dcrat | fcc7ce0c1cf2c3d90bef0d564fcb9ac13631d73dd516a4e32f01ecd3ea9bcda9

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2024, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
622C4B85AC8B720CEA2D247B615410EA.exe
Size 3.3MB
Sample241019-p3gbmayeql
SHA256 fcc7ce0c1cf2c3d90bef0d564fcb9ac13631d73dd516a4e32f01ecd3ea9bcda9
MD5 622c4b85ac8b720cea2d247b615410ea
SHA1 af51dc4aa33cab13eb7bd1d633c9ca1e008f4021
SHA512 2b3735ec49f67d9a76b524fe6a65d7947c48f8c36918cdbc9b218db5b362c9a3f0bdc8058834ce073e998b40be025a534fa5fb6e6fb24b99f0e92313c74ad07f
SSDEEP 49152:Yqcgj17YRt2uT8OgCR4N5K1fj6oLUPqu/T7XM9d9s0pY87oWSZxrAXQ/EFjE67Ku:Yvgj1g2uT8i2M1Pub7c9d9f6dZxodE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\Idle.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\csrss.exe\", \"C:\\Users\\Public\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\lua\\intf\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\Idle.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\csrss.exe\", \"C:\\Users\\Public\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\lua\\intf\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\explorer.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\sppsvc.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\Idle.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\csrss.exe\", \"C:\\Users\\Public\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\lua\\intf\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\explorer.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\sppsvc.exe\", \"C:\\Users\\Default\\Registry.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\Idle.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\csrss.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\Idle.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\csrss.exe\", \"C:\\Users\\Public\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\Idle.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\csrss.exe\", \"C:\\Users\\Public\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\lua\\intf\\fontdrvhost.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\Idle.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\csrss.exe\", \"C:\\Users\\Public\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\lua\\intf\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\Idle.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\csrss.exe\", \"C:\\Users\\Public\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\lua\\intf\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\explorer.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\Idle.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\Idle.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\csrss.exe\", \"C:\\Users\\Public\\StartMenuExperienceHost.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\Idle.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\csrss.exe\", \"C:\\Users\\Public\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\Idle.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\csrss.exe\", \"C:\\Users\\Public\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\lua\\intf\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4740	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3316	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3480	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	1388	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	1388	schtasks.exe	87

UAC bypass 3 TTPs 42 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/5052-1-0x0000000000650000-0x00000000009AE000-memory.dmp	dcrat
behavioral2/files/0x0007000000023ca9-47.dat	dcrat

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	622C4B85AC8B720CEA2D247B615410EA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	csrss.exe

Executes dropped EXE 13 IoCs

pid	Process
4088	csrss.exe
4824	csrss.exe
4392	csrss.exe
1516	csrss.exe
5104	csrss.exe
4848	csrss.exe
1092	csrss.exe
4176	csrss.exe
4596	csrss.exe
4844	csrss.exe
2172	csrss.exe
3528	csrss.exe
2540	csrss.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\DigitalLocker\\en-US\\csrss.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\DigitalLocker\\en-US\\csrss.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\VideoLAN\\VLC\\lua\\intf\\fontdrvhost.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Default\\Registry.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows Portable Devices\\Idle.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Users\\Public\\StartMenuExperienceHost.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Users\\Public\\StartMenuExperienceHost.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\VideoLAN\\VLC\\lua\\intf\\fontdrvhost.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\sppsvc.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Default\\Registry.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows Portable Devices\\Idle.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\explorer.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\explorer.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\sppsvc.exe\""	622C4B85AC8B720CEA2D247B615410EA.exe

Checks whether UAC is enabled 1 TTPs 28 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	622C4B85AC8B720CEA2D247B615410EA.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\dllhost.exe	622C4B85AC8B720CEA2D247B615410EA.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\explorer.exe	622C4B85AC8B720CEA2D247B615410EA.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\0a1fd5f707cd16	622C4B85AC8B720CEA2D247B615410EA.exe
File created	C:\Program Files (x86)\Windows Portable Devices\6ccacd8608530f	622C4B85AC8B720CEA2D247B615410EA.exe
File created	C:\Program Files (x86)\Windows Portable Devices\explorer.exe	622C4B85AC8B720CEA2D247B615410EA.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\5b884080fd4f94	622C4B85AC8B720CEA2D247B615410EA.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\fontdrvhost.exe	622C4B85AC8B720CEA2D247B615410EA.exe
File created	C:\Program Files (x86)\Windows Portable Devices\5940a34987c991	622C4B85AC8B720CEA2D247B615410EA.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\7a0fd90576e088	622C4B85AC8B720CEA2D247B615410EA.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\sppsvc.exe	622C4B85AC8B720CEA2D247B615410EA.exe
File created	C:\Program Files (x86)\Windows Portable Devices\Idle.exe	622C4B85AC8B720CEA2D247B615410EA.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\Idle.exe	622C4B85AC8B720CEA2D247B615410EA.exe
File created	C:\Program Files (x86)\Windows Portable Devices\7a0fd90576e088	622C4B85AC8B720CEA2D247B615410EA.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\DigitalLocker\en-US\csrss.exe	622C4B85AC8B720CEA2D247B615410EA.exe
File created	C:\Windows\DigitalLocker\en-US\886983d96e3d3e	622C4B85AC8B720CEA2D247B615410EA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	csrss.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4340	schtasks.exe
212	schtasks.exe
1844	schtasks.exe
4012	schtasks.exe
3492	schtasks.exe
1748	schtasks.exe
4604	schtasks.exe
2316	schtasks.exe
4036	schtasks.exe
4080	schtasks.exe
844	schtasks.exe
4120	schtasks.exe
4528	schtasks.exe
1612	schtasks.exe
3632	schtasks.exe
2948	schtasks.exe
3620	schtasks.exe
4456	schtasks.exe
2248	schtasks.exe
1432	schtasks.exe
2152	schtasks.exe
948	schtasks.exe
1920	schtasks.exe
4740	schtasks.exe
1956	schtasks.exe
2380	schtasks.exe
552	schtasks.exe
4040	schtasks.exe
4984	schtasks.exe
2904	schtasks.exe
3316	schtasks.exe
4620	schtasks.exe
540	schtasks.exe
3048	schtasks.exe
3480	schtasks.exe
2192	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5052	622C4B85AC8B720CEA2D247B615410EA.exe
5052	622C4B85AC8B720CEA2D247B615410EA.exe
5052	622C4B85AC8B720CEA2D247B615410EA.exe
5052	622C4B85AC8B720CEA2D247B615410EA.exe
5052	622C4B85AC8B720CEA2D247B615410EA.exe
5052	622C4B85AC8B720CEA2D247B615410EA.exe
5052	622C4B85AC8B720CEA2D247B615410EA.exe
5052	622C4B85AC8B720CEA2D247B615410EA.exe
5052	622C4B85AC8B720CEA2D247B615410EA.exe
5052	622C4B85AC8B720CEA2D247B615410EA.exe
5052	622C4B85AC8B720CEA2D247B615410EA.exe
5052	622C4B85AC8B720CEA2D247B615410EA.exe
5052	622C4B85AC8B720CEA2D247B615410EA.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4088	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe
4824	csrss.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	622C4B85AC8B720CEA2D247B615410EA.exe
Token: SeDebugPrivilege	4088	csrss.exe
Token: SeDebugPrivilege	4824	csrss.exe
Token: SeDebugPrivilege	4392	csrss.exe
Token: SeDebugPrivilege	1516	csrss.exe
Token: SeDebugPrivilege	5104	csrss.exe
Token: SeDebugPrivilege	4848	csrss.exe
Token: SeDebugPrivilege	1092	csrss.exe
Token: SeDebugPrivilege	4176	csrss.exe
Token: SeDebugPrivilege	4596	csrss.exe
Token: SeDebugPrivilege	4844	csrss.exe
Token: SeDebugPrivilege	2172	csrss.exe
Token: SeDebugPrivilege	3528	csrss.exe
Token: SeDebugPrivilege	2540	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 4088	5052	622C4B85AC8B720CEA2D247B615410EA.exe	124
PID 5052 wrote to memory of 4088	5052	622C4B85AC8B720CEA2D247B615410EA.exe	124
PID 4088 wrote to memory of 3160	4088	csrss.exe	128
PID 4088 wrote to memory of 3160	4088	csrss.exe	128
PID 4088 wrote to memory of 2964	4088	csrss.exe	129
PID 4088 wrote to memory of 2964	4088	csrss.exe	129
PID 3160 wrote to memory of 4824	3160	WScript.exe	137
PID 3160 wrote to memory of 4824	3160	WScript.exe	137
PID 4824 wrote to memory of 3632	4824	csrss.exe	139
PID 4824 wrote to memory of 3632	4824	csrss.exe	139
PID 4824 wrote to memory of 1684	4824	csrss.exe	140
PID 4824 wrote to memory of 1684	4824	csrss.exe	140
PID 3632 wrote to memory of 4392	3632	WScript.exe	143
PID 3632 wrote to memory of 4392	3632	WScript.exe	143
PID 4392 wrote to memory of 4636	4392	csrss.exe	147
PID 4392 wrote to memory of 4636	4392	csrss.exe	147
PID 4392 wrote to memory of 1808	4392	csrss.exe	148
PID 4392 wrote to memory of 1808	4392	csrss.exe	148
PID 4636 wrote to memory of 1516	4636	WScript.exe	152
PID 4636 wrote to memory of 1516	4636	WScript.exe	152
PID 1516 wrote to memory of 4104	1516	csrss.exe	154
PID 1516 wrote to memory of 4104	1516	csrss.exe	154
PID 1516 wrote to memory of 1592	1516	csrss.exe	155
PID 1516 wrote to memory of 1592	1516	csrss.exe	155
PID 4104 wrote to memory of 5104	4104	WScript.exe	157
PID 4104 wrote to memory of 5104	4104	WScript.exe	157
PID 5104 wrote to memory of 3984	5104	csrss.exe	159
PID 5104 wrote to memory of 3984	5104	csrss.exe	159
PID 5104 wrote to memory of 1060	5104	csrss.exe	160
PID 5104 wrote to memory of 1060	5104	csrss.exe	160
PID 3984 wrote to memory of 4848	3984	WScript.exe	162
PID 3984 wrote to memory of 4848	3984	WScript.exe	162
PID 4848 wrote to memory of 3476	4848	csrss.exe	164
PID 4848 wrote to memory of 3476	4848	csrss.exe	164
PID 4848 wrote to memory of 3604	4848	csrss.exe	165
PID 4848 wrote to memory of 3604	4848	csrss.exe	165
PID 3476 wrote to memory of 1092	3476	WScript.exe	168
PID 3476 wrote to memory of 1092	3476	WScript.exe	168
PID 1092 wrote to memory of 5008	1092	csrss.exe	170
PID 1092 wrote to memory of 5008	1092	csrss.exe	170
PID 1092 wrote to memory of 4552	1092	csrss.exe	171
PID 1092 wrote to memory of 4552	1092	csrss.exe	171
PID 5008 wrote to memory of 4176	5008	WScript.exe	173
PID 5008 wrote to memory of 4176	5008	WScript.exe	173
PID 4176 wrote to memory of 768	4176	csrss.exe	175
PID 4176 wrote to memory of 768	4176	csrss.exe	175
PID 4176 wrote to memory of 2736	4176	csrss.exe	176
PID 4176 wrote to memory of 2736	4176	csrss.exe	176
PID 768 wrote to memory of 4596	768	WScript.exe	178
PID 768 wrote to memory of 4596	768	WScript.exe	178
PID 4596 wrote to memory of 1464	4596	csrss.exe	180
PID 4596 wrote to memory of 1464	4596	csrss.exe	180
PID 4596 wrote to memory of 4964	4596	csrss.exe	181
PID 4596 wrote to memory of 4964	4596	csrss.exe	181
PID 1464 wrote to memory of 4844	1464	WScript.exe	190
PID 1464 wrote to memory of 4844	1464	WScript.exe	190
PID 4844 wrote to memory of 1688	4844	csrss.exe	193
PID 4844 wrote to memory of 1688	4844	csrss.exe	193
PID 4844 wrote to memory of 372	4844	csrss.exe	194
PID 4844 wrote to memory of 372	4844	csrss.exe	194
PID 1688 wrote to memory of 2172	1688	WScript.exe	197
PID 1688 wrote to memory of 2172	1688	WScript.exe	197
PID 2172 wrote to memory of 3316	2172	csrss.exe	199
PID 2172 wrote to memory of 3316	2172	csrss.exe	199

System policy modification 1 TTPs 42 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	622C4B85AC8B720CEA2D247B615410EA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\622C4B85AC8B720CEA2D247B615410EA.exe
"C:\Users\Admin\AppData\Local\Temp\622C4B85AC8B720CEA2D247B615410EA.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5052
- C:\Windows\DigitalLocker\en-US\csrss.exe
  "C:\Windows\DigitalLocker\en-US\csrss.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4088
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d3471c3e-7102-477a-a6d3-327a8b052a04.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\DigitalLocker\en-US\csrss.exe
      C:\Windows\DigitalLocker\en-US\csrss.exe
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4824
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7aa537ac-9ecc-47b7-9d53-3013165b73fb.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3632
      - C:\Windows\DigitalLocker\en-US\csrss.exe
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4392
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b6d1be68-dfa2-46c8-abb5-9bf628d7d186.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1516
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd9c5fc1-d8b7-420e-9471-553a092df87e.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:5104
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\46209f85-f3b6-4689-8079-923dbbb0fa6a.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3984
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b300fd68-8dcd-4c7c-b452-8a8deb39511b.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1092
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cebfd4a7-73ef-4f3f-a64e-1f118669e88d.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4176
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ebbaeaef-e299-4f44-bd9a-d03d3d2bae98.vbs"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:768
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4596
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1949f630-28a0-4f20-b28a-52d670052879.vbs"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c35a78d2-2b94-47d8-95b2-8eef2f30bd0c.vbs"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:1688
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2172
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b856f2bb-ea4d-45b3-912b-dbca5db0269a.vbs"
        23⤵
        
        PID:3316
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        24⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3528
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec2c67fa-f479-45b3-aec5-c03b4117892c.vbs"
        25⤵
        
        PID:4764
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        
        C:\Windows\DigitalLocker\en-US\csrss.exe
        26⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2540
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62dd4ff2-f9fc-4537-a45e-4e7c167d2fc6.vbs"
        27⤵
        
        PID:3624
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f0513a6-2a41-4304-95a8-d1666c3241d9.vbs"
        27⤵
        
        PID:4080
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7fd0446-444d-4392-bc64-5b18e8061b46.vbs"
        25⤵
        
        PID:1520
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70ef5b7d-0da0-4471-a890-5a2a207ab00b.vbs"
        23⤵
        
        PID:3780
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7ac9dac-6eb0-4439-82ad-1f40c27235b9.vbs"
        21⤵
        
        PID:372
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e8d1934a-5ff1-4524-9e9d-ec77558b6d19.vbs"
        19⤵
        
        PID:4964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f7248c2-0c3a-40f8-ba3f-82319596290b.vbs"
        17⤵
        
        PID:2736
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d39606f6-14e0-4710-a062-9310dc01bd35.vbs"
        15⤵
        
        PID:4552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f492a92f-0746-4dd7-9385-c49f08af58b3.vbs"
        13⤵
        
        PID:3604
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\77540da8-958f-453d-9213-057b8512b3e8.vbs"
        11⤵
        
        PID:1060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\656b9be2-bc9d-40d3-8f9d-6627f4893079.vbs"
        9⤵
        
        PID:1592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aba1f6c4-2953-41f9-8436-d1653a7f483a.vbs"
        7⤵
        
        PID:1808
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f48c9f17-a79b-4dd0-841c-6a90451e1498.vbs"
        5⤵
        
        PID:1684
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a45bf60e-65cd-4578-8439-223c62b917d9.vbs"
    3⤵
    PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\DigitalLocker\en-US\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\DigitalLocker\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Users\Public\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Public\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Users\Public\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\VLC\lua\intf\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\intf\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\VLC\lua\intf\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\Accessories\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SppExtComObj.exe

Path C:\Recovery\WindowsRE\SppExtComObj.exe
Size 3.3MB
SHA256 fcc7ce0c1cf2c3d90bef0d564fcb9ac13631d73dd516a4e32f01ecd3ea9bcda9
MD5 622c4b85ac8b720cea2d247b615410ea
SHA1 af51dc4aa33cab13eb7bd1d633c9ca1e008f4021
SHA512 2b3735ec49f67d9a76b524fe6a65d7947c48f8c36918cdbc9b218db5b362c9a3f0bdc8058834ce073e998b40be025a534fa5fb6e6fb24b99f0e92313c74ad07f
SSDEEP 49152:Yqcgj17YRt2uT8OgCR4N5K1fj6oLUPqu/T7XM9d9s0pY87oWSZxrAXQ/EFjE67Ku:Yvgj1g2uT8i2M1Pub7c9d9f6dZxodE
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log
Size 1KB
SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
MD5 49b64127208271d8f797256057d0b006
SHA1 b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
SHA512 f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e
MD5 SHA1 SHA512

Submit Download

1949f630-28a0-4f20-b28a-52d670052879.vbs

Path C:\Users\Admin\AppData\Local\Temp\1949f630-28a0-4f20-b28a-52d670052879.vbs
Size 716B
SHA256 70fc2237f4b4ee8d2a419805d7ef3f3af00dd609ecaa7c75d97e9f91ef5f8a10
MD5 e11b08cfbbd637c14c142526d778872a
SHA1 1a93bdccf68ca6b5560b341764e7007575c6c318
SHA512 9b12bd6e447b703a437919f064ff0607074950787fc73a5151f3b9a5492be58a61a67c5382b9d259c91f345ced1c571d2fee7bed9e2d6756cee139db8e03092e
MD5 SHA1 SHA512

Submit Download

46209f85-f3b6-4689-8079-923dbbb0fa6a.vbs

Path C:\Users\Admin\AppData\Local\Temp\46209f85-f3b6-4689-8079-923dbbb0fa6a.vbs
Size 716B
SHA256 cf640b232dfa14bb114f5bfc9e3d22d96ed7fcbdf6d57e07aaa9cc70e6032af4
MD5 ed343a04cba36e416d7224abb8de7be0
SHA1 1afb5f860a7c84e0cd5ca50c445af7af1d25bb34
SHA512 e29bc91069db1fbaaf6aa09fa38679af39cff1aac2ebd17c4e0236fe08e088132acf400d07ea3d0fa9c20ab0c61466753c74b2902752266f2915ece2f8e4050f
MD5 SHA1 SHA512

Submit Download

62dd4ff2-f9fc-4537-a45e-4e7c167d2fc6.vbs

Path C:\Users\Admin\AppData\Local\Temp\62dd4ff2-f9fc-4537-a45e-4e7c167d2fc6.vbs
Size 716B
SHA256 9471adc5eb627647cc2f12fec0e3c6752ec34af686bfd5e4f447dbf89d838726
MD5 9fcb32c25b6ee25e3d44a134221c5da7
SHA1 85b4c9ab9bae3fdf248871849184494dff19ebf3
SHA512 249117f75be2801910894b37785963e1ba5672feb650c503e46a525eb9edd8050b4e6e17591d95a7a5073f7dce8a91077668fbc960e6eed23dcf8871b81280db
MD5 SHA1 SHA512

Submit Download

7aa537ac-9ecc-47b7-9d53-3013165b73fb.vbs

Path C:\Users\Admin\AppData\Local\Temp\7aa537ac-9ecc-47b7-9d53-3013165b73fb.vbs
Size 716B
SHA256 693d196dca9fba8df672e79ba1f40778ab4f8d6250279c32ee0d149c33d8f6bf
MD5 97a396b2aa3778e79a8e10d878d6cf07
SHA1 d3e6f9999f81498c42000a61c1aed7361886bca8
SHA512 654c9a826d794c724b2d8b261a462547c45efc2c6f6e4e17a8f7312d1a8e9b0a3165c11ab716f7c8add58596e44d067f80ec4b9612909c2565a221851caeec1f
MD5 SHA1 SHA512

Submit Download

a45bf60e-65cd-4578-8439-223c62b917d9.vbs

Path C:\Users\Admin\AppData\Local\Temp\a45bf60e-65cd-4578-8439-223c62b917d9.vbs
Size 492B
SHA256 cc8af20f4abc3a36de85470cdf859cb84f33f0d627acf378fb58fb474a53d32e
MD5 056c1094948f607c00a1f61db7954ad9
SHA1 c43aae0c45242556db0936f804ab132ba1b2f063
SHA512 bde876e98450d6b5fb873e7cc77582a70dda9c2eaaed539664c413aeaa83d1abcfb2073c7cfa73d82cd51fd9a75e1cf694a938efde4ce3cf024fdf2c1867083f
MD5 SHA1 SHA512

Submit Download

b300fd68-8dcd-4c7c-b452-8a8deb39511b.vbs

Path C:\Users\Admin\AppData\Local\Temp\b300fd68-8dcd-4c7c-b452-8a8deb39511b.vbs
Size 716B
SHA256 bc3c93955910ab5221b0407163faf3568b642254f7e5763e66236ba0f54d0a65
MD5 8752342a7f09b2bab92557e3fc4f1848
SHA1 9cec47c7fc528e352d6e799cbdea66af31523fff
SHA512 d7a6698312e726e0af6fb50702cf7fe95b2d2d6c7c0e3f0d67249e5cfa3361b85c82945fe199cd33c1a744e5a7bd0397697850e87b31a24cb42b0a5ca9aa0173
MD5 SHA1 SHA512

Submit Download

b6d1be68-dfa2-46c8-abb5-9bf628d7d186.vbs

Path C:\Users\Admin\AppData\Local\Temp\b6d1be68-dfa2-46c8-abb5-9bf628d7d186.vbs
Size 716B
SHA256 c169d1203dc30061093efe3ecab1665fe601a42d0e07f57609af6f8cdd41fd39
MD5 cc2274dd86cdb27602e1c93de22d9f4f
SHA1 f7a29f755f4ce55f1f5c3fd2e6164f35271fe6fa
SHA512 645bcf0ace9345760b2ab1f4743613a4e9ad979908f59ee745cc9d40520ecd9daef995fec5b6dd6e16cdc008c6b03a61ee183ad70a3171917a7be5db37d1d2fe
MD5 SHA1 SHA512

Submit Download

b856f2bb-ea4d-45b3-912b-dbca5db0269a.vbs

Path C:\Users\Admin\AppData\Local\Temp\b856f2bb-ea4d-45b3-912b-dbca5db0269a.vbs
Size 716B
SHA256 4f674f79a78b83ac5bb4d3f1ac7114453f8f2d5755ceb6c0522ffab937fa06ef
MD5 9fd33feb54db6d3f00237bfabadb7f1f
SHA1 d9bcd771bcad3252fcf7fa23d88863c337edca9b
SHA512 8f9e55740980e40809010e9294ab073c64596382c791d4e1c852386fc38b9dfbc7c03186701fb3d6a50a3f80b908f44de6fde3a27bfd4698ce5ae4a2e3fb3423
MD5 SHA1 SHA512

Submit Download

bd9c5fc1-d8b7-420e-9471-553a092df87e.vbs

Path C:\Users\Admin\AppData\Local\Temp\bd9c5fc1-d8b7-420e-9471-553a092df87e.vbs
Size 716B
SHA256 fc58384fd3553c8897e898b828789b101fd8d63d75a70504dd6bababea4f469c
MD5 30246f4aec6e2884ec0090b4c365eb43
SHA1 e3d4ea69dc4d77d7d50405a69d5df634e0bd8405
SHA512 4bf5aa1b8ec8f3ba92664aba2a8be58744e2a22405c3045f6c5ed954ce3fa4253865695a9213103cb43d52616b8dd718866da439fa943d33a3bfff491339b336
MD5 SHA1 SHA512

Submit Download

c35a78d2-2b94-47d8-95b2-8eef2f30bd0c.vbs

Path C:\Users\Admin\AppData\Local\Temp\c35a78d2-2b94-47d8-95b2-8eef2f30bd0c.vbs
Size 716B
SHA256 0ff42a2706cf22f51281e83cb479caeb9c6f67650d42890cd135aa83f2669b90
MD5 faf0446caf5eff717d99c67a944ef667
SHA1 3c757300a71ec6bcf93ddb5ff0279bbeecd5ff56
SHA512 785fe2742c01933788a04a0cc6f0b1779faeebc2d927ebe9793068571e8771d8dfd7af0d09390ab4886400d65efb4d62f33b92293a33a272d39c836c360db5f7
MD5 SHA1 SHA512

Submit Download

cebfd4a7-73ef-4f3f-a64e-1f118669e88d.vbs

Path C:\Users\Admin\AppData\Local\Temp\cebfd4a7-73ef-4f3f-a64e-1f118669e88d.vbs
Size 716B
SHA256 45c1aec5fcd099ef6f2f49412445e25ced46336aa4013e3ebffc34e7e5944138
MD5 faf8b150bc9de352204ac253de4db3af
SHA1 9002e7b4836615627aee98800860ffee8107d52c
SHA512 a5fe9339b44a6a507947c5dbf3a1e41467d426a6baed2e1cdcb28d89ee629cc199ae6c1b0795ad2618a28d01d6d50b1340a17b2ddc8d439753fb7cb106c5e66d
MD5 SHA1 SHA512

Submit Download

d3471c3e-7102-477a-a6d3-327a8b052a04.vbs

Path C:\Users\Admin\AppData\Local\Temp\d3471c3e-7102-477a-a6d3-327a8b052a04.vbs
Size 716B
SHA256 f0415983b8e6d7e7c6403c425c72617b5453b3ad2b2849a3b0e995bbeed9abcc
MD5 5c6c5a998d93e9c691695bee5c73c905
SHA1 174e021791f8121325f997c6156786c9ac10e99c
SHA512 c28c600c83066e1fd17de15b5e1c57afbd55f7fd3144bd3eb3da36d91769cae42dda10eeb45932e354032d5ec2bc4987163fc546169c06f1febf39e73c01a174
MD5 SHA1 SHA512

Submit Download

ebbaeaef-e299-4f44-bd9a-d03d3d2bae98.vbs

Path C:\Users\Admin\AppData\Local\Temp\ebbaeaef-e299-4f44-bd9a-d03d3d2bae98.vbs
Size 716B
SHA256 59ff9884a153962379aaa7a9b5f97d12ce693bc49daaeaa250ad5393cc8edc10
MD5 da018bef643a7d459efb1a728c14022e
SHA1 ad64eb4cb1bc75377b0edcfea1793c9d33f509c9
SHA512 385cda646c6a8219ae86b6b430cd3e01de36da655817d5259de07b31e4c77a122841b056fd356ef7e55478545d594f8dd6c8b23132d5a21f51ce135d1ed69234
MD5 SHA1 SHA512

Submit Download

ec2c67fa-f479-45b3-aec5-c03b4117892c.vbs

Path C:\Users\Admin\AppData\Local\Temp\ec2c67fa-f479-45b3-aec5-c03b4117892c.vbs
Size 716B
SHA256 c7f4b510675e77985342499fe146e52ff7f833ac7f0e26a26e692cd8a7de4326
MD5 301c9acdeb8e9ca727e1977ae8b8771e
SHA1 35c89043255806b42ff91eed35c0cf07b726979a
SHA512 5cb818894f90bec05db80146146bf4f2bc3a00bd8cc1c154b62080f5dbaf672ea931cbd0f7a979f27de00a334e81403ec169a4e433355ac8c92b05cf9b4b1784
MD5 SHA1 SHA512

Submit Download

memory/1092-144-0x000000001D3E0000-0x000000001D3F2000-memory.dmp

Download

memory/2172-190-0x000000001D770000-0x000000001D782000-memory.dmp

Download

memory/2172-191-0x000000001D7B0000-0x000000001D806000-memory.dmp

Download

memory/4176-156-0x000000001D7B0000-0x000000001D806000-memory.dmp

Download

memory/4392-98-0x000000001D5B0000-0x000000001D606000-memory.dmp

Download

memory/4848-132-0x000000001D810000-0x000000001D822000-memory.dmp

Download

memory/5052-15-0x0000000002B90000-0x0000000002BA0000-memory.dmp

Download

memory/5052-21-0x0000000002A90000-0x0000000002A98000-memory.dmp

Download

memory/5052-24-0x000000001BE80000-0x000000001BE8C000-memory.dmp

Download

memory/5052-25-0x000000001BE90000-0x000000001BE98000-memory.dmp

Download

memory/5052-26-0x000000001BEA0000-0x000000001BEAC000-memory.dmp

Download

memory/5052-27-0x000000001BEB0000-0x000000001BEBC000-memory.dmp

Download

memory/5052-29-0x000000001BFD0000-0x000000001BFDC000-memory.dmp

Download

memory/5052-28-0x000000001BFC0000-0x000000001BFC8000-memory.dmp

Download

memory/5052-33-0x000000001C110000-0x000000001C11E000-memory.dmp

Download

memory/5052-32-0x000000001C100000-0x000000001C108000-memory.dmp

Download

memory/5052-35-0x000000001C130000-0x000000001C13C000-memory.dmp

Download

memory/5052-34-0x000000001C120000-0x000000001C128000-memory.dmp

Download

memory/5052-37-0x000000001C150000-0x000000001C15A000-memory.dmp

Download

memory/5052-38-0x000000001C160000-0x000000001C16C000-memory.dmp

Download

memory/5052-36-0x000000001C140000-0x000000001C148000-memory.dmp

Download

memory/5052-31-0x000000001C0F0000-0x000000001C0FE000-memory.dmp

Download

memory/5052-30-0x000000001BFE0000-0x000000001BFEA000-memory.dmp

Download

memory/5052-22-0x000000001B6F0000-0x000000001B702000-memory.dmp

Download

memory/5052-74-0x00007FFCD44C0000-0x00007FFCD4F81000-memory.dmp

Download

memory/5052-23-0x000000001C3B0000-0x000000001C8D8000-memory.dmp

Download

memory/5052-20-0x0000000002A80000-0x0000000002A8C000-memory.dmp

Download

memory/5052-19-0x0000000002A70000-0x0000000002A78000-memory.dmp

Download

memory/5052-18-0x0000000002A60000-0x0000000002A6C000-memory.dmp

Download

memory/5052-17-0x000000001BE30000-0x000000001BE86000-memory.dmp

Download

memory/5052-16-0x000000001B6E0000-0x000000001B6EA000-memory.dmp

Download

memory/5052-0-0x00007FFCD44C3000-0x00007FFCD44C5000-memory.dmp

Download

memory/5052-14-0x0000000002B80000-0x0000000002B88000-memory.dmp

Download

memory/5052-13-0x0000000002BA0000-0x0000000002BAC000-memory.dmp

Download

memory/5052-8-0x0000000002B20000-0x0000000002B28000-memory.dmp

Download

memory/5052-12-0x0000000002B70000-0x0000000002B82000-memory.dmp

Download

memory/5052-9-0x0000000002B30000-0x0000000002B40000-memory.dmp

Download

memory/5052-11-0x0000000002B60000-0x0000000002B68000-memory.dmp

Download

memory/5052-10-0x0000000002B40000-0x0000000002B56000-memory.dmp

Download

memory/5052-7-0x000000001B690000-0x000000001B6E0000-memory.dmp

Download

memory/5052-6-0x0000000002B00000-0x0000000002B1C000-memory.dmp

Download

memory/5052-5-0x0000000002AF0000-0x0000000002AF8000-memory.dmp

Download

memory/5052-4-0x0000000002AE0000-0x0000000002AEE000-memory.dmp

Download

memory/5052-3-0x0000000002AD0000-0x0000000002ADE000-memory.dmp

Download

memory/5052-2-0x00007FFCD44C0000-0x00007FFCD4F81000-memory.dmp

Download

memory/5052-1-0x0000000000650000-0x00000000009AE000-memory.dmp

Download