dcrat | cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
Size

4.9MB
MD5

643e28154ca147ff6fc14012107dd0c0
SHA1

8ed3ed51217c70a1e519f9aace5fb2884b1a1c75
SHA256

cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4
SHA512

70e218b3ddc9d92f83a68bf7cfe22737d7cbe0336926a27d72f702fe530c8dcf267f18055525cbd4d8953f7de093ca24a9d6dd6fb9838ad9094434d8e52bf508
SSDEEP

49152:Ll5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	2820	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2820	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	2820	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2820	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2820	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2820	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2820	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2820	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2820	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2820	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	2820	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2820	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2820	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2820	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2820	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2820	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2820	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2820	schtasks.exe	30

UAC bypass 3 TTPs 33 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1972-3-0x000000001B670000-0x000000001B79E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2540	powershell.exe
536	powershell.exe
2504	powershell.exe
2724	powershell.exe
1776	powershell.exe
1284	powershell.exe
2424	powershell.exe
2408	powershell.exe
2812	powershell.exe
2608	powershell.exe
2396	powershell.exe
2132	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
840	csrss.exe
1544	csrss.exe
908	csrss.exe
964	csrss.exe
3012	csrss.exe
888	csrss.exe
1644	csrss.exe
2192	csrss.exe
1496	csrss.exe
2536	csrss.exe

Checks whether UAC is enabled 1 TTPs 22 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Sidebar\es-ES\taskhost.exe	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\RCXC1A1.tmp	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\csrss.exe	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
File created	C:\Program Files (x86)\Windows Sidebar\es-ES\taskhost.exe	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
File created	C:\Program Files (x86)\Windows Sidebar\es-ES\b75386f1303e64	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
File created	C:\Program Files (x86)\Windows Defender\csrss.exe	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
File created	C:\Program Files (x86)\Windows Defender\886983d96e3d3e	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\es-ES\RCXBD8A.tmp	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\de-DE\OSPPSVC.exe	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
File created	C:\Windows\de-DE\1610b97d3ab4a7	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
File opened for modification	C:\Windows\de-DE\RCXB914.tmp	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
File opened for modification	C:\Windows\de-DE\OSPPSVC.exe	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2456	schtasks.exe
2788	schtasks.exe
1804	schtasks.exe
2752	schtasks.exe
2684	schtasks.exe
1008	schtasks.exe
1484	schtasks.exe
2612	schtasks.exe
2792	schtasks.exe
3048	schtasks.exe
2896	schtasks.exe
2968	schtasks.exe
2780	schtasks.exe
2972	schtasks.exe
2624	schtasks.exe
1932	schtasks.exe
2700	schtasks.exe
3040	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
536	powershell.exe
2396	powershell.exe
2540	powershell.exe
2424	powershell.exe
2408	powershell.exe
2812	powershell.exe
2504	powershell.exe
2724	powershell.exe
2608	powershell.exe
1776	powershell.exe
2132	powershell.exe
1284	powershell.exe
840	csrss.exe
1544	csrss.exe
908	csrss.exe
964	csrss.exe
3012	csrss.exe
888	csrss.exe
1644	csrss.exe
2192	csrss.exe
1496	csrss.exe
2536	csrss.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	1284	powershell.exe
Token: SeDebugPrivilege	840	csrss.exe
Token: SeDebugPrivilege	1544	csrss.exe
Token: SeDebugPrivilege	908	csrss.exe
Token: SeDebugPrivilege	964	csrss.exe
Token: SeDebugPrivilege	3012	csrss.exe
Token: SeDebugPrivilege	888	csrss.exe
Token: SeDebugPrivilege	1644	csrss.exe
Token: SeDebugPrivilege	2192	csrss.exe
Token: SeDebugPrivilege	1496	csrss.exe
Token: SeDebugPrivilege	2536	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2424	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	49
PID 1972 wrote to memory of 2424	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	49
PID 1972 wrote to memory of 2424	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	49
PID 1972 wrote to memory of 2408	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	50
PID 1972 wrote to memory of 2408	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	50
PID 1972 wrote to memory of 2408	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	50
PID 1972 wrote to memory of 2396	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	51
PID 1972 wrote to memory of 2396	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	51
PID 1972 wrote to memory of 2396	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	51
PID 1972 wrote to memory of 2540	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	52
PID 1972 wrote to memory of 2540	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	52
PID 1972 wrote to memory of 2540	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	52
PID 1972 wrote to memory of 536	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	53
PID 1972 wrote to memory of 536	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	53
PID 1972 wrote to memory of 536	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	53
PID 1972 wrote to memory of 2608	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	54
PID 1972 wrote to memory of 2608	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	54
PID 1972 wrote to memory of 2608	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	54
PID 1972 wrote to memory of 2132	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	56
PID 1972 wrote to memory of 2132	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	56
PID 1972 wrote to memory of 2132	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	56
PID 1972 wrote to memory of 2504	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	58
PID 1972 wrote to memory of 2504	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	58
PID 1972 wrote to memory of 2504	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	58
PID 1972 wrote to memory of 2724	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	59
PID 1972 wrote to memory of 2724	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	59
PID 1972 wrote to memory of 2724	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	59
PID 1972 wrote to memory of 1776	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	60
PID 1972 wrote to memory of 1776	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	60
PID 1972 wrote to memory of 1776	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	60
PID 1972 wrote to memory of 1284	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	61
PID 1972 wrote to memory of 1284	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	61
PID 1972 wrote to memory of 1284	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	61
PID 1972 wrote to memory of 2812	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	62
PID 1972 wrote to memory of 2812	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	62
PID 1972 wrote to memory of 2812	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	62
PID 1972 wrote to memory of 844	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	73
PID 1972 wrote to memory of 844	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	73
PID 1972 wrote to memory of 844	1972	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe	73
PID 844 wrote to memory of 1296	844	cmd.exe	75
PID 844 wrote to memory of 1296	844	cmd.exe	75
PID 844 wrote to memory of 1296	844	cmd.exe	75
PID 844 wrote to memory of 840	844	cmd.exe	77
PID 844 wrote to memory of 840	844	cmd.exe	77
PID 844 wrote to memory of 840	844	cmd.exe	77
PID 840 wrote to memory of 872	840	csrss.exe	78
PID 840 wrote to memory of 872	840	csrss.exe	78
PID 840 wrote to memory of 872	840	csrss.exe	78
PID 840 wrote to memory of 1668	840	csrss.exe	79
PID 840 wrote to memory of 1668	840	csrss.exe	79
PID 840 wrote to memory of 1668	840	csrss.exe	79
PID 872 wrote to memory of 1544	872	WScript.exe	80
PID 872 wrote to memory of 1544	872	WScript.exe	80
PID 872 wrote to memory of 1544	872	WScript.exe	80
PID 1544 wrote to memory of 2072	1544	csrss.exe	81
PID 1544 wrote to memory of 2072	1544	csrss.exe	81
PID 1544 wrote to memory of 2072	1544	csrss.exe	81
PID 1544 wrote to memory of 2776	1544	csrss.exe	82
PID 1544 wrote to memory of 2776	1544	csrss.exe	82
PID 1544 wrote to memory of 2776	1544	csrss.exe	82
PID 2072 wrote to memory of 908	2072	WScript.exe	83
PID 2072 wrote to memory of 908	2072	WScript.exe	83
PID 2072 wrote to memory of 908	2072	WScript.exe	83
PID 908 wrote to memory of 2720	908	csrss.exe	84

System policy modification 1 TTPs 33 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe
"C:\Users\Admin\AppData\Local\Temp\cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4N.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vT6Q8ndOLD.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1296
- - C:\Program Files (x86)\Windows Defender\csrss.exe
    "C:\Program Files (x86)\Windows Defender\csrss.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:840
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4cb65f5-8d4d-44d6-909d-2e3d6c4e6734.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:872
    - - C:\Program Files (x86)\Windows Defender\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\csrss.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1544
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ab287fd6-5d25-46e2-85eb-617cdfce133f.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Program Files (x86)\Windows Defender\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\csrss.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:908
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\facafe9f-cbc0-485a-808f-e6d695e43b52.vbs"
        8⤵
        
        PID:2720
        
        C:\Program Files (x86)\Windows Defender\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\csrss.exe"
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e78748ad-fb25-48a6-aeff-b094c18de395.vbs"
        10⤵
        
        PID:2664
        
        C:\Program Files (x86)\Windows Defender\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\csrss.exe"
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c47c2f3-a835-466f-bacd-a2512407e3c7.vbs"
        12⤵
        
        PID:1488
        
        C:\Program Files (x86)\Windows Defender\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\csrss.exe"
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:888
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a94a3fd-653a-4372-8735-80af988e7e23.vbs"
        14⤵
        
        PID:2116
        
        C:\Program Files (x86)\Windows Defender\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\csrss.exe"
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1644
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fc768243-2b3b-4a60-94cd-3dfa863aa519.vbs"
        16⤵
        
        PID:2416
        
        C:\Program Files (x86)\Windows Defender\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\csrss.exe"
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2192
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\480df64f-e9c0-4486-9857-ded8564d3c65.vbs"
        18⤵
        
        PID:1296
        
        C:\Program Files (x86)\Windows Defender\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\csrss.exe"
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1496
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\63d0e0e5-373b-4c26-a418-ed51104e4ca3.vbs"
        20⤵
        
        PID:2756
        
        C:\Program Files (x86)\Windows Defender\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\csrss.exe"
        21⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2536
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\03e13b9a-a906-47f6-a2c3-d5a73ff43c96.vbs"
        22⤵
        
        PID:1652
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\35f38f84-7e04-41bc-8eb8-7621f14039ac.vbs"
        22⤵
        
        PID:2736
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\900c0601-0767-4acd-b8dd-a3e9813fa97d.vbs"
        20⤵
        
        PID:608
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38285bf3-3b53-44ef-9f91-2655591ff607.vbs"
        18⤵
        
        PID:1744
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\372cab5b-2521-413a-966d-6bdb51710776.vbs"
        16⤵
        
        PID:556
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa8867ad-8447-4364-a4d5-14806d0738b4.vbs"
        14⤵
        
        PID:2564
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\851c954e-b6a7-4370-92f3-7625f43e6307.vbs"
        12⤵
        
        PID:1444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bfd18244-c7b1-45c5-a4db-ce8cfd165dd7.vbs"
        10⤵
        
        PID:2384
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cb73057c-f046-4b15-9867-47741a892c92.vbs"
        8⤵
        
        PID:2924
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2449655e-c012-4cd8-8768-327cbeae4add.vbs"
        6⤵
        
        PID:2776
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1673089b-17c2-45ff-b14d-ca9c82c64cc4.vbs"
      4⤵
      PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Windows\de-DE\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\de-DE\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Windows\de-DE\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Defender\csrss.exe

Filesize
4.9MB

MD5
37da7245839130568001d9ade753eddd

SHA1
5ad8373960e578506c0c432a52c24881998ffe2d

SHA256
9f04000b6332a90420f33ab285297556a8b0cebeff4f6e2deb75ae789f40f18b

SHA512
c84574596c2e05cce9fbe9c862b0cccf97aac7991f2711d2836de3abb9bee2b1fd02560d4620eb58c5768171abd978d2c5a00a0fe6bfcca0740ebb46bb5e4f4d

Download Submit
C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe

Filesize
4.9MB

MD5
643e28154ca147ff6fc14012107dd0c0

SHA1
8ed3ed51217c70a1e519f9aace5fb2884b1a1c75

SHA256
cbc0b7cde904d6a4e2a3dbc717312b90b09aa1e2895774e28ff4076f964b7ba4

SHA512
70e218b3ddc9d92f83a68bf7cfe22737d7cbe0336926a27d72f702fe530c8dcf267f18055525cbd4d8953f7de093ca24a9d6dd6fb9838ad9094434d8e52bf508

Download Submit
C:\Users\Admin\AppData\Local\Temp\03e13b9a-a906-47f6-a2c3-d5a73ff43c96.vbs

Filesize
725B

MD5
66dde5242722501b5f793e9761f323a0

SHA1
04fbba5fd97f6207899e3e2f959bd85a0dbb2b4d

SHA256
6dda343dda74bf78aa701c0d7cb55686f31363ece3aa3664ebba7c5de6fca572

SHA512
617ce8fc55538e8ff09cae33c434f485fbdcdb0c7138528531d77bc38359dd3951ed63e53678936606d2ef61620c05a6522da5d836fb6f59f9928d4a64ce48d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1673089b-17c2-45ff-b14d-ca9c82c64cc4.vbs

Filesize
501B

MD5
a8d61fee11d12980ee1d1c3188c72a56

SHA1
9cb02b0d16b7b7cfcb1200d6b69b5840cb39092c

SHA256
f273a89fd8e927dbed5578bb968db2cb135aeeb8f1a7015c4c81c6800f56a73c

SHA512
11a8ee4bac990cf70442fbc76a4d60f3bfb8ffa83cea06478d13deadface246ec93237f4bf5b0abc3f5f1c69cbc11bab3f65a1a633d1d7fcbd1175caa903b4c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1c47c2f3-a835-466f-bacd-a2512407e3c7.vbs

Filesize
725B

MD5
e0eed087be488826fb3fd380f7ed3ef7

SHA1
0f0b545bb3008a28ccf42ee2603d2a7a53600fa3

SHA256
ef9a7497be6fdf1871d6e418a88de1181043d3f8d4402e7010792a2d192af495

SHA512
cc297f38bf777ebefc520405d836147c521ec2f65d82f12ec19e75459c3f1437e530a55022817ca0c53ae224cbb7e66afa409a1dcca2a115dd7249e431970490

Download Submit
C:\Users\Admin\AppData\Local\Temp\480df64f-e9c0-4486-9857-ded8564d3c65.vbs

Filesize
725B

MD5
47081ce2240c35b226735dd3c9dc0bfa

SHA1
b193452df627d01995bbe335bcca0edf7eaef288

SHA256
02acaec5ede0fc9dbe6dbbf356e11109e2f69b2f258726f7d5279e16c3437e60

SHA512
b8f331c0394b9160331b1b8c63081f8595f4f3fd61491ea9672a31193f990b2807e2238152590c9aa8173a2ff24400db2aa1bb95b621229dc4667ba0875740da

Download Submit
C:\Users\Admin\AppData\Local\Temp\63d0e0e5-373b-4c26-a418-ed51104e4ca3.vbs

Filesize
725B

MD5
715dc8bb26eaf883d4e0dd97e2ef50c8

SHA1
a5403106e6044c82409646a3707ed413fceb585e

SHA256
9a255f4989991b96c250ffcb5b314b302c27f1794d1817ffcf8793848a5b0c13

SHA512
3c2825c2e2c99a85f7766e9088fd8c37a86ef7ac206edfc44dd83bfcb2256e76d7128e7c5aa91ba28956d222a2d34228b09cf20114152ad9572d47deeeb6ab69

Download Submit
C:\Users\Admin\AppData\Local\Temp\7a94a3fd-653a-4372-8735-80af988e7e23.vbs

Filesize
724B

MD5
53077173944876372a02296b7c345403

SHA1
46f482e1e9350364b76dc3cd44f160c0d2ae1b6d

SHA256
79c8e461a560d768e5252fbbb12fbcf1ba6ce1530c04232bcd5b428115b99dc7

SHA512
2e15d3739eeb31fae4c64c0e39448b092dd506ace53a525cf349f9ca1b3f3868996515f7e14a2d62a34a140efb9d80f0e4e446547371690699b9a54f49827ebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\ab287fd6-5d25-46e2-85eb-617cdfce133f.vbs

Filesize
725B

MD5
57c3f4d111df37da5812f1d0446d8130

SHA1
a32d558910e123e3ad55d90063b4684b2a22aa90

SHA256
1cedb2dd43808a62567c8e189dab9f083f81c2ede96b98f85dcc3991e3d95283

SHA512
0aabad8a5910fcc3178b9e389b333beabb88171f1b9bd98d1155780764fc0dfaa9ed6a7741e9209ce873247506967696185f3cb4caa0ca5afc7690c0248bd927

Download Submit
C:\Users\Admin\AppData\Local\Temp\b4cb65f5-8d4d-44d6-909d-2e3d6c4e6734.vbs

Filesize
724B

MD5
09f76825647ef1a0d5301762a9daeb40

SHA1
8768daf7515d56ec320fe48ed5171a85aa560aa5

SHA256
43f2dc860391c615083ce267943214b90849de97be6b054502803f5ee542b538

SHA512
518e9e40080afae85bd178ebb43e00b40465b68320f0cf7f6f62a1c786395cbbb438eeb04a8ba1ce040856ac72bb09f1215aadb16a6c36d2da63254889205b9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\e78748ad-fb25-48a6-aeff-b094c18de395.vbs

Filesize
724B

MD5
fc10eb7e44dd36f622f89a822371a500

SHA1
1136037f98fc7e623b28bcdb6c2e04623c90310e

SHA256
e36bb780d1a8768bf16cf825f2645cc31c401015fb0276771832f6ecf1365287

SHA512
1a3e1e1c1c0f9fa0a8a34035fa8767ed36e45eb425519e903882cac34b7ca85533332db22f156a151e39467f27f52d237af1b084d91aec15361b6c96dafeb73e

Download Submit
C:\Users\Admin\AppData\Local\Temp\facafe9f-cbc0-485a-808f-e6d695e43b52.vbs

Filesize
724B

MD5
ff3f66c04779362ffb53cb6d7ac7233b

SHA1
2e2b0cdc49d3753e6d1ae2fc7581c6b02853234e

SHA256
d301f15d69be065db9574b7d0a48b84ea59adef32c0590de0ebfdd0a4325a3b5

SHA512
a7c7c1fec4c913c492a05966f16f77d8c6d3fee3c8eef74be43a6c07f7ecb1a6481d4bb809c48a85ed82fb83b27d8c2cd4d2a9bb4a67977aedf2e154513b3344

Download Submit
C:\Users\Admin\AppData\Local\Temp\fc768243-2b3b-4a60-94cd-3dfa863aa519.vbs

Filesize
725B

MD5
37fb531e42c9400979080a069f37e8be

SHA1
8d88d2998fe3d51345bb819b2a83c44a8698e0dc

SHA256
aa4535f10f4993797175a1dd3199afbcb733b7a26b3d4509509dcab4ef29f27d

SHA512
365c525e3f4d199099b2e7681347fcaaaba6075d830da8c3178fad55b7db3b0dfe1f5ae5674ed5e4ac574f62c6de90d5d87772f82b05ad6fbdd305a516577d44

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEA4F.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Local\Temp\vT6Q8ndOLD.bat

Filesize
214B

MD5
73270aaf9dfa70056b29834cf49ca13e

SHA1
03f72713ff462189b5fb12ff7272df2f5d27ed5c

SHA256
6a16180ae65c651865b1ae01319a44c5ca47976aa874164a08533d243d91199e

SHA512
1d2ad30c0c207f95e6eddc088762d3cf9ea7c1f236b332d3a6517edb6fef0612090ab14e8562538511204cc4b403a5bbabc9faf494197d1eca307ac6d49589e7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f444c02b154f7bfddede64c605f211c0

SHA1
3383824145c19dbce9510fbcd930440e7fcc3180

SHA256
c2640183d3944cd8434510a4487b26ece97c5128a2ce2d36baeec7e6944d63fe

SHA512
e1cf515cc40b31dfbf0bc33ab5bb2e8c19b0b65cc7c0a3ee0d0c25762e280e5ec8397485984b96151f848670210f1633dc1c64d778279c7fe0b57d9f2b2489cf

Download Submit
memory/536-91-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/536-93-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/840-145-0x0000000000060000-0x0000000000554000-memory.dmp

Filesize
5.0MB

Download
memory/888-217-0x0000000000110000-0x0000000000604000-memory.dmp

Filesize
5.0MB

Download
memory/964-188-0x0000000000C00000-0x0000000000C12000-memory.dmp

Filesize
72KB

Download
memory/1496-261-0x0000000001380000-0x0000000001874000-memory.dmp

Filesize
5.0MB

Download
memory/1544-159-0x0000000001150000-0x0000000001644000-memory.dmp

Filesize
5.0MB

Download
memory/1644-232-0x00000000011F0000-0x00000000016E4000-memory.dmp

Filesize
5.0MB

Download
memory/1972-10-0x0000000000510000-0x0000000000522000-memory.dmp

Filesize
72KB

Download
memory/1972-111-0x000007FEF5140000-0x000007FEF5B2C000-memory.dmp

Filesize
9.9MB

Download
memory/1972-15-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/1972-16-0x0000000000570000-0x000000000057C000-memory.dmp

Filesize
48KB

Download
memory/1972-14-0x0000000000550000-0x0000000000558000-memory.dmp

Filesize
32KB

Download
memory/1972-13-0x0000000000540000-0x000000000054E000-memory.dmp

Filesize
56KB

Download
memory/1972-12-0x0000000000530000-0x000000000053E000-memory.dmp

Filesize
56KB

Download
memory/1972-11-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download
memory/1972-0-0x000007FEF5143000-0x000007FEF5144000-memory.dmp

Filesize
4KB

Download
memory/1972-9-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/1972-8-0x00000000001E0000-0x00000000001F0000-memory.dmp

Filesize
64KB

Download
memory/1972-7-0x0000000000460000-0x0000000000476000-memory.dmp

Filesize
88KB

Download
memory/1972-6-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download
memory/1972-5-0x0000000000180000-0x0000000000188000-memory.dmp

Filesize
32KB

Download
memory/1972-4-0x00000000001B0000-0x00000000001CC000-memory.dmp

Filesize
112KB

Download
memory/1972-3-0x000000001B670000-0x000000001B79E000-memory.dmp

Filesize
1.2MB

Download
memory/1972-2-0x000007FEF5140000-0x000007FEF5B2C000-memory.dmp

Filesize
9.9MB

Download
memory/1972-1-0x0000000000A00000-0x0000000000EF4000-memory.dmp

Filesize
5.0MB

Download