dcrat | 93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-10-2024 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
Size

4.9MB
MD5

8d6dfdefd799c9332221c796a6357d7d
SHA1

b4db624796583e409acabb081cbebc0a2b50c6a6
SHA256

93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587
SHA512

3118602bfe9b42a456319b0e8ed0df83974422bdb4edb59e37c5ea67a38b5411242ab114269aff7e325d880daedf93e55cab51cc74dfe63f66f2a661f5c01e58
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	332	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1188	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2804	schtasks.exe

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

csrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.execsrss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/2264-3-0x000000001B820000-0x000000001B94E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1328	powershell.exe
1696	powershell.exe
1260	powershell.exe
1888	powershell.exe
1608	powershell.exe
1104	powershell.exe
2088	powershell.exe
828	powershell.exe
2364	powershell.exe
1424	powershell.exe
1584	powershell.exe
2248	powershell.exe

Executes dropped EXE 12 IoCs

Processes:

csrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

pid	process
1908	csrss.exe
832	csrss.exe
2172	csrss.exe
2600	csrss.exe
2280	csrss.exe
2252	csrss.exe
976	csrss.exe
1696	csrss.exe
1680	csrss.exe
1164	csrss.exe
568	csrss.exe
2704	csrss.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

csrss.execsrss.execsrss.execsrss.exe93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe

Drops file in Program Files directory 24 IoCs

Processes:

93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe

description	ioc	process
File created	C:\Program Files\Windows Portable Devices\0a1fd5f707cd16	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Program Files\Windows Media Player\24dbde2999530e	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\RCX29FF.tmp	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\winlogon.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Program Files\Windows Portable Devices\RCX3982.tmp	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\cc11b995f2a76d	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Program Files\Windows Mail\fr-FR\0a1fd5f707cd16	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Program Files\Mozilla Firefox\fonts\smss.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Program Files\Windows Media Player\WmiPrvSE.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Program Files\Mozilla Firefox\fonts\RCX27FB.tmp	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Program Files\Windows Media Player\WmiPrvSE.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Program Files\Windows Portable Devices\sppsvc.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Program Files\Mozilla Firefox\fonts\69ddcba757bf72	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\winlogon.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\5940a34987c991	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Program Files\Windows Mail\fr-FR\sppsvc.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Program Files\Windows Portable Devices\sppsvc.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCX420E.tmp	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Program Files\Windows Media Player\RCX4A8A.tmp	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Program Files\Mozilla Firefox\fonts\smss.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Program Files\Windows Mail\fr-FR\sppsvc.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Program Files\Windows Mail\fr-FR\RCX4C8E.tmp	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe

Drops file in Windows directory 24 IoCs

Processes:

93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe

description	ioc	process
File created	C:\Windows\ModemLogs\wininit.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Windows\assembly\lsass.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Windows\AppPatch\it-IT\audiodg.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Windows\ModemLogs\1610b97d3ab4a7	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Windows\LiveKernelReports\101b941d020240	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Windows\AppPatch\it-IT\audiodg.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Windows\ModemLogs\56085415360792	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Windows\assembly\6203df4a6bafc7	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Windows\Setup\RCX2C81.tmp	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Windows\ModemLogs\RCX2EF2.tmp	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Windows\AppPatch\it-IT\RCX350D.tmp	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Windows\LiveKernelReports\lsm.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Windows\Setup\csrss.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Windows\AppPatch\it-IT\42af1c969fbb7b	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Windows\ModemLogs\OSPPSVC.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Windows\ModemLogs\wininit.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Windows\ModemLogs\RCX4411.tmp	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Windows\ModemLogs\OSPPSVC.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Windows\LiveKernelReports\RCX4615.tmp	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Windows\Setup\886983d96e3d3e	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File created	C:\Windows\LiveKernelReports\lsm.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Windows\Setup\csrss.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Windows\assembly\RCX3309.tmp	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
File opened for modification	C:\Windows\assembly\lsass.exe	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	process
2764	schtasks.exe
2824	schtasks.exe
1688	schtasks.exe
1164	schtasks.exe
1992	schtasks.exe
292	schtasks.exe
2924	schtasks.exe
924	schtasks.exe
2696	schtasks.exe
3048	schtasks.exe
2928	schtasks.exe
1852	schtasks.exe
1844	schtasks.exe
1868	schtasks.exe
1104	schtasks.exe
1632	schtasks.exe
884	schtasks.exe
2060	schtasks.exe
880	schtasks.exe
1492	schtasks.exe
2116	schtasks.exe
2220	schtasks.exe
2192	schtasks.exe
2092	schtasks.exe
1680	schtasks.exe
1732	schtasks.exe
2272	schtasks.exe
976	schtasks.exe
948	schtasks.exe
1684	schtasks.exe
2876	schtasks.exe
996	schtasks.exe
1200	schtasks.exe
2912	schtasks.exe
2600	schtasks.exe
2820	schtasks.exe
1012	schtasks.exe
2972	schtasks.exe
2452	schtasks.exe
2376	schtasks.exe
2068	schtasks.exe
2632	schtasks.exe
2012	schtasks.exe
1536	schtasks.exe
1656	schtasks.exe
1004	schtasks.exe
1820	schtasks.exe
332	schtasks.exe
2076	schtasks.exe
1432	schtasks.exe
1216	schtasks.exe
2704	schtasks.exe
2648	schtasks.exe
2564	schtasks.exe
1188	schtasks.exe
2524	schtasks.exe
1628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

pid	process
2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
2364	powershell.exe
1888	powershell.exe
1104	powershell.exe
1328	powershell.exe
1608	powershell.exe
1260	powershell.exe
2088	powershell.exe
2248	powershell.exe
1696	powershell.exe
1584	powershell.exe
1424	powershell.exe
828	powershell.exe
1908	csrss.exe
832	csrss.exe
2172	csrss.exe
2600	csrss.exe
2280	csrss.exe
2252	csrss.exe
976	csrss.exe
1696	csrss.exe
1680	csrss.exe
1164	csrss.exe
568	csrss.exe
2704	csrss.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	828	powershell.exe
Token: SeDebugPrivilege	1908	csrss.exe
Token: SeDebugPrivilege	832	csrss.exe
Token: SeDebugPrivilege	2172	csrss.exe
Token: SeDebugPrivilege	2600	csrss.exe
Token: SeDebugPrivilege	2280	csrss.exe
Token: SeDebugPrivilege	2252	csrss.exe
Token: SeDebugPrivilege	976	csrss.exe
Token: SeDebugPrivilege	1696	csrss.exe
Token: SeDebugPrivilege	1680	csrss.exe
Token: SeDebugPrivilege	1164	csrss.exe
Token: SeDebugPrivilege	568	csrss.exe
Token: SeDebugPrivilege	2704	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.execsrss.exeWScript.execsrss.exeWScript.execsrss.exeWScript.exe

description	pid	process	target process
PID 2264 wrote to memory of 828	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 828	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 828	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 2364	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 2364	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 2364	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1424	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1424	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1424	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1696	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1696	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1696	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1584	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1584	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1584	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1260	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1260	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1260	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1888	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1888	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1888	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 2248	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 2248	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 2248	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1608	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1608	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1608	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 2088	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 2088	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 2088	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1104	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1104	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1104	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1328	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1328	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1328	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	powershell.exe
PID 2264 wrote to memory of 1908	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	csrss.exe
PID 2264 wrote to memory of 1908	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	csrss.exe
PID 2264 wrote to memory of 1908	2264	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe	csrss.exe
PID 1908 wrote to memory of 772	1908	csrss.exe	WScript.exe
PID 1908 wrote to memory of 772	1908	csrss.exe	WScript.exe
PID 1908 wrote to memory of 772	1908	csrss.exe	WScript.exe
PID 1908 wrote to memory of 1568	1908	csrss.exe	WScript.exe
PID 1908 wrote to memory of 1568	1908	csrss.exe	WScript.exe
PID 1908 wrote to memory of 1568	1908	csrss.exe	WScript.exe
PID 772 wrote to memory of 832	772	WScript.exe	csrss.exe
PID 772 wrote to memory of 832	772	WScript.exe	csrss.exe
PID 772 wrote to memory of 832	772	WScript.exe	csrss.exe
PID 832 wrote to memory of 2744	832	csrss.exe	WScript.exe
PID 832 wrote to memory of 2744	832	csrss.exe	WScript.exe
PID 832 wrote to memory of 2744	832	csrss.exe	WScript.exe
PID 832 wrote to memory of 2732	832	csrss.exe	WScript.exe
PID 832 wrote to memory of 2732	832	csrss.exe	WScript.exe
PID 832 wrote to memory of 2732	832	csrss.exe	WScript.exe
PID 2744 wrote to memory of 2172	2744	WScript.exe	csrss.exe
PID 2744 wrote to memory of 2172	2744	WScript.exe	csrss.exe
PID 2744 wrote to memory of 2172	2744	WScript.exe	csrss.exe
PID 2172 wrote to memory of 924	2172	csrss.exe	WScript.exe
PID 2172 wrote to memory of 924	2172	csrss.exe	WScript.exe
PID 2172 wrote to memory of 924	2172	csrss.exe	WScript.exe
PID 2172 wrote to memory of 1012	2172	csrss.exe	WScript.exe
PID 2172 wrote to memory of 1012	2172	csrss.exe	WScript.exe
PID 2172 wrote to memory of 1012	2172	csrss.exe	WScript.exe
PID 924 wrote to memory of 2600	924	WScript.exe	csrss.exe

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

Processes:

csrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe
"C:\Users\Admin\AppData\Local\Temp\93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1328
- C:\Windows\Setup\csrss.exe
  "C:\Windows\Setup\csrss.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1908
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b51b7508-1371-4ccd-9762-721bdc97d582.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\Windows\Setup\csrss.exe
      C:\Windows\Setup\csrss.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:832
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\63bfb678-3ccf-4afd-9fd3-99aa605f09c1.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2744
      - C:\Windows\Setup\csrss.exe
        
        C:\Windows\Setup\csrss.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2172
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2600e141-e3ee-4981-a4c4-3f9f85a4ac24.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:924
        
        C:\Windows\Setup\csrss.exe
        
        C:\Windows\Setup\csrss.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0ddfdf25-6399-454d-adb4-b3952fa77d00.vbs"
        9⤵
        
        PID:2632
        
        C:\Windows\Setup\csrss.exe
        
        C:\Windows\Setup\csrss.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2280
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c38162b1-1f85-4eb6-a135-c0a7c3cae7d2.vbs"
        11⤵
        
        PID:536
        
        C:\Windows\Setup\csrss.exe
        
        C:\Windows\Setup\csrss.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2252
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5936cbbe-a6c7-42d6-9787-7c1930c53167.vbs"
        13⤵
        
        PID:2832
        
        C:\Windows\Setup\csrss.exe
        
        C:\Windows\Setup\csrss.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:976
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ab4e5c5f-ca07-4361-aaaa-b77381205662.vbs"
        15⤵
        
        PID:1720
        
        C:\Windows\Setup\csrss.exe
        
        C:\Windows\Setup\csrss.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\59124e63-5be2-41b0-91b1-3647c407b6e3.vbs"
        17⤵
        
        PID:2972
        
        C:\Windows\Setup\csrss.exe
        
        C:\Windows\Setup\csrss.exe
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05aac9cb-b6e9-4737-a218-fd95356a30eb.vbs"
        19⤵
        
        PID:2612
        
        C:\Windows\Setup\csrss.exe
        
        C:\Windows\Setup\csrss.exe
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1164
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad929c91-5010-41e6-b42e-e28683db750f.vbs"
        21⤵
        
        PID:2532
        
        C:\Windows\Setup\csrss.exe
        
        C:\Windows\Setup\csrss.exe
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:568
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4645f646-2343-48ec-99b8-6d46cd4abdba.vbs"
        23⤵
        
        PID:1260
        
        C:\Windows\Setup\csrss.exe
        
        C:\Windows\Setup\csrss.exe
        24⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2704
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9ea1d79-b67a-44f7-9ee2-8177d03aff68.vbs"
        25⤵
        
        PID:2816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\caac3ecd-0fd1-479e-8fbf-362d95e06936.vbs"
        25⤵
        
        PID:2296
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e0fb981d-ae31-4d2a-9ba2-f6d97a47e59b.vbs"
        23⤵
        
        PID:380
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cf0283ba-fdd7-4032-922d-95b8c1c6efaf.vbs"
        21⤵
        
        PID:2748
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89748976-6620-48b1-a8ff-b53ca6356e6f.vbs"
        19⤵
        
        PID:328
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d101c0d-500d-4ca0-8cb9-c3623d1322df.vbs"
        17⤵
        
        PID:1844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e33185b6-22c3-46e1-884c-87fab4bca066.vbs"
        15⤵
        
        PID:2892
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d47e0e1-7ad3-4a5c-8f42-15534e516b95.vbs"
        13⤵
        
        PID:2012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0171bb6-c6fb-4c3a-97d0-8cae35b9c4f7.vbs"
        11⤵
        
        PID:1684
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\111f4009-81e8-40e0-b5ae-201d6729e00e.vbs"
        9⤵
        
        PID:1020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eb3a61a2-e228-4fb8-bdec-cc49377d7970.vbs"
        7⤵
        
        PID:1012
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee643ac2-9d54-46c1-b490-eb5889ddb1c8.vbs"
        5⤵
        
        PID:2732
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e460de1-2495-443c-8bf9-ccd2c2e58396.vbs"
    3⤵
    PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\fonts\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\fonts\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\fonts\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\Setup\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Setup\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\Setup\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\ModemLogs\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\ModemLogs\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\ModemLogs\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Windows\assembly\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\assembly\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\assembly\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Windows\AppPatch\it-IT\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\AppPatch\it-IT\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Windows\AppPatch\it-IT\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Adobe\Acrobat\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Acrobat\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Adobe\Acrobat\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Windows\ModemLogs\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\ModemLogs\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Windows\ModemLogs\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Windows\LiveKernelReports\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Windows\LiveKernelReports\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Media Player\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\fr-FR\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\fr-FR\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\fr-FR\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\OSPPSVC.exe

Filesize
4.9MB

MD5
8d6dfdefd799c9332221c796a6357d7d

SHA1
b4db624796583e409acabb081cbebc0a2b50c6a6

SHA256
93a3114003ed7698411f3b78fab505c53012a6e8fdc669182756d03609cdd587

SHA512
3118602bfe9b42a456319b0e8ed0df83974422bdb4edb59e37c5ea67a38b5411242ab114269aff7e325d880daedf93e55cab51cc74dfe63f66f2a661f5c01e58

Download Submit
C:\Program Files\Windows Mail\fr-FR\RCX4C8E.tmp

Filesize
4.9MB

MD5
0c0fc386bf5a175843d7d4d8ca37ec10

SHA1
d1035c59c15b19e117881e1aa6570c5f7616391a

SHA256
fca4977ba1782b2f926562316675b00e9dd0e8cc331ae7f764dc641ec40b2cbd

SHA512
e19a42841aec593d35e4d02c22e8a4175ca9d1ef93ad9ac5bc99a88c1cd99d447c2ac5b74765df7bd2d3bf0a5c72e3bb7bf6475dc27d6f1018c487beb1ba97e3

Download Submit
C:\ProgramData\Adobe\Acrobat\RCX3FFA.tmp

Filesize
4.9MB

MD5
8812416da06d77ef4a3424e0240cdbe1

SHA1
501ed94db97b86d8c091825b4e0a0ecb9193646f

SHA256
f9567f37cef2d4dc459885ccfac42404f3134b8aae4b0cd9bad9ed15f92af284

SHA512
b9099e3a318c89ac3bc8a9d311a81beccd583174b5a9d2b3ae61286c21e47106b90647b9ce2c71634a93d33bc23b91d27ecf426af83ad153283f9e02288503b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\05aac9cb-b6e9-4737-a218-fd95356a30eb.vbs

Filesize
702B

MD5
40d0e02a312d0382577a158af00f6e59

SHA1
f9b93386647f7766df3f469ee951bb01df1f7989

SHA256
d097b6ed04e70ce93ac36c0a22ee69c6e1b108fb1eb390dbad9747781aed8d16

SHA512
dcfc3773e80c0dc5628fc11013e419b5bdaa54a2513afc5672c2a16de73a539dee764575257c5b3d0f52f1748041261335144211d8edeb51d98c8454d67eed75

Download Submit
C:\Users\Admin\AppData\Local\Temp\0ddfdf25-6399-454d-adb4-b3952fa77d00.vbs

Filesize
702B

MD5
f34ff8c0a63084b3d94c82e75cc16017

SHA1
f91f20ddff431dbcd62e460aac97d517fe66becb

SHA256
1cb01ce06c77a51e3064503485f9c2c708420a12fbcc187ff456a65aed7bd031

SHA512
f88eecdadad6811093053b3d273179dd87c2d4db78f627287a142dbe79c7a04314341c90d5bd90c733660b690e836d2ebe0043ef8a1218e2106d206e33df2b4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2600e141-e3ee-4981-a4c4-3f9f85a4ac24.vbs

Filesize
702B

MD5
6200c18f258dbc7db8d59ca726776428

SHA1
6a78f3b8846ed0da468c7809de7ec5d74e84fff7

SHA256
ac3ae96b595c2fd5c2f296668eebfed69291871a77a46b3dc9ac51c4f193e1cb

SHA512
a5ba74cfb68a8e24a13620ce15ead1f133f5c31994c666fbe87a0c033adea9c80e8369aa274e8715db61e9701c60b10f1af81614f92ae69a8a7e4197fd059c91

Download Submit
C:\Users\Admin\AppData\Local\Temp\4645f646-2343-48ec-99b8-6d46cd4abdba.vbs

Filesize
701B

MD5
b93dd8ca346de76304d0152484f1391c

SHA1
2d3c9f6121d5a687a0775d104c54862f7f9c8cd2

SHA256
e849e880b52c475566964b4c70d01944492c6194e9ec6f11e14a0f794edbef42

SHA512
07035b80b30b1645a4a832ee7fd4dcfede908eaf18d2cc2ef0a3d915f6463b72c9eb767b2b91be364a4753b5084230de4bcaefa9f4806cecf0040cd90117303f

Download Submit
C:\Users\Admin\AppData\Local\Temp\59124e63-5be2-41b0-91b1-3647c407b6e3.vbs

Filesize
702B

MD5
145e318088daa0e39e51e8ce25739175

SHA1
ebc099af0ae8aeecf79fe7f4710c75951b109a3d

SHA256
8f3757db8fd534564d3f9699e801fb8e133f014d6f8ed6394e29d92ccc0ba2ca

SHA512
38ac12adb79d1afc416af3f0c5e87461e6a5599352ebbdc3c586fcc36bb8d8d108da4dda58a7d14b8e91e963cd2e9f0c322f9312445070e98474130c45057ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\5936cbbe-a6c7-42d6-9787-7c1930c53167.vbs

Filesize
702B

MD5
6cda656416fe93ecae7cf4486a1ff20c

SHA1
8c7c651702b59389e32a593c2511293c8da737ae

SHA256
c358b64f2cbd7f3a2b90d347df709f0df90cad54043fbbb13c9e29194151d7d8

SHA512
5ab7f5b726ed199054d11df7df821066ef5295483f574251078189511be7d47493958fff155fc31ffc332563c453097624af39eaacf7333b087d566783c118d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\63bfb678-3ccf-4afd-9fd3-99aa605f09c1.vbs

Filesize
701B

MD5
cbf15174ef94a95b8aff51fc48f63f2e

SHA1
4bed5c3f8463711a9f7b39c0610686dfbc9803e6

SHA256
7fb4510a191a88dde19375da0830a0a24bc513acde46c671b5a616fb496cb212

SHA512
d52035195b7be406950c8e71efa4168c691206726c5911984d34b2b5aeb112b59dc9f5b28425493374eda9d688ac0119ca707cf247c848386ddc4e93cebe4279

Download Submit
C:\Users\Admin\AppData\Local\Temp\7e460de1-2495-443c-8bf9-ccd2c2e58396.vbs

Filesize
478B

MD5
ddda84c7ab20c3e1d72eba5704e7a6af

SHA1
fa8fb827e0dfb89abfffda05fe2a040c3b2e0376

SHA256
c1ce373d385f96eac15ab9371e36ab1faed45ae5e79ef570b2f9557f0285638a

SHA512
b196085177d6f594456fbc0ab9d918bd9ba7a8d91523cda93f661d937b9b024f7918cc7d0cdea238ff724e04ea4bd892e99edc026134b60bd7f09e29c267b699

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9ea1d79-b67a-44f7-9ee2-8177d03aff68.vbs

Filesize
702B

MD5
36cd4980903731cb2334071aa4b211e8

SHA1
39aacbf9421bc572410a3e45dd996dc193011308

SHA256
426d5794ef924151002ab3601c54753576b58fe764a98454b8da5118aed79ee2

SHA512
92993b923581e236b679b73b9efaefc36a90bd4bf3deb8b1188b10f9cf3a3bd0786f8fd23f24302912d5967d76ce5a7ddaedd403435ef7fc2e9a45890384d1d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ab4e5c5f-ca07-4361-aaaa-b77381205662.vbs

Filesize
701B

MD5
4634a258e378ce1703d99c71db772f00

SHA1
fce5a049e586a8ecec69bf5a8f3bc5e5e6e0713f

SHA256
9e7d64b91474a90dfab44daf9f635453cbde5136d46a5d3e0a6db3fe83653a16

SHA512
800175d50e32c668700d4be6d58a1bf2ce1cd90c8bc408407dcb331c83dfe3f0c076529878daa8c65206f96b3ff13e983b2ff233f454f4b42b5eea406e4f77f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ad929c91-5010-41e6-b42e-e28683db750f.vbs

Filesize
702B

MD5
7b1895020cc2c71b964b640cf6fdcab9

SHA1
cd507731527e98bd637d1571d7f93003a634bd6a

SHA256
baffd3ec6c36b055bfafff9914ce4e2eb392894ded6c720efe2f0f45fcf45b86

SHA512
2c7b20da94b041710994b6981f0950650f33f98fb06946a3a3da00128460f8bed2fe9d62ac10fcb12afe969140db1436f1b27bc6a7145bcf9849cfb0712181ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\b51b7508-1371-4ccd-9762-721bdc97d582.vbs

Filesize
702B

MD5
d944c47d1c00877bc646f7d1c8567aa3

SHA1
85d3db0e7c6e1bcc4d68352a86de78781fe296ab

SHA256
dbc15910e19c383c7b8594acaed5ad9325b8e6266b60b6a2cea2917952be5e8b

SHA512
c4c14809c1fc237b1feb4b36b4ea3e96c98032b3245134cdaaa81333de42a122d9f69cfe47c9c73dcb29bc7ae80a0b63254b9115d3d1b5bb2efb294d7a2c93aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\c38162b1-1f85-4eb6-a135-c0a7c3cae7d2.vbs

Filesize
702B

MD5
8509fa31dfea6aa07ede37707044dc0b

SHA1
92a8d26161c9f069e2c3a4fc0e35e7a4e13e7033

SHA256
e1879a68e30fd9d6c73b5d67d3b15062c595030c80265ba5f14cbfda6782b226

SHA512
fd1ebb745653fd3f88ace2b66e6acffcfb49e4633616949e3f2a65a445fc1dcdbb89ee869a82495732e8a628ab2b43eeda1099d8794a3dcedfe5d832ef25ff38

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5ED3.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
47bb620dd4c983ff38cc1eb1433960fa

SHA1
93c9cc6b4b8009bc4b5e40fa7011904914281075

SHA256
417bca50c0ee02d0c4d29c5b5558126e68621bc072ed191126b6300c6c1d71ca

SHA512
367431af3834c2494a7bfb35c1374fde62daa15e726441f4efe2c4c37def2dbce76a3a64d7dd7ccfb62c0ea4bd63fea8f2cabdb6dcd3c0a0e698772329667b91

Download Submit
C:\Windows\ModemLogs\RCX2EF2.tmp

Filesize
4.9MB

MD5
4410cce260d2c03f27e0246e416772ed

SHA1
2a7aa744a7639750bfcfd9a5f29069a031e40074

SHA256
6a40d00077a539def786632b93dad05ea91a0cf66514d7808918aab724ca1788

SHA512
625577cf4c74006b274bfb29ebf092b2b8114a1e5f9e2129b4b4441c74b532889beba05ceb11b46b8fb6a280df23a18f2fe8a167dc3bbb573f2e88edcbc15447

Download Submit
C:\Windows\Setup\csrss.exe

Filesize
4.9MB

MD5
7c4697f02649231498a5c61553373cb6

SHA1
57a8f5e90d7613a33df16374f80f6b5fc7d10ec9

SHA256
379d71c4397a1cc71c747a2c669c45f1b0b63f930e87b1e298d61673c513ad15

SHA512
d720152c42e6b8786543788ae051e2c0e51fd4648989dad14c25e4705e552695f9278775563b2a95e96e34a22700e53468c5518c0ce6549428dffb8a625149e8

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/568-387-0x00000000013B0000-0x00000000018A4000-memory.dmp

Filesize
5.0MB

Download
memory/568-388-0x00000000006A0000-0x00000000006B2000-memory.dmp

Filesize
72KB

Download
memory/832-252-0x0000000000790000-0x00000000007A2000-memory.dmp

Filesize
72KB

Download
memory/832-251-0x0000000000FC0000-0x00000000014B4000-memory.dmp

Filesize
5.0MB

Download
memory/976-327-0x0000000000E50000-0x0000000001344000-memory.dmp

Filesize
5.0MB

Download
memory/1164-372-0x0000000000310000-0x0000000000804000-memory.dmp

Filesize
5.0MB

Download
memory/1680-356-0x00000000011C0000-0x00000000016B4000-memory.dmp

Filesize
5.0MB

Download
memory/1680-357-0x0000000000520000-0x0000000000532000-memory.dmp

Filesize
72KB

Download
memory/1908-214-0x0000000000910000-0x0000000000E04000-memory.dmp

Filesize
5.0MB

Download
memory/1908-237-0x00000000023C0000-0x00000000023D2000-memory.dmp

Filesize
72KB

Download
memory/2172-267-0x0000000000BD0000-0x0000000000BE2000-memory.dmp

Filesize
72KB

Download
memory/2252-312-0x0000000000370000-0x0000000000864000-memory.dmp

Filesize
5.0MB

Download
memory/2264-6-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download
memory/2264-147-0x000007FEF6853000-0x000007FEF6854000-memory.dmp

Filesize
4KB

Download
memory/2264-12-0x0000000000B60000-0x0000000000B6E000-memory.dmp

Filesize
56KB

Download
memory/2264-162-0x000007FEF6850000-0x000007FEF723C000-memory.dmp

Filesize
9.9MB

Download
memory/2264-11-0x0000000000B50000-0x0000000000B5A000-memory.dmp

Filesize
40KB

Download
memory/2264-16-0x0000000000BA0000-0x0000000000BAC000-memory.dmp

Filesize
48KB

Download
memory/2264-1-0x0000000000F60000-0x0000000001454000-memory.dmp

Filesize
5.0MB

Download
memory/2264-10-0x0000000000B40000-0x0000000000B52000-memory.dmp

Filesize
72KB

Download
memory/2264-2-0x000007FEF6850000-0x000007FEF723C000-memory.dmp

Filesize
9.9MB

Download
memory/2264-15-0x0000000000B90000-0x0000000000B98000-memory.dmp

Filesize
32KB

Download
memory/2264-0-0x000007FEF6853000-0x000007FEF6854000-memory.dmp

Filesize
4KB

Download
memory/2264-13-0x0000000000B70000-0x0000000000B7E000-memory.dmp

Filesize
56KB

Download
memory/2264-3-0x000000001B820000-0x000000001B94E000-memory.dmp

Filesize
1.2MB

Download
memory/2264-4-0x0000000000AF0000-0x0000000000B0C000-memory.dmp

Filesize
112KB

Download
memory/2264-14-0x0000000000B80000-0x0000000000B88000-memory.dmp

Filesize
32KB

Download
memory/2264-9-0x0000000000B30000-0x0000000000B3A000-memory.dmp

Filesize
40KB

Download
memory/2264-8-0x0000000000540000-0x0000000000550000-memory.dmp

Filesize
64KB

Download
memory/2264-7-0x0000000000B10000-0x0000000000B26000-memory.dmp

Filesize
88KB

Download
memory/2264-216-0x000007FEF6850000-0x000007FEF723C000-memory.dmp

Filesize
9.9MB

Download
memory/2264-5-0x0000000000310000-0x0000000000318000-memory.dmp

Filesize
32KB

Download
memory/2280-297-0x0000000000200000-0x00000000006F4000-memory.dmp

Filesize
5.0MB

Download
memory/2364-196-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2364-198-0x0000000001E90000-0x0000000001E98000-memory.dmp

Filesize
32KB

Download
memory/2600-282-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Filesize
72KB

Download
memory/2704-403-0x0000000000630000-0x0000000000642000-memory.dmp

Filesize
72KB

Download