec9453187c562506a

SHA512
42ace1097d732183d1af23c560d6550d5234861a42f53b620946d464b34160b3e7d6fcad7b011ff1dd792b9c8c8020f004c9382538b0758eb09ed7946bcfe62d

Download Submit
C:\Users\Admin\AppData\Local\Temp\77892324-5378-4ab7-a789-804b6b635052.vbs

Filesize
750B

MD5
df50e3c08f100290629058ec9f48fd5c

SHA1
07e8001f62115edca2bcbaa99ccc5dff65f3feff

SHA256
f671d171a749f368ca99afa901e738a8f774f102a2b1ca15eb0103485d53e36a

SHA512
d58525be2ec382c1e539efb945c8d4df81e703b0ffed4a8d49dd014321a15dea12b5c59e50f91f4465f1bd24927eeb1faa41acef31ed8c5f677ca492b54b340d

Download Submit
C:\Users\Admin\AppData\Local\Temp\834b9c3b-348a-4d1f-8196-a022c59b02ce.vbs

Filesize
749B

MD5
747c0cd0371ef0d682fff87602f64fd3

SHA1
63f760e3594efa764397d7c2d1db433b71b0d937

SHA256
7cd5e2560bc0ccc5f796ebc335b89632e3ce319cb4699e3d26e537c066eaf2fe

SHA512
42b4981b14687cce28c3df986839025297cb9344859247d56d5e98d8bb555c2bb90c192211b244daa750155311fe66a58ec4fe4856c791c53dfacf5c5220a2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\8432e54f-7ac3-4532-86fb-2267f970d0a1.vbs

Filesize
750B

MD5
f9f83c6760d1017a9aad79040779b7f5

SHA1
4e670acc979187015baf7f4d9efbeaed9580d12c

SHA256
5cf6a972ea813c371f3afc186b87df4a945d960526f0c8c34f5ca423ad3104e4

SHA512
4bd2c05437b9735faf1d9f3cc367a14ccd17fda1d51ff5a33a22b1b9d7e6f86aa1ce9b1acd938ddcd2efafbdf1b9f91eda72c84d4a98065688df51c7a9880436

Download Submit
C:\Users\Admin\AppData\Local\Temp\8c92f21e-30fb-41aa-bd89-cba13c5a1c38.vbs

Filesize
750B

MD5
f4bd1904c8bc7e1c2911d7bf2b7d4f09

SHA1
fb720f062d85f83832cb273200ae420203451a41

SHA256
bf9c960e05f5e9a137ecf1470510e8fd5bc619fe224a8dbc2f2aed0ae9993cd9

SHA512
a22397594c79923839dd689c02c9331e1a5772d77470117c795381e359e105a13de316957cc1a66ed01866ac710b2e627f8192df94b7f50a8764369f2bebc759

Download Submit
C:\Users\Admin\AppData\Local\Temp\9d004ac1-e7ae-4b11-99ca-fe935a20e383.vbs

Filesize
750B

MD5
a98de4b88eede92312aa37ff089d2664

SHA1
9393ccc7c36c0ce1680c4e767092865b3e67a3c0

SHA256
600cd0612ab9809fbf2e2878b0d91835d5b73d1999b1a5aa886783c453eae3a3

SHA512
b3c5c3cc2821de3a7429f25049803a36b8b8c442352389a75c93985330b78b3dfd0044527f5591d0c7fb82cfb2d1adb36f82a70183deb82bc4b604575a106073

Download Submit
C:\Users\Admin\AppData\Local\Temp\AFF5hliR7g.bat

Filesize
239B

MD5
84dae56f2887dc2ed4396aaf673a5ae5

SHA1
27111e96b1214b832bab01ec2d525b11997c8963

SHA256
cebf98be7448d55ac292b3daef168c2bdbd5b44a140b1386a472a49c6ea16947

SHA512
c3c8770f7de4443a9edca5dae0efe64672cff84c683ef68be342b86f63a037f8f22f083199f27bd7d5478a88c109aba58f62fd4807fb9b485762bf5e81622e8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\b4ab4f6a-6614-4673-9e75-66b0683487af.vbs

Filesize
750B

MD5
699adc4607002bf65f810f37d9297cfd

SHA1
082df4967b008391f38592911eabc0a7d3283c8e

SHA256
0e063867d36156b26379c9dfbaf30068b62918fde23841f3632a007a30ff7660

SHA512
c32c2655ded1ac4c351392d687dd4a2ef4eb8e93ceff06c1a8d09163f0c177f033daaea2c656b6b2395e8edec01f4eed50156a08013c48564ae9924def89994e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1CA5.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4cf44a5d0a0b80987b096bb383d79ccc

SHA1
b42305cefac6eb21929b340587f46086e0c88750

SHA256
171256961ab8c4d7202c3e038ed2075fbc67ef283f643a83118a88dc85542db3

SHA512
5df1aede4e27a0304291ac74ea4b3bfe31bebe6d98a3e4b3195e858a33c14d3728d5cb90c62bcd683445843c8bdf2042967d72488567411de84104eea1ff11f4

Download Submit
C:\Windows\Help\OEM\smss.exe

Filesize
4.9MB

MD5
4f8b5ff1d510510566ed8b70b88ce8fc

SHA1
68dd156763d1fc94c1ece0bbd1f57ce51a2b15b3

SHA256
35c92cb350247a18b96737594602fabdfacea97e4610d856ef761d74403ef616

SHA512
fc42620bd05cb11570028dfe6aab55a61ddcc63ef5a155371a5e15220da27d6f332705bfe45ca1e9de765f3e66a13039866185182f1a8bf03228d77f890078e1

Download Submit
C:\Windows\Resources\csrss.exe

Filesize
4.9MB

MD5
e2b06d34e6d6a309a1a70e4f7726a8e1

SHA1
5a6a3d49e034d0574137cca25ce08d8f28bc75eb

SHA256
c641b15cd91db0f4e54707a53c1da70465b3c70213fdabeec0fa984f0f72d6e3

SHA512
a06fed1b778c80760103b271af53c5eb50bab3e5a5a34e148c700d2cf22ccf470883f6fbdcf8f819cc829acc2354dc4b5eda7129344ea44ceff378be4359c47f

Download Submit
memory/872-280-0x00000000004A0000-0x00000000004B2000-memory.dmp

Filesize
72KB

Download
memory/972-250-0x00000000013A0000-0x0000000001894000-memory.dmp

Filesize
5.0MB

Download
memory/1428-192-0x0000000000BE0000-0x00000000010D4000-memory.dmp

Filesize
5.0MB

Download
memory/1440-137-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/1440-130-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/1648-178-0x0000000000A00000-0x0000000000EF4000-memory.dmp

Filesize
5.0MB

Download
memory/1924-295-0x00000000005A0000-0x00000000005B2000-memory.dmp

Filesize
72KB

Download
memory/2416-11-0x0000000000CC0000-0x0000000000CCA000-memory.dmp

Filesize
40KB

Download
memory/2416-9-0x0000000000CA0000-0x0000000000CAA000-memory.dmp

Filesize
40KB

Download
memory/2416-15-0x0000000000D80000-0x0000000000D88000-memory.dmp

Filesize
32KB

Download
memory/2416-14-0x0000000000D70000-0x0000000000D78000-memory.dmp

Filesize
32KB

Download
memory/2416-13-0x0000000000D60000-0x0000000000D6E000-memory.dmp

Filesize
56KB

Download
memory/2416-12-0x0000000000CD0000-0x0000000000CDE000-memory.dmp

Filesize
56KB

Download
memory/2416-1-0x0000000000FD0000-0x00000000014C4000-memory.dmp

Filesize
5.0MB

Download
memory/2416-143-0x000007FEF5F90000-0x000007FEF697C000-memory.dmp

Filesize
9.9MB

Download
memory/2416-10-0x0000000000CB0000-0x0000000000CC2000-memory.dmp

Filesize
72KB

Download
memory/2416-16-0x0000000000D90000-0x0000000000D9C000-memory.dmp

Filesize
48KB

Download
memory/2416-8-0x0000000000C90000-0x0000000000CA0000-memory.dmp

Filesize
64KB

Download
memory/2416-7-0x00000000002E0000-0x00000000002F6000-memory.dmp

Filesize
88KB

Download
memory/2416-2-0x000007FEF5F90000-0x000007FEF697C000-memory.dmp

Filesize
9.9MB

Download
memory/2416-6-0x00000000002D0000-0x00000000002E0000-memory.dmp

Filesize
64KB

Download
memory/2416-5-0x00000000002B0000-0x00000000002B8000-memory.dmp

Filesize
32KB

Download
memory/2416-4-0x0000000000290000-0x00000000002AC000-memory.dmp

Filesize
112KB

Download
memory/2416-0-0x000007FEF5F93000-0x000007FEF5F94000-memory.dmp

Filesize
4KB

Download
memory/2416-3-0x000000001B2E0000-0x000000001B40E000-memory.dmp

Filesize
1.2MB

Download
memory/2792-207-0x0000000000520000-0x0000000000532000-memory.dmp

Filesize
72KB

Download
memory/2796-265-0x00000000007B0000-0x00000000007C2000-memory.dmp

Filesize
72KB

Download