dcrat | a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
Size

4.9MB
MD5

28feb5efaafa67cef60ea0228eaaad26
SHA1

11f07fa02dad31c4209461451386796085235e66
SHA256

a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294
SHA512

0c3b5d70c06d01d0124bddadf15ee6df3a787a77eb786fe6438587ecc87291de0e3b5b1d5102f5228e6a944e88251b3bf4b584c236cda6d5c1cb947739a6be6c
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2548	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	2548	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2548	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2548	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2548	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	564	2548	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2548	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2548	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2548	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2548	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2548	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2548	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	2548	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2548	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	2548	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	2548	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	2548	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2548	schtasks.exe	31

UAC bypass 3 TTPs 33 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2652-3-0x000000001B3D0000-0x000000001B4FE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
404	powershell.exe
2360	powershell.exe
1016	powershell.exe
2096	powershell.exe
2396	powershell.exe
3060	powershell.exe
2440	powershell.exe
2076	powershell.exe
344	powershell.exe
2368	powershell.exe
2256	powershell.exe
2236	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
112	csrss.exe
1592	csrss.exe
2276	csrss.exe
1852	csrss.exe
1224	csrss.exe
2272	csrss.exe
2808	csrss.exe
2976	csrss.exe
2388	csrss.exe
1948	csrss.exe

Checks whether UAC is enabled 1 TTPs 22 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\27d1bcfc3c54e0	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\dwm.exe	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\6cb0b6c459d5d3	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
File opened for modification	C:\Program Files\Common Files\RCXFFA4.tmp	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\RCX5B1.tmp	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\dwm.exe	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
File created	C:\Program Files\Common Files\System.exe	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
File opened for modification	C:\Program Files\Common Files\System.exe	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\wininit.exe	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
File created	C:\Windows\ServiceProfiles\56085415360792	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
File opened for modification	C:\Windows\Resources\Themes\Aero\ja-JP\RCX1A8.tmp	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
File opened for modification	C:\Windows\Resources\Themes\Aero\ja-JP\csrss.exe	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
File opened for modification	C:\Windows\ServiceProfiles\RCX3AC.tmp	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
File opened for modification	C:\Windows\ServiceProfiles\wininit.exe	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
File created	C:\Windows\Resources\Themes\Aero\ja-JP\csrss.exe	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
File created	C:\Windows\Resources\Themes\Aero\ja-JP\886983d96e3d3e	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2580	schtasks.exe
2260	schtasks.exe
2332	schtasks.exe
3024	schtasks.exe
992	schtasks.exe
1932	schtasks.exe
2996	schtasks.exe
564	schtasks.exe
2840	schtasks.exe
2856	schtasks.exe
2084	schtasks.exe
2620	schtasks.exe
1936	schtasks.exe
1900	schtasks.exe
2520	schtasks.exe
2556	schtasks.exe
2804	schtasks.exe
2800	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
2396	powershell.exe
3060	powershell.exe
2360	powershell.exe
2256	powershell.exe
2368	powershell.exe
2236	powershell.exe
344	powershell.exe
404	powershell.exe
1016	powershell.exe
2096	powershell.exe
2076	powershell.exe
2440	powershell.exe
112	csrss.exe
1592	csrss.exe
2276	csrss.exe
1852	csrss.exe
1224	csrss.exe
2272	csrss.exe
2808	csrss.exe
2976	csrss.exe
2388	csrss.exe
1948	csrss.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	2236	powershell.exe
Token: SeDebugPrivilege	344	powershell.exe
Token: SeDebugPrivilege	404	powershell.exe
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	112	csrss.exe
Token: SeDebugPrivilege	1592	csrss.exe
Token: SeDebugPrivilege	2276	csrss.exe
Token: SeDebugPrivilege	1852	csrss.exe
Token: SeDebugPrivilege	1224	csrss.exe
Token: SeDebugPrivilege	2272	csrss.exe
Token: SeDebugPrivilege	2808	csrss.exe
Token: SeDebugPrivilege	2976	csrss.exe
Token: SeDebugPrivilege	2388	csrss.exe
Token: SeDebugPrivilege	1948	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2396	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	50
PID 2652 wrote to memory of 2396	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	50
PID 2652 wrote to memory of 2396	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	50
PID 2652 wrote to memory of 3060	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	51
PID 2652 wrote to memory of 3060	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	51
PID 2652 wrote to memory of 3060	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	51
PID 2652 wrote to memory of 2368	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	52
PID 2652 wrote to memory of 2368	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	52
PID 2652 wrote to memory of 2368	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	52
PID 2652 wrote to memory of 2256	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	54
PID 2652 wrote to memory of 2256	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	54
PID 2652 wrote to memory of 2256	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	54
PID 2652 wrote to memory of 2236	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	55
PID 2652 wrote to memory of 2236	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	55
PID 2652 wrote to memory of 2236	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	55
PID 2652 wrote to memory of 2440	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	58
PID 2652 wrote to memory of 2440	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	58
PID 2652 wrote to memory of 2440	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	58
PID 2652 wrote to memory of 2076	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	60
PID 2652 wrote to memory of 2076	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	60
PID 2652 wrote to memory of 2076	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	60
PID 2652 wrote to memory of 2360	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	61
PID 2652 wrote to memory of 2360	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	61
PID 2652 wrote to memory of 2360	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	61
PID 2652 wrote to memory of 404	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	62
PID 2652 wrote to memory of 404	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	62
PID 2652 wrote to memory of 404	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	62
PID 2652 wrote to memory of 1016	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	64
PID 2652 wrote to memory of 1016	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	64
PID 2652 wrote to memory of 1016	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	64
PID 2652 wrote to memory of 2096	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	65
PID 2652 wrote to memory of 2096	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	65
PID 2652 wrote to memory of 2096	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	65
PID 2652 wrote to memory of 344	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	67
PID 2652 wrote to memory of 344	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	67
PID 2652 wrote to memory of 344	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	67
PID 2652 wrote to memory of 112	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	74
PID 2652 wrote to memory of 112	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	74
PID 2652 wrote to memory of 112	2652	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe	74
PID 112 wrote to memory of 2500	112	csrss.exe	75
PID 112 wrote to memory of 2500	112	csrss.exe	75
PID 112 wrote to memory of 2500	112	csrss.exe	75
PID 112 wrote to memory of 304	112	csrss.exe	76
PID 112 wrote to memory of 304	112	csrss.exe	76
PID 112 wrote to memory of 304	112	csrss.exe	76
PID 2500 wrote to memory of 1592	2500	WScript.exe	77
PID 2500 wrote to memory of 1592	2500	WScript.exe	77
PID 2500 wrote to memory of 1592	2500	WScript.exe	77
PID 1592 wrote to memory of 1492	1592	csrss.exe	78
PID 1592 wrote to memory of 1492	1592	csrss.exe	78
PID 1592 wrote to memory of 1492	1592	csrss.exe	78
PID 1592 wrote to memory of 2828	1592	csrss.exe	79
PID 1592 wrote to memory of 2828	1592	csrss.exe	79
PID 1592 wrote to memory of 2828	1592	csrss.exe	79
PID 1492 wrote to memory of 2276	1492	WScript.exe	80
PID 1492 wrote to memory of 2276	1492	WScript.exe	80
PID 1492 wrote to memory of 2276	1492	WScript.exe	80
PID 2276 wrote to memory of 2640	2276	csrss.exe	81
PID 2276 wrote to memory of 2640	2276	csrss.exe	81
PID 2276 wrote to memory of 2640	2276	csrss.exe	81
PID 2276 wrote to memory of 1516	2276	csrss.exe	82
PID 2276 wrote to memory of 1516	2276	csrss.exe	82
PID 2276 wrote to memory of 1516	2276	csrss.exe	82
PID 2640 wrote to memory of 1852	2640	WScript.exe	83

System policy modification 1 TTPs 33 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe
"C:\Users\Admin\AppData\Local\Temp\a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:344
- C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
  "C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:112
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f7f58ca-dc68-447f-9103-d05d065cfe35.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
      C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1592
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7fc57b2a-d2a5-4494-965d-320629cfe322.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1492
      - C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
        
        C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2276
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9347a5bf-f3e2-4c4f-a182-1dc5676b21c2.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
        
        C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1852
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4fe8f8c7-aef6-404d-8b20-a3cda7e2e660.vbs"
        9⤵
        
        PID:3000
        
        C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
        
        C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1224
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6757d11-631c-4204-bee6-c500f6e4278f.vbs"
        11⤵
        
        PID:532
        
        C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
        
        C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d6e7e3e-da0f-420c-8543-8780341779b2.vbs"
        13⤵
        
        PID:2148
        
        C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
        
        C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\649c4afc-3449-410f-bd46-c6abd109ea8c.vbs"
        15⤵
        
        PID:1176
        
        C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
        
        C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2976
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\198eeaed-939d-461b-9944-fbbd460055a6.vbs"
        17⤵
        
        PID:316
        
        C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
        
        C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2388
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c116cfa9-fc5e-4ceb-86fb-93df5d5b6b21.vbs"
        19⤵
        
        PID:2312
        
        C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
        
        C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b78b63f7-a462-4d3e-808f-715754bc87c1.vbs"
        21⤵
        
        PID:2624
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cddd0145-49b6-467c-a691-3c77d164eb36.vbs"
        21⤵
        
        PID:336
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cb35d466-91cb-4355-83ad-85466a680463.vbs"
        19⤵
        
        PID:2732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\faf3e1ee-5cc5-461f-801b-44509f856c4b.vbs"
        17⤵
        
        PID:996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\439d810d-44eb-491b-9a49-dc22b1611cdf.vbs"
        15⤵
        
        PID:1660
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec908b77-b75e-4070-b487-d2ef43220fe9.vbs"
        13⤵
        
        PID:2860
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e969bc7-9b85-4457-a840-3dd9b8a5375d.vbs"
        11⤵
        
        PID:1152
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0026df66-dfc9-422b-84ca-d8d2a04c80c9.vbs"
        9⤵
        
        PID:3008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\150f3990-f344-47ea-9e19-41cce1e7eb0e.vbs"
        7⤵
        
        PID:1516
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23117cd7-d2d0-4f88-982d-f8a8398bfd9e.vbs"
        5⤵
        
        PID:2828
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a182efa-0637-4cf1-8361-f225337a407d.vbs"
    3⤵
    PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Common Files\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\Resources\Themes\Aero\ja-JP\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Resources\Themes\Aero\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\Resources\Themes\Aero\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\ServiceProfiles\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\ServiceProfiles\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\es-ES\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe

Filesize
4.9MB

MD5
28feb5efaafa67cef60ea0228eaaad26

SHA1
11f07fa02dad31c4209461451386796085235e66

SHA256
a14a650188cebc865e97fb3fd917fb6cc3e9efb30500bf45317994bc37c1a294

SHA512
0c3b5d70c06d01d0124bddadf15ee6df3a787a77eb786fe6438587ecc87291de0e3b5b1d5102f5228e6a944e88251b3bf4b584c236cda6d5c1cb947739a6be6c

Download Submit
C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe

Filesize
4.9MB

MD5
df6dafb7a350443e244b1d4902bd1aec

SHA1
3258fb76addf7fa4d9f83b8b166b3fda16ac7bf9

SHA256
4af8a55dfbd9bf011aeb38f30fe537a9317a6d7f975dcb8f91e3afb59c33d261

SHA512
f41cea335ae1faf199a5092bb8c027a6dd6fd5419633ca277824f2003aa6513d232fe76117d664e9aa349922f6a7fa6f3c4c88321083efb3fe40679cdfaff086

Download Submit
C:\Users\Admin\AppData\Local\Temp\0f7f58ca-dc68-447f-9103-d05d065cfe35.vbs

Filesize
733B

MD5
c5892f4857f5603438969b1e439be955

SHA1
50fa0665cb2487236fc9e7e704c1d8290b487d14

SHA256
245049eee694021894b91dd01410011c55d6f4df490c19a92984e4625a892cb6

SHA512
d93cb88f661639419001e22bebd47dab7ea7f07524c565f24771bea79ef7fdff9779fdbbd0f2a519c5236824dcad3793dbd61ff8a92eb418bff78971d61b3a26

Download Submit
C:\Users\Admin\AppData\Local\Temp\198eeaed-939d-461b-9944-fbbd460055a6.vbs

Filesize
734B

MD5
1a011cc7f3c6ddbb10ca348301623249

SHA1
6e408125f02eaf09273633a8ee6ad628144e9e60

SHA256
07dc8c2b39fa8085127dc6c636ee9360c60075fc03b94ff3b4fd1384193d9d9b

SHA512
098d366e6d3713dc972a57342e30d9454d1f2bb508041591d6160c48931ae02476bf3600a1073930037e605f5da5a037ed110d8161544896cf43aaeceeb6307f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2d6e7e3e-da0f-420c-8543-8780341779b2.vbs

Filesize
734B

MD5
bc5be9ba7ee713b14e109cf190614ed4

SHA1
8a8b8b7af7707aee9eb66f4f6bc6e94caf878330

SHA256
470cccf3c226c75b95f9f40eaa6e7a1c6fb986a9d87761c5dc96a0caf6ef3283

SHA512
53fbf8dfa8d2112ca49bd763ca5de2a95a7beaeca33abf75d09501c24993582dc590a26ad350c429b76f7496ca34d5982bffbc30b6964a4ca2d2ca48bbaa5d80

Download Submit
C:\Users\Admin\AppData\Local\Temp\4fe8f8c7-aef6-404d-8b20-a3cda7e2e660.vbs

Filesize
734B

MD5
12c59d9603be25ede6472b6e754357d4

SHA1
de80db6ca6c0859d514a4345c4694e6123087d09

SHA256
e2dbe49fdd2298280c74a98ae46a1bf43b7b7593c69053649ead3f70e117f0f5

SHA512
883368567db887d9fe4859deb29dec39913afa31dab21d1a7e9f336cb199d361b3cfb04f32a7eef9b97969ffe1849700bff3b81acbf6a83e8df092a7cdc7c65a

Download Submit
C:\Users\Admin\AppData\Local\Temp\649c4afc-3449-410f-bd46-c6abd109ea8c.vbs

Filesize
734B

MD5
1564aa05f49ae2087ba70a5999daaf1f

SHA1
9a02b469b813397b3db7df4b8d4ddc568e48a5f6

SHA256
f7d75eeb6a0764fddaf3bb498f20fcb1777678d476047a116244658ec88aa5e7

SHA512
c599adc64af771c881ca9a0b88a75dc5bbdf12da0f666d3d1ac2d3c66375667091f8f09d9574d05c41c4125030d9b5f4e476d1adbaee01cb4a90889f2e211b7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\6a182efa-0637-4cf1-8361-f225337a407d.vbs

Filesize
510B

MD5
2e483b6b9d866c6955ae28e48bda701a

SHA1
a7e53e4e6031d3ced592de04b717b8ace48a8297

SHA256
f46f7eee8b31cad8a57760e2f4376ad5bb1cd1b3d3c7f7390506a590f5b9185b

SHA512
f9272f8a76e1cdf227de79314e0d86150cafd97033fe208af5f6d0776005b5e17e2f1a8e4189e84ffc34f715df3e4036f1679b25de6b5ffd3b3e37816c0f304c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7fc57b2a-d2a5-4494-965d-320629cfe322.vbs

Filesize
734B

MD5
43f3b0ee712596a052d027561030493d

SHA1
66336dd4e5bbd775e9ce01980ea77a9e37a325ea

SHA256
a55c0194cfbddd867cf5ebd9636b02beb9239a9b04a44dd1d891f624dd2cb819

SHA512
bd29440b1d041c55b0c46725b2d7e39060fcf9225a52979bc4f5db492fb3618c9ab2c5376a0ac3771a913642283076739deccba8769dac13417a2c7a7b503b59

Download Submit
C:\Users\Admin\AppData\Local\Temp\9347a5bf-f3e2-4c4f-a182-1dc5676b21c2.vbs

Filesize
734B

MD5
64921cfbcc88783c2fd4981d63ee059a

SHA1
78056bf0b47bd7a59ba0a2f2468cfeeb98b0e41f

SHA256
a74b2678eddead94fcce0cbd9844c9168cb99bba7198890df7e05d82d0deb12e

SHA512
ce4f5372fa7779c887960b428b58b3bf6e7ef104e9ce3a053e28a78f7f9db089f3ef86dc82839c53e6f201c5d6fa84209cd39a5497ede16a55a95a74497f9449

Download Submit
C:\Users\Admin\AppData\Local\Temp\b78b63f7-a462-4d3e-808f-715754bc87c1.vbs

Filesize
734B

MD5
e91481d8ab8061d5b445ee1707363d45

SHA1
f35a8751a248507ed89f15fe938eafeb2cde239b

SHA256
7d73b955c461e83ed4a721d9c2db248c5d68905644afca260514bf8a303e55da

SHA512
f3f7d49d1389e4e4737b153961599f14120b5626131dc6f8623a848f445741ddd9ae82355f1cbd14335634657208eb9d04734483b0bb930b21e56c829239b36d

Download Submit
C:\Users\Admin\AppData\Local\Temp\c116cfa9-fc5e-4ceb-86fb-93df5d5b6b21.vbs

Filesize
734B

MD5
2c33a2ef456867a4b968c75c727abe91

SHA1
2cee344b963605257f46d941199a1627b0b76cbc

SHA256
26a5ab18da6b5c6c889fecb535637f498a7bf0c4f14c4d52fe15affbed1a2ba1

SHA512
3ec013051aa3b7811aa5ade5f14fd0103ba9117252486207162a667542d16eebd64c7695c62a0950377fbcafc8fc4c64d680e10f6a422fe4479693c5a583c7d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\c6757d11-631c-4204-bee6-c500f6e4278f.vbs

Filesize
734B

MD5
c7916800408bb8f14e172e9fbc203149

SHA1
aec24609108f6bc6fa8a98519a8fe2107ceb97ff

SHA256
0d73124545c2068266459fc91a85f644ba832311901f4499d5a6907cf2e638b4

SHA512
c54157eb5a46510319d8bbe10ac520a35bc31e43f5ad773b7212a0a9578f754ad8cb668002f01ff59a4e6172b4ffd0fea0920c6359cd076dbb2de2a90a0597bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1C66.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1b95fefa3fdd2e8563f00f6c87653e8b

SHA1
cdcfc126b61c3375efe6a70212caaec2bde6c9c2

SHA256
0c1857c3e494932a38f536cb35007e64bc9830ce098e15936efa5aafcbcfc536

SHA512
690cf1742a0b96b66f285885e17fcc9f595b61e907644bac06f96ce62b55ffef4aa5ad35efebca8b77d43891f1e3f21d4af48b1c0e3845d13b530f109505ab10

Download Submit
memory/112-111-0x0000000000CD0000-0x00000000011C4000-memory.dmp

Filesize
5.0MB

Download
memory/112-144-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/1592-158-0x0000000000410000-0x0000000000422000-memory.dmp

Filesize
72KB

Download
memory/1948-278-0x0000000000390000-0x0000000000884000-memory.dmp

Filesize
5.0MB

Download
memory/2272-217-0x0000000000200000-0x00000000006F4000-memory.dmp

Filesize
5.0MB

Download
memory/2276-174-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Filesize
72KB

Download
memory/2276-173-0x0000000001340000-0x0000000001834000-memory.dmp

Filesize
5.0MB

Download
memory/2388-263-0x0000000000A30000-0x0000000000A42000-memory.dmp

Filesize
72KB

Download
memory/2396-92-0x0000000001D00000-0x0000000001D08000-memory.dmp

Filesize
32KB

Download
memory/2396-91-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2652-13-0x0000000000AF0000-0x0000000000AFE000-memory.dmp

Filesize
56KB

Download
memory/2652-5-0x00000000002B0000-0x00000000002B8000-memory.dmp

Filesize
32KB

Download
memory/2652-10-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Filesize
72KB

Download
memory/2652-12-0x0000000000AE0000-0x0000000000AEE000-memory.dmp

Filesize
56KB

Download
memory/2652-9-0x0000000000810000-0x000000000081A000-memory.dmp

Filesize
40KB

Download
memory/2652-16-0x0000000000B20000-0x0000000000B2C000-memory.dmp

Filesize
48KB

Download
memory/2652-117-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

Filesize
9.9MB

Download
memory/2652-8-0x0000000000800000-0x0000000000810000-memory.dmp

Filesize
64KB

Download
memory/2652-7-0x00000000005D0000-0x00000000005E6000-memory.dmp

Filesize
88KB

Download
memory/2652-6-0x00000000005C0000-0x00000000005D0000-memory.dmp

Filesize
64KB

Download
memory/2652-0-0x000007FEF58C3000-0x000007FEF58C4000-memory.dmp

Filesize
4KB

Download
memory/2652-11-0x0000000000AD0000-0x0000000000ADA000-memory.dmp

Filesize
40KB

Download
memory/2652-1-0x0000000001350000-0x0000000001844000-memory.dmp

Filesize
5.0MB

Download
memory/2652-15-0x0000000000B10000-0x0000000000B18000-memory.dmp

Filesize
32KB

Download
memory/2652-4-0x0000000000290000-0x00000000002AC000-memory.dmp

Filesize
112KB

Download
memory/2652-2-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

Filesize
9.9MB

Download
memory/2652-3-0x000000001B3D0000-0x000000001B4FE000-memory.dmp

Filesize
1.2MB

Download
memory/2652-14-0x0000000000B00000-0x0000000000B08000-memory.dmp

Filesize
32KB

Download
memory/2808-233-0x0000000000B40000-0x0000000000B52000-memory.dmp

Filesize
72KB

Download
memory/2808-232-0x0000000000E10000-0x0000000001304000-memory.dmp

Filesize
5.0MB

Download
memory/2976-248-0x00000000011D0000-0x00000000016C4000-memory.dmp

Filesize
5.0MB

Download