dcrat | 76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154b

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 05:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
Size

4.9MB
MD5

028bdc90907407e6347ed647ec3a4520
SHA1

a4666b332fa2086a2367fca57e8f8516f661703f
SHA256

76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154b
SHA512

a98b624d5a480fe88d23a0c11f52bf16c9f7631d1f0a4d8eb1255b1da325c8a78b997b75c43d79c6b16a1d9b6704315b931eba826ee0266487b099244a2a852e
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	496	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	2056	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2056	schtasks.exe	28

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2964-2-0x000000001B580000-0x000000001B6AE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1940	powershell.exe
2632	powershell.exe
2624	powershell.exe
2588	powershell.exe
1848	powershell.exe
2768	powershell.exe
1060	powershell.exe
1184	powershell.exe
2708	powershell.exe
2608	powershell.exe
1756	powershell.exe
2404	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2596	winlogon.exe
2088	winlogon.exe
2248	winlogon.exe
1576	winlogon.exe
848	winlogon.exe
2396	winlogon.exe
316	winlogon.exe
1036	winlogon.exe
2756	winlogon.exe
704	winlogon.exe
2816	winlogon.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\Windows NT\Accessories\fr-FR\winlogon.exe	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File created	C:\Program Files\Windows NT\Accessories\fr-FR\cc11b995f2a76d	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\dwm.exe	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\csrss.exe	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\RCXAC54.tmp	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\fr-FR\RCX932D.tmp	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\fr-FR\winlogon.exe	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\RCXAE58.tmp	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\audiodg.exe	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\RCX9BAA.tmp	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\audiodg.exe	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\csrss.exe	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0b1ac2d643d50b	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\6cb0b6c459d5d3	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\886983d96e3d3e	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\42af1c969fbb7b	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\RCXAA50.tmp	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\dwm.exe	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Panther\taskhost.exe	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File created	C:\Windows\Panther\b75386f1303e64	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File opened for modification	C:\Windows\Panther\RCXB260.tmp	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
File opened for modification	C:\Windows\Panther\taskhost.exe	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
756	schtasks.exe
1100	schtasks.exe
2936	schtasks.exe
2036	schtasks.exe
1448	schtasks.exe
1952	schtasks.exe
2060	schtasks.exe
2888	schtasks.exe
2644	schtasks.exe
2480	schtasks.exe
2512	schtasks.exe
1772	schtasks.exe
1964	schtasks.exe
2812	schtasks.exe
2536	schtasks.exe
2608	schtasks.exe
1908	schtasks.exe
2824	schtasks.exe
2316	schtasks.exe
2464	schtasks.exe
1552	schtasks.exe
2744	schtasks.exe
3012	schtasks.exe
2696	schtasks.exe
2364	schtasks.exe
1152	schtasks.exe
1500	schtasks.exe
1056	schtasks.exe
1996	schtasks.exe
1968	schtasks.exe
1228	schtasks.exe
2840	schtasks.exe
1852	schtasks.exe
1884	schtasks.exe
1556	schtasks.exe
2312	schtasks.exe
544	schtasks.exe
2436	schtasks.exe
2504	schtasks.exe
2684	schtasks.exe
2940	schtasks.exe
2652	schtasks.exe
2424	schtasks.exe
496	schtasks.exe
2412	schtasks.exe
2864	schtasks.exe
1292	schtasks.exe
1708	schtasks.exe
1800	schtasks.exe
2148	schtasks.exe
2328	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
1060	powershell.exe
2768	powershell.exe
1940	powershell.exe
2608	powershell.exe
1184	powershell.exe
2596	winlogon.exe
1756	powershell.exe
2708	powershell.exe
2624	powershell.exe
2632	powershell.exe
2588	powershell.exe
1848	powershell.exe
2404	powershell.exe
2248	winlogon.exe
1576	winlogon.exe
848	winlogon.exe
2396	winlogon.exe
316	winlogon.exe
1036	winlogon.exe
2756	winlogon.exe
704	winlogon.exe
2816	winlogon.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeDebugPrivilege	2596	winlogon.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	1184	powershell.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	2248	winlogon.exe
Token: SeDebugPrivilege	1576	winlogon.exe
Token: SeDebugPrivilege	848	winlogon.exe
Token: SeDebugPrivilege	2396	winlogon.exe
Token: SeDebugPrivilege	316	winlogon.exe
Token: SeDebugPrivilege	1036	winlogon.exe
Token: SeDebugPrivilege	2756	winlogon.exe
Token: SeDebugPrivilege	704	winlogon.exe
Token: SeDebugPrivilege	2816	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2624	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	80
PID 2964 wrote to memory of 2624	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	80
PID 2964 wrote to memory of 2624	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	80
PID 2964 wrote to memory of 1184	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	81
PID 2964 wrote to memory of 1184	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	81
PID 2964 wrote to memory of 1184	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	81
PID 2964 wrote to memory of 1060	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	82
PID 2964 wrote to memory of 1060	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	82
PID 2964 wrote to memory of 1060	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	82
PID 2964 wrote to memory of 2632	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	83
PID 2964 wrote to memory of 2632	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	83
PID 2964 wrote to memory of 2632	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	83
PID 2964 wrote to memory of 2404	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	86
PID 2964 wrote to memory of 2404	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	86
PID 2964 wrote to memory of 2404	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	86
PID 2964 wrote to memory of 1940	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	87
PID 2964 wrote to memory of 1940	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	87
PID 2964 wrote to memory of 1940	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	87
PID 2964 wrote to memory of 2768	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	89
PID 2964 wrote to memory of 2768	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	89
PID 2964 wrote to memory of 2768	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	89
PID 2964 wrote to memory of 1848	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	90
PID 2964 wrote to memory of 1848	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	90
PID 2964 wrote to memory of 1848	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	90
PID 2964 wrote to memory of 1756	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	91
PID 2964 wrote to memory of 1756	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	91
PID 2964 wrote to memory of 1756	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	91
PID 2964 wrote to memory of 2588	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	92
PID 2964 wrote to memory of 2588	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	92
PID 2964 wrote to memory of 2588	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	92
PID 2964 wrote to memory of 2608	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	93
PID 2964 wrote to memory of 2608	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	93
PID 2964 wrote to memory of 2608	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	93
PID 2964 wrote to memory of 2708	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	95
PID 2964 wrote to memory of 2708	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	95
PID 2964 wrote to memory of 2708	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	95
PID 2964 wrote to memory of 2596	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	100
PID 2964 wrote to memory of 2596	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	100
PID 2964 wrote to memory of 2596	2964	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe	100
PID 2596 wrote to memory of 2488	2596	winlogon.exe	105
PID 2596 wrote to memory of 2488	2596	winlogon.exe	105
PID 2596 wrote to memory of 2488	2596	winlogon.exe	105
PID 2596 wrote to memory of 2648	2596	winlogon.exe	106
PID 2596 wrote to memory of 2648	2596	winlogon.exe	106
PID 2596 wrote to memory of 2648	2596	winlogon.exe	106
PID 2488 wrote to memory of 2088	2488	WScript.exe	109
PID 2488 wrote to memory of 2088	2488	WScript.exe	109
PID 2488 wrote to memory of 2088	2488	WScript.exe	109
PID 2580 wrote to memory of 2248	2580	WScript.exe	112
PID 2580 wrote to memory of 2248	2580	WScript.exe	112
PID 2580 wrote to memory of 2248	2580	WScript.exe	112
PID 2248 wrote to memory of 3028	2248	winlogon.exe	113
PID 2248 wrote to memory of 3028	2248	winlogon.exe	113
PID 2248 wrote to memory of 3028	2248	winlogon.exe	113
PID 2248 wrote to memory of 1544	2248	winlogon.exe	114
PID 2248 wrote to memory of 1544	2248	winlogon.exe	114
PID 2248 wrote to memory of 1544	2248	winlogon.exe	114
PID 3028 wrote to memory of 1576	3028	WScript.exe	115
PID 3028 wrote to memory of 1576	3028	WScript.exe	115
PID 3028 wrote to memory of 1576	3028	WScript.exe	115
PID 1576 wrote to memory of 1732	1576	winlogon.exe	116
PID 1576 wrote to memory of 1732	1576	winlogon.exe	116
PID 1576 wrote to memory of 1732	1576	winlogon.exe	116
PID 1576 wrote to memory of 2872	1576	winlogon.exe	117

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe
"C:\Users\Admin\AppData\Local\Temp\76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe
  "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2596
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2385680d-a413-42b1-9614-119b70f603f8.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe
      "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      System policy modification
      PID:2088
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5dec602-b972-4e5b-9b4f-5bd4770e4b32.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2580
      - C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2248
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42019158-49b2-4fec-84d3-f2b8c53a555e.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1576
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\11f27b04-cfa0-4351-8eb9-537e97ea01ac.vbs"
        9⤵
        
        PID:1732
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4452ee3b-790f-40b0-b5df-66143467e2c1.vbs"
        11⤵
        
        PID:2508
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2396
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb24eb54-11d2-411e-be8b-59965f1cc6fa.vbs"
        13⤵
        
        PID:2488
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:316
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bba0873c-a788-4649-a88d-fd299266a00b.vbs"
        15⤵
        
        PID:1100
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2de27d9a-7336-4734-82fe-a4e4a42f3bc1.vbs"
        17⤵
        
        PID:880
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe"
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2756
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce638e2a-0067-4e59-bb11-bfbc6da01721.vbs"
        19⤵
        
        PID:2528
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe"
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:704
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1f314130-28a4-4608-9c80-1592dd575a65.vbs"
        21⤵
        
        PID:1584
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe"
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\85cb747e-e847-4cb1-a194-3eac04a29834.vbs"
        23⤵
        
        PID:2096
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b60ca5f1-5b11-43db-9cc3-95ba87698750.vbs"
        23⤵
        
        PID:2676
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1b05f002-e642-429d-b8fd-0b7355a486cd.vbs"
        21⤵
        
        PID:1784
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6c4ca29c-db96-420d-9cfd-db11bc8b7808.vbs"
        19⤵
        
        PID:2728
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\957c9c55-8beb-44e9-bfc4-1295228ec861.vbs"
        17⤵
        
        PID:3004
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ccbc0e89-851c-4cd1-9c80-71beac683c4f.vbs"
        15⤵
        
        PID:556
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\929edbf2-26a3-47b5-b47b-4bfcffbbacc5.vbs"
        13⤵
        
        PID:1132
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ff485ba0-4b2c-4b3e-83f9-26017f8482cf.vbs"
        11⤵
        
        PID:2168
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6bcc2d6f-4a61-481e-a31f-883b482e8af9.vbs"
        9⤵
        
        PID:2872
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b6762dba-3ac3-4683-8955-188ce893393f.vbs"
        7⤵
        
        PID:1544
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0aadb6d3-7016-45a4-a889-7bd140d2da74.vbs"
        5⤵
        
        PID:2068
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\68f5091f-a8b2-4701-b4f7-743b164939d7.vbs"
    3⤵
    PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\Accessories\fr-FR\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\fr-FR\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\Accessories\fr-FR\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN7" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN7" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154bN.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\SendTo\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\SendTo\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Default User\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\Public\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Users\Public\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Windows\Panther\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\Panther\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Windows\Panther\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\RCXA83D.tmp

Filesize
4.9MB

MD5
a9fb675ae8af51d9bf73d6c505d50884

SHA1
49fc5ad4863e6579b7197a8ba7370db2995a1650

SHA256
6815e7af0b18f78a3ee0a6ef89984b92e6c57cc27e321c0c43dc7ab655eae965

SHA512
57d0db1a0087b898f494bff4f0b2e449981ea7e4171f307d9f69e6a07a1ab59f58984d485172592f40766bc767dab8bb21b76b866d895c5c2e3d8858ff530956

Download Submit
C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe

Filesize
4.9MB

MD5
028bdc90907407e6347ed647ec3a4520

SHA1
a4666b332fa2086a2367fca57e8f8516f661703f

SHA256
76a824876f1d947fb290138a601306849881effd0871fb2d7baf5b7f7922154b

SHA512
a98b624d5a480fe88d23a0c11f52bf16c9f7631d1f0a4d8eb1255b1da325c8a78b997b75c43d79c6b16a1d9b6704315b931eba826ee0266487b099244a2a852e

Download Submit
C:\Users\Admin\AppData\Local\Temp\11f27b04-cfa0-4351-8eb9-537e97ea01ac.vbs

Filesize
751B

MD5
0cae0ec1d7ad4342d3ef28265b45de01

SHA1
f304a3279565ff006f7f0c1567ccdd597dc7484d

SHA256
73bbe9f1f82e531e154e8de8673bac0408a0f3f5d7e15a93df58a7facd4cf897

SHA512
2549dec5e30214c12369cda1312f575231487bc28870baf04e4c8851fa848c4246e2b72a70e7a26c0edb9163b740af5b9510e5772297086cee6ecddbc542972b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1f314130-28a4-4608-9c80-1592dd575a65.vbs

Filesize
750B

MD5
03f5b8e1f9a8dcdea04ec42c02666c6b

SHA1
2391c9b20bd3eeb2e0bd87ba498af931e5a5bf2d

SHA256
5f8fc5daff78c1ee87cbd8234aadd55dc614b40f4074546fff7a31430e2d05e8

SHA512
d1bde5e3b9e1ec248ebaa9a34b2996c7a0adef3a68902fb705546339afa76b639e31aef9bb4b97d61b7a10078bcc9afe7c1800f4376edbec0d4125658f8cd185

Download Submit
C:\Users\Admin\AppData\Local\Temp\2385680d-a413-42b1-9614-119b70f603f8.vbs

Filesize
751B

MD5
0b8da6a5b3330cf6e60ab67032386ed9

SHA1
9f5cbb39a6087b6c439cba44d36c94678eae1d1c

SHA256
3f1563d44d176885f01824bc06823e15af07314fb5fce8d639e76847123da878

SHA512
c689e80fd688e506275a9eeb8b4081c89ea689f30cc2ab1287e22eee29b5dae4cda546a26a47d1400b2947cc511432e60501a2b9755c83a2c555a1194c5a9668

Download Submit
C:\Users\Admin\AppData\Local\Temp\2de27d9a-7336-4734-82fe-a4e4a42f3bc1.vbs

Filesize
751B

MD5
bb1904cd3c1c80e808a6704adf8f5281

SHA1
613c5040e6af6b9c4295315e0bda282d63eb73d7

SHA256
5423ddafde261e0b47d5a0741dcba838650c6038f4d70307afbe3896fdd885bb

SHA512
2dfc594fd50c964c8a53446e5c26a57c4fdc82a63d072cf4e21cbf48214655497e6c554afec1ae9ea6c10922e924611a833f5498ade928a6c800f55b7d670e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\42019158-49b2-4fec-84d3-f2b8c53a555e.vbs

Filesize
751B

MD5
211c36e98d45a06fcad6e58779c618f2

SHA1
648df55dd41f43be544a7922dcad4b7bd9e8c277

SHA256
607cd5d73e79e94c6a4fa472c1b36d8c6c03e3d64a9919885f0a3dc392bb4781

SHA512
01a07222ccab0c4bb70ce8c15560738108ee6d28ba14e6980ceb1dd025a67b624fef27ec81fbb095f4e76671073ee678c80a93a5c2cd0c5075915f43409e2670

Download Submit
C:\Users\Admin\AppData\Local\Temp\4452ee3b-790f-40b0-b5df-66143467e2c1.vbs

Filesize
750B

MD5
d72cf0dfce1fd47111a1f069db611b83

SHA1
7bdadf07343c5013346e3e06966f8e5f442b2b2a

SHA256
222f5898d0a1ab68747e817653e76a7b7f8d6db028890c34a847a2f53dd482a8

SHA512
efdd9e4fbef59ea0ab2b0e54acc0782b13c76e8a4246edbc7ebc16dee05a9cb951ef7431b3d510715f8b81177a06169842db9a4f0c3b2edd55d2c48cf188a330

Download Submit
C:\Users\Admin\AppData\Local\Temp\68f5091f-a8b2-4701-b4f7-743b164939d7.vbs

Filesize
527B

MD5
a1687cf85a6b2ecf0e4d54558759a0d1

SHA1
923e06fa335ce0dbb455000161e0ef5b68950a99

SHA256
89acdeb61c597f6df3e6b2be4ab1a849bf2c6753ddd7301369e635ee02338721

SHA512
a93e438836377306a13b4749df71a1cb080e0e56c788969e50c2ff44d2930f1894caea56bd314fbb1a9102f8a2b41d5da26ec089c7ab666f2bda88b32c112c34

Download Submit
C:\Users\Admin\AppData\Local\Temp\85cb747e-e847-4cb1-a194-3eac04a29834.vbs

Filesize
751B

MD5
02e9bf9f3b78db8eb44cb966cac672fa

SHA1
473fa3057293e78f6215494ab7c97c237b969947

SHA256
05ea148c5b9f3b0e2c029576665ea161c987fa484a79673917fda934ee3fe176

SHA512
4c19d889da22595a9ad497d28cf7e744579085a9e1ad422efc621cb8cd0b1c7ad1d01f9189c87595ed769b2d6542e3e449577b336d66a3ef4fe09d6f4d9dfde0

Download Submit
C:\Users\Admin\AppData\Local\Temp\bb24eb54-11d2-411e-be8b-59965f1cc6fa.vbs

Filesize
751B

MD5
9aa18baacb6820a6e168aaffa039c573

SHA1
0f160045e784f087dc73e053b9920b8a5893d930

SHA256
40ef7e21d1b8b6fdc4ef3afe782a27d651e7ac3d50e8dde7493111c6d2f091b8

SHA512
6d3694103c1f1af0c4b5d0aebfe2f4f3d75f922f06f23af999de4afe25da96c139b5cc23baea0e7a35398d4ffe9660aa7ec76a598268a675d5b1ff7e2927e917

Download Submit
C:\Users\Admin\AppData\Local\Temp\bba0873c-a788-4649-a88d-fd299266a00b.vbs

Filesize
750B

MD5
935970144620e4b3b727983f700826d1

SHA1
33ca654fe8e80275cb4913ea8810e18b7d4de612

SHA256
e18b5aaf5bf921e7c24b1545347c986d86674b8bae62eeb476aa0c912b94f3d2

SHA512
4242c22675a2e2675739d36e529ff5b095e61b8568a83d3c167bb92acb1325f1a54c14c3be07ad0f4ad6f41893b00879b297b6df22a42abbd14a88698e828dad

Download Submit
C:\Users\Admin\AppData\Local\Temp\ce638e2a-0067-4e59-bb11-bfbc6da01721.vbs

Filesize
751B

MD5
481a6c55cc88d4c63bfc6b16c3f77da9

SHA1
9ee9efac0512761d1895efdc195e3622d876777f

SHA256
3128acd499379b89ecf92267a436899476dced49b681d4d2e93409bcd0060f94

SHA512
bdef9aaa23a525694c6ca19880c9c87f3766945c2a181b488d5703a07d17064a2ddd12db6071df18397e270b5fa755bfcab142ceb39391a05400ddf9f93e5319

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC1F8.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
610a8f4a21c4317f98fd53c880d8118d

SHA1
9a6a06bb807eaa8c0a20e4eb6102c25e001367ff

SHA256
5320f5f97a4bfa555893361656f1a75322aedb14a8a81b47561cf6dc3d4602cc

SHA512
e88c4baac763792d20dfacdec10dacaa91ba245a4aa35b44802d7644cc124698064de84da3671284945e5e83ac53ac42b131284c05ecc276a2ab5e1f320e5370

Download Submit
memory/316-307-0x00000000003E0000-0x00000000008D4000-memory.dmp

Filesize
5.0MB

Download
memory/704-353-0x0000000001350000-0x0000000001844000-memory.dmp

Filesize
5.0MB

Download
memory/1036-322-0x0000000000FD0000-0x00000000014C4000-memory.dmp

Filesize
5.0MB

Download
memory/1060-183-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/1060-185-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2248-249-0x00000000013A0000-0x0000000001894000-memory.dmp

Filesize
5.0MB

Download
memory/2396-292-0x0000000000080000-0x0000000000574000-memory.dmp

Filesize
5.0MB

Download
memory/2756-337-0x00000000002B0000-0x00000000007A4000-memory.dmp

Filesize
5.0MB

Download
memory/2756-338-0x0000000000880000-0x0000000000892000-memory.dmp

Filesize
72KB

Download
memory/2964-0-0x000007FEF5CF3000-0x000007FEF5CF4000-memory.dmp

Filesize
4KB

Download
memory/2964-9-0x0000000000710000-0x000000000071A000-memory.dmp

Filesize
40KB

Download
memory/2964-12-0x0000000000B50000-0x0000000000B5E000-memory.dmp

Filesize
56KB

Download
memory/2964-14-0x0000000000D70000-0x0000000000D78000-memory.dmp

Filesize
32KB

Download
memory/2964-15-0x0000000000E00000-0x0000000000E08000-memory.dmp

Filesize
32KB

Download
memory/2964-16-0x0000000000E10000-0x0000000000E1C000-memory.dmp

Filesize
48KB

Download
memory/2964-13-0x0000000000B60000-0x0000000000B6E000-memory.dmp

Filesize
56KB

Download
memory/2964-10-0x0000000000720000-0x0000000000732000-memory.dmp

Filesize
72KB

Download
memory/2964-168-0x000007FEF5CF0000-0x000007FEF66DC000-memory.dmp

Filesize
9.9MB

Download
memory/2964-11-0x0000000000730000-0x000000000073A000-memory.dmp

Filesize
40KB

Download
memory/2964-7-0x00000000006F0000-0x0000000000706000-memory.dmp

Filesize
88KB

Download
memory/2964-8-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/2964-6-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/2964-5-0x00000000003C0000-0x00000000003C8000-memory.dmp

Filesize
32KB

Download
memory/2964-154-0x000007FEF5CF3000-0x000007FEF5CF4000-memory.dmp

Filesize
4KB

Download
memory/2964-187-0x000007FEF5CF0000-0x000007FEF66DC000-memory.dmp

Filesize
9.9MB

Download
memory/2964-4-0x00000000003A0000-0x00000000003BC000-memory.dmp

Filesize
112KB

Download
memory/2964-3-0x000007FEF5CF0000-0x000007FEF66DC000-memory.dmp

Filesize
9.9MB

Download
memory/2964-2-0x000000001B580000-0x000000001B6AE000-memory.dmp

Filesize
1.2MB

Download
memory/2964-1-0x0000000001160000-0x0000000001654000-memory.dmp

Filesize
5.0MB

Download