dcrat | 101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5

Analysis

max time kernel
150s
max time network
158s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-10-2024 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
Size

4.9MB
MD5

682295e9dea6b6c362facab1d64dbcfd
SHA1

f919a213030d33a2cdea27e7471ddbadf2f2a268
SHA256

101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5
SHA512

4cd90d088a4f5faf082b5567314e3d5e1a80a1ebffb1f3cf7eb69a71386e6f87205e38a49a350a7118e03b888cb5e61408b356f78e16a6282913dac2a09d622e
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	324	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	472	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	524	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	3044	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	3044	schtasks.exe	30

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/3012-3-0x000000001B670000-0x000000001B79E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1472	powershell.exe
2884	powershell.exe
2768	powershell.exe
2296	powershell.exe
324	powershell.exe
2536	powershell.exe
320	powershell.exe
2856	powershell.exe
1828	powershell.exe
2792	powershell.exe
3020	powershell.exe
2872	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
1908	lsass.exe
1972	lsass.exe
1924	lsass.exe
1680	lsass.exe
1640	lsass.exe
2844	lsass.exe
1984	lsass.exe
1524	lsass.exe
1988	lsass.exe
936	lsass.exe
2012	lsass.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\csrss.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Program Files\Java\jre7\lib\csrss.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Program Files\7-Zip\Lang\audiodg.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Program Files (x86)\Windows Mail\de-DE\Idle.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\csrss.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\de-DE\RCXD162.tmp	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Program Files\7-Zip\Lang\69ddcba757bf72	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Program Files\VideoLAN\886983d96e3d3e	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Program Files\VideoLAN\csrss.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\de-DE\Idle.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\audiodg.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Program Files\7-Zip\Lang\smss.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCXBE38.tmp	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Program Files\Windows Journal\Templates\RCXC731.tmp	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCXCC61.tmp	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Program Files\Windows Journal\Templates\spoolsv.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Program Files\Java\jre7\lib\csrss.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\RCXB7DE.tmp	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Program Files\VideoLAN\RCXCF3F.tmp	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\6203df4a6bafc7	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Program Files (x86)\Windows Mail\de-DE\6ccacd8608530f	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\886983d96e3d3e	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\smss.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Program Files\7-Zip\Lang\42af1c969fbb7b	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Program Files\Windows Journal\Templates\spoolsv.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Program Files\Java\jre7\lib\RCXDB45.tmp	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\RCXD654.tmp	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Program Files\Windows Journal\Templates\f3b6ecef712a24	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Program Files\VideoLAN\csrss.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Program Files\Java\jre7\lib\886983d96e3d3e	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Registration\CRMLog\RCXC2CC.tmp	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Windows\Registration\CRMLog\lsass.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Windows\twain_32\Idle.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Windows\twain_32\6ccacd8608530f	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Windows\Registration\CRMLog\lsass.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File created	C:\Windows\Registration\CRMLog\6203df4a6bafc7	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Windows\twain_32\RCXBC15.tmp	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
File opened for modification	C:\Windows\twain_32\Idle.exe	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
968	schtasks.exe
1468	schtasks.exe
2092	schtasks.exe
2820	schtasks.exe
456	schtasks.exe
1892	schtasks.exe
2324	schtasks.exe
1716	schtasks.exe
1904	schtasks.exe
1840	schtasks.exe
2800	schtasks.exe
1320	schtasks.exe
2796	schtasks.exe
1540	schtasks.exe
2876	schtasks.exe
324	schtasks.exe
1688	schtasks.exe
1444	schtasks.exe
1932	schtasks.exe
2272	schtasks.exe
2128	schtasks.exe
2064	schtasks.exe
1972	schtasks.exe
2264	schtasks.exe
1464	schtasks.exe
1924	schtasks.exe
764	schtasks.exe
2188	schtasks.exe
1780	schtasks.exe
2480	schtasks.exe
2948	schtasks.exe
2580	schtasks.exe
2508	schtasks.exe
1568	schtasks.exe
1828	schtasks.exe
2516	schtasks.exe
1048	schtasks.exe
672	schtasks.exe
2708	schtasks.exe
2824	schtasks.exe
2416	schtasks.exe
472	schtasks.exe
1448	schtasks.exe
3068	schtasks.exe
2140	schtasks.exe
2916	schtasks.exe
1700	schtasks.exe
1452	schtasks.exe
2244	schtasks.exe
2360	schtasks.exe
556	schtasks.exe
1648	schtasks.exe
2228	schtasks.exe
2780	schtasks.exe
2808	schtasks.exe
1884	schtasks.exe
524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
3020	powershell.exe
2884	powershell.exe
1472	powershell.exe
324	powershell.exe
2872	powershell.exe
2792	powershell.exe
320	powershell.exe
2296	powershell.exe
2768	powershell.exe
2536	powershell.exe
2856	powershell.exe
1828	powershell.exe
1908	lsass.exe
1972	lsass.exe
1924	lsass.exe
1680	lsass.exe
1640	lsass.exe
2844	lsass.exe
1984	lsass.exe
1524	lsass.exe
1988	lsass.exe
936	lsass.exe
2012	lsass.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	324	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	320	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	1828	powershell.exe
Token: SeDebugPrivilege	1908	lsass.exe
Token: SeDebugPrivilege	1972	lsass.exe
Token: SeDebugPrivilege	1924	lsass.exe
Token: SeDebugPrivilege	1680	lsass.exe
Token: SeDebugPrivilege	1640	lsass.exe
Token: SeDebugPrivilege	2844	lsass.exe
Token: SeDebugPrivilege	1984	lsass.exe
Token: SeDebugPrivilege	1524	lsass.exe
Token: SeDebugPrivilege	1988	lsass.exe
Token: SeDebugPrivilege	936	lsass.exe
Token: SeDebugPrivilege	2012	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2872	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	88
PID 3012 wrote to memory of 2872	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	88
PID 3012 wrote to memory of 2872	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	88
PID 3012 wrote to memory of 3020	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	89
PID 3012 wrote to memory of 3020	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	89
PID 3012 wrote to memory of 3020	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	89
PID 3012 wrote to memory of 2536	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	90
PID 3012 wrote to memory of 2536	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	90
PID 3012 wrote to memory of 2536	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	90
PID 3012 wrote to memory of 324	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	92
PID 3012 wrote to memory of 324	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	92
PID 3012 wrote to memory of 324	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	92
PID 3012 wrote to memory of 2296	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	93
PID 3012 wrote to memory of 2296	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	93
PID 3012 wrote to memory of 2296	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	93
PID 3012 wrote to memory of 2792	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	94
PID 3012 wrote to memory of 2792	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	94
PID 3012 wrote to memory of 2792	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	94
PID 3012 wrote to memory of 2768	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	95
PID 3012 wrote to memory of 2768	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	95
PID 3012 wrote to memory of 2768	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	95
PID 3012 wrote to memory of 2884	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	96
PID 3012 wrote to memory of 2884	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	96
PID 3012 wrote to memory of 2884	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	96
PID 3012 wrote to memory of 1472	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	97
PID 3012 wrote to memory of 1472	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	97
PID 3012 wrote to memory of 1472	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	97
PID 3012 wrote to memory of 1828	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	98
PID 3012 wrote to memory of 1828	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	98
PID 3012 wrote to memory of 1828	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	98
PID 3012 wrote to memory of 2856	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	99
PID 3012 wrote to memory of 2856	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	99
PID 3012 wrote to memory of 2856	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	99
PID 3012 wrote to memory of 320	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	100
PID 3012 wrote to memory of 320	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	100
PID 3012 wrote to memory of 320	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	100
PID 3012 wrote to memory of 764	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	112
PID 3012 wrote to memory of 764	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	112
PID 3012 wrote to memory of 764	3012	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe	112
PID 764 wrote to memory of 2496	764	cmd.exe	114
PID 764 wrote to memory of 2496	764	cmd.exe	114
PID 764 wrote to memory of 2496	764	cmd.exe	114
PID 764 wrote to memory of 1908	764	cmd.exe	115
PID 764 wrote to memory of 1908	764	cmd.exe	115
PID 764 wrote to memory of 1908	764	cmd.exe	115
PID 1908 wrote to memory of 236	1908	lsass.exe	116
PID 1908 wrote to memory of 236	1908	lsass.exe	116
PID 1908 wrote to memory of 236	1908	lsass.exe	116
PID 1908 wrote to memory of 652	1908	lsass.exe	117
PID 1908 wrote to memory of 652	1908	lsass.exe	117
PID 1908 wrote to memory of 652	1908	lsass.exe	117
PID 236 wrote to memory of 1972	236	WScript.exe	118
PID 236 wrote to memory of 1972	236	WScript.exe	118
PID 236 wrote to memory of 1972	236	WScript.exe	118
PID 1972 wrote to memory of 1672	1972	lsass.exe	119
PID 1972 wrote to memory of 1672	1972	lsass.exe	119
PID 1972 wrote to memory of 1672	1972	lsass.exe	119
PID 1972 wrote to memory of 1892	1972	lsass.exe	120
PID 1972 wrote to memory of 1892	1972	lsass.exe	120
PID 1972 wrote to memory of 1892	1972	lsass.exe	120
PID 1672 wrote to memory of 1924	1672	WScript.exe	121
PID 1672 wrote to memory of 1924	1672	WScript.exe	121
PID 1672 wrote to memory of 1924	1672	WScript.exe	121
PID 1924 wrote to memory of 2392	1924	lsass.exe	122

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
"C:\Users\Admin\AppData\Local\Temp\101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nMdX7E06KS.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1908
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c0ce140-5a57-4c0f-8497-440f19d29a57.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:236
    - - C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1972
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\11fb1b3a-ef20-498f-bef2-5c8d59f66724.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1a23370-18da-45fd-b24c-7dc36ce5c547.vbs"
        8⤵
        
        PID:2392
        
        C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe"
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1abd3269-246f-4c6d-9a96-fdc0f9677165.vbs"
        10⤵
        
        PID:900
        
        C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe"
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b335071b-077e-48d5-8541-3ef2dd65ca40.vbs"
        12⤵
        
        PID:1664
        
        C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe"
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d8721280-d732-480a-8304-3dad8e65e570.vbs"
        14⤵
        
        PID:1508
        
        C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe"
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b2425909-38e8-4c83-a9b2-3db80a677992.vbs"
        16⤵
        
        PID:2636
        
        C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe"
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1524
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a761aa21-3bbd-4173-b66c-d7c4a848db9c.vbs"
        18⤵
        
        PID:2628
        
        C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe"
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\724e6d32-6f96-43ae-94f8-030638b248ac.vbs"
        20⤵
        
        PID:876
        
        C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe"
        21⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:936
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7f1bc77-82ec-4fee-bfca-395975b390d4.vbs"
        22⤵
        
        PID:1168
        
        C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe"
        23⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fcfa3cd9-3448-4148-97e9-ba96080fcebf.vbs"
        24⤵
        
        PID:336
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac96805d-c74e-4975-88ab-1e9e67b224a7.vbs"
        24⤵
        
        PID:2448
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\945266ac-51b5-441c-aea7-288a6ce462e0.vbs"
        22⤵
        
        PID:1448
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8cc67e5a-7131-4e78-b0ad-4058f8b5b1d3.vbs"
        20⤵
        
        PID:1700
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a899ed15-f61d-4da5-b035-d34ddc35c4a8.vbs"
        18⤵
        
        PID:2972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2b92d217-bece-4d1d-9767-ea8bb226cb8c.vbs"
        16⤵
        
        PID:2128
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\050ab71e-c3e8-4607-b8a2-5e302e003e6b.vbs"
        14⤵
        
        PID:2080
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\687214bc-47af-428e-900b-11b8d6d78103.vbs"
        12⤵
        
        PID:2252
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5faec784-450a-4ad9-8ceb-e22429a1e64c.vbs"
        10⤵
        
        PID:2292
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f9d7f4b6-a6e6-4499-9efd-7a530ba5dc11.vbs"
        8⤵
        
        PID:108
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a2103254-5ce2-4783-af04-d873874a4a11.vbs"
        6⤵
        
        PID:1892
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3d8c6701-44c0-483c-9f56-53cedec2c1aa.vbs"
      4⤵
      PID:652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\LocalLow\Sun\Java\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Admin\AppData\LocalLow\Sun\Java\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\LocalLow\Sun\Java\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Office\Office14\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\twain_32\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\twain_32\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Windows\twain_32\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Default User\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Windows\Registration\CRMLog\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\Registration\CRMLog\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Journal\Templates\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\Templates\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Journal\Templates\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\VideoLAN\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\de-DE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\de-DE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\de-DE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Favorites\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\Favorites\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Favorites\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jre7\lib\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\lib\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jre7\lib\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Mail\de-DE\RCXD162.tmp

Filesize
4.9MB

MD5
554deb615ba89bef09e452940695331c

SHA1
a77f5489ef5aa599b248a62c67b0acb614154594

SHA256
0e96a43c795c257bb1024d55390c30b28e308d44320b45ebfc362957ac1cca77

SHA512
821de91705cc8cd1c4d183fd8466109fd825ca0872b621964ef3f47b94c2f90676a19e226f61dc970d11961f7277d8190c254e0548744cce3926366d76534736

Download Submit
C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\RCXD922.tmp

Filesize
4.9MB

MD5
72b494980a97f940c2409a3ade9863e8

SHA1
1a7909f127db1485d6c07855d9c755fbfebd79f3

SHA256
c50c91eb3b7aca94cf542e00a2f5cae21994637d7e2412e8f3157e64e15f5206

SHA512
07ad0cb82de7db0814662c5fdff9be94d88115634a3ec85dddf67503b7b25a268d0adfc99cccc0cb1ca0e7276c2718e86e1bf35d9e32c131eb6f40857a209f1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\11fb1b3a-ef20-498f-bef2-5c8d59f66724.vbs

Filesize
734B

MD5
a32cdaf2e4a0789a4aee0bcd5e2a9c22

SHA1
1f2e45f57f3317aede536a246567f722b8f286fc

SHA256
d2571579ca3d6bae38f48c2dab275ff938f569e02e19cf51880b7bfde2b5451d

SHA512
998b83d81afff933c48146551b358812795ce94f94b76663f90ea69e542c978852aa89565613cbbcfa5e8ae1d09cd9a2741ebf28c94cf671bdd07e1d538fb866

Download Submit
C:\Users\Admin\AppData\Local\Temp\1abd3269-246f-4c6d-9a96-fdc0f9677165.vbs

Filesize
734B

MD5
f262333c7256d9e3cb8cb471b9207f82

SHA1
87573f3b345ee911af9b02cd20d2f3266fe07d6b

SHA256
d83eacd07d3a3ba25b803ed1941f2014d23aa9e5c24f7a2f73ec32160bb62583

SHA512
00f96592e1fb1b57394f69ac10e8f4b15c38672a68c5a38d463f9f9e1cdabfd80d6c972aef992b7e524bc8ffeff2cc0ad04b4a8b3406c014efe3eba325e67641

Download Submit
C:\Users\Admin\AppData\Local\Temp\3c0ce140-5a57-4c0f-8497-440f19d29a57.vbs

Filesize
734B

MD5
66617a2587745e6ca1dcc1f7ee9eb443

SHA1
4d0acb794468ffacdedc84232f5b5815e3910a52

SHA256
b9ad9144b6c0f5a32054991df567796eb0d16470b5c39e36020d2b80be2c7419

SHA512
2dda2375d470b6b65870a987db47eca60ec5336954e5c29b97af874526d6d8f619add3f70ca19f482f6fefa7c5682aba3791fb5a56a0c95d7a0af05f275f4882

Download Submit
C:\Users\Admin\AppData\Local\Temp\3d8c6701-44c0-483c-9f56-53cedec2c1aa.vbs

Filesize
510B

MD5
06d951bc147d53370ae95666e9dc5352

SHA1
e31f862cb9d91da222a82f71bd9e7415ccdbf31e

SHA256
d28f5c09409abc76b8a1adb404ea1e01563197f66e8032d5d16e7f6da8421efa

SHA512
41dc6ba7173e0914107d1b54dae1c1b21ad8b7548c6fdebbf47a50081a9c9cc219fce28a2c49518dd3c493cdff029c197a212732b70c391a4d95187d6343681f

Download Submit
C:\Users\Admin\AppData\Local\Temp\724e6d32-6f96-43ae-94f8-030638b248ac.vbs

Filesize
734B

MD5
a832558d9d502185e2a4023f6565ff79

SHA1
6cc2fcdd15ef6a167fce1c71fb515e6a7cebfca4

SHA256
046f24f8d5b3e90a4a88ae72570117fc646f06b456bdd19ad3037bf02698540b

SHA512
6b2d70d4eed3dc4f2ad8cc414d3a504d43b79cfa559c6f2ddba2db1be8790d4f23f7e4324fb0522c240f3b30e7f6ada1d99edc13f6f65cbd3ce4fe1be13ed23b

Download Submit
C:\Users\Admin\AppData\Local\Temp\a1a23370-18da-45fd-b24c-7dc36ce5c547.vbs

Filesize
734B

MD5
c47df3f9bdf759537ea1a2e44b0b4e47

SHA1
53aacc9643677d0808af605a965066f765427bcf

SHA256
cf5b40f13f6fedcf48e9eacdf7212c498fe7b8fdfe2011b86ebe304c34c666f3

SHA512
e1e5c8d5a702d47e37c45ee2128d81582cdc8357dede2e4fdc4335f5b03d75def696a3f4301457c6533aa59f5b9315735fb8cfba6c21ad10160e8a2ecd814640

Download Submit
C:\Users\Admin\AppData\Local\Temp\a761aa21-3bbd-4173-b66c-d7c4a848db9c.vbs

Filesize
734B

MD5
964670a7650f58641e7ab30cde2a693e

SHA1
e8f7dab8daccde1217c3a84ed966ac67f1be2454

SHA256
e9f6c6f4836904708741d2f12168ac2258e022a46067dc20dd6ed3f52a976d2e

SHA512
dc995ec0580e2b7c1546396ae4fb490a7f557696a1f6687899cbb128c0ffdd6287e273282a68588506d1be0208fce843b404e4ab3191944df706cc7f32a1cd4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\b2425909-38e8-4c83-a9b2-3db80a677992.vbs

Filesize
734B

MD5
e282f08d2e24179a9a7faf3c11415c61

SHA1
976e1e34bd695c7398f6f3f48d06e0014ce05583

SHA256
2241efa370a2c09067559f9b36379be7fe5d1d80264f52f3763aee1db9bded60

SHA512
2f6a56e1ad5b90fe7459501d1f8ea99d3839b69d7d102520f970a886108963a3f36d4c0dcd409eaa7ca7ebea47df771d74ff028fbd0c0cbb15a056f7b60aa6da

Download Submit
C:\Users\Admin\AppData\Local\Temp\b335071b-077e-48d5-8541-3ef2dd65ca40.vbs

Filesize
734B

MD5
c97e69f38d38ebcf2197f79c360285a3

SHA1
e37a52e7694420a8b03fe01a0c0f4fe0e950fef8

SHA256
67edf76e7680d47f78d5cde9c30d5042df6f8052a37f3e286a5d8aa78315d750

SHA512
6a979592d757071dba7ef72556cabe843ae00bef7a8da6abae46b791852c171494c28fd4b6708c031d5c7c42e5e16b9eb7e1cb84d3daa5131a33c38cb0047592

Download Submit
C:\Users\Admin\AppData\Local\Temp\b7f1bc77-82ec-4fee-bfca-395975b390d4.vbs

Filesize
733B

MD5
87502969041631cd07de4c0300badf6b

SHA1
034c4f27bda57c9ae0b39e6f9fce2ae98042d967

SHA256
cf335443d9267ab5a9b0f65e1aa118fe0c92f985494004718fc5b555d1047a09

SHA512
4a48bc17a1bb4a0b8dae3507716ab1dddc9d59be337235d0c3b30844d5eaf7dc65176c680af755307ad51ee96681c2c93a10f57da40cb0c206aa4327c838fcbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\d8721280-d732-480a-8304-3dad8e65e570.vbs

Filesize
734B

MD5
67a81904cb9c583c8e652a0d51984d00

SHA1
acc1b17d2d5395e2b0786828bc4b4f3daf50938b

SHA256
f7b1642eba40988568f850dec412f9dab074a60094f3c2852baeb6ad8c9afec2

SHA512
6fbd5eb04dacb311191e37cde7733b1b75d33795f35345b54f7613384f6b249084e2df8f57e0de7dc0bfa28c5e6232779de669c1c554ee3406987f57f2829797

Download Submit
C:\Users\Admin\AppData\Local\Temp\fcfa3cd9-3448-4148-97e9-ba96080fcebf.vbs

Filesize
734B

MD5
790cda57c0607fd6a6ae6237f177247d

SHA1
24a77f1c62866012538bd58fd5aea1dcf907f9c6

SHA256
0c20958018d0a16db92cca438190f2384eea8fd9ec31cd8a1a5e36f713476e6d

SHA512
f41e347fe2142c28d0c6d935e06720177a4ea72f791265b59a10d15cb4b1f4a9bc0d71bf714c0423a3aa1fe7c88e8cc3403e239c19ed28e578c653dbd57e6101

Download Submit
C:\Users\Admin\AppData\Local\Temp\nMdX7E06KS.bat

Filesize
223B

MD5
eb50857cbe2f45f886b27481c41b0b83

SHA1
5468bdfbcf53d6df95d2466820cc2eb8011a7635

SHA256
de5485f0c21fc4832487cb2e391e0b982cab33b47d8bf6ac29edba647cd8461b

SHA512
403486166d321d65250785e480e76b9c655dd32c44998a9828e6a66091b03e5f045c353bd0ad7d92e340f9bfa3575efc5029bae473583fef016db72230c5aa5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC12.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a7e4e8ee16a11fc7ee3ca784d5147b54

SHA1
176bcde2232f68ded6c403a002c6d80522852bad

SHA256
6b81d2ce0de56955cda1afc6e3d70e879d72aa9fcf6464e9062533d595cc06c3

SHA512
349e585492d9171299da52f321778fd9a88279b1bccad5a6190cbe77fab0b0c63c417b59a1b166fefb0c209840fda80063d192ffea6791b3e7382f0c3f52bb77

Download Submit
C:\Users\Public\Favorites\explorer.exe

Filesize
4.9MB

MD5
5a8b935a9c93a32d1bb65fc9d09c6d48

SHA1
267afd2fcf1aa84a67fee09b4e602bab43b0fe8c

SHA256
561301753fd9ea18b9c6411e23dd9c011f3a3c420cb17ea1bd2664dc68467d75

SHA512
30795a0fb298e7785163e07fdc084ae788ee83f6bc29902418f3c04fb7421d150b1d6e9a6b32709d8f6b1c13415f887ad50b8890c0103234a5088deea8a10b59

Download Submit
C:\Windows\twain_32\Idle.exe

Filesize
4.9MB

MD5
682295e9dea6b6c362facab1d64dbcfd

SHA1
f919a213030d33a2cdea27e7471ddbadf2f2a268

SHA256
101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5

SHA512
4cd90d088a4f5faf082b5567314e3d5e1a80a1ebffb1f3cf7eb69a71386e6f87205e38a49a350a7118e03b888cb5e61408b356f78e16a6282913dac2a09d622e

Download Submit
memory/936-394-0x0000000000EC0000-0x00000000013B4000-memory.dmp

Filesize
5.0MB

Download
memory/1524-364-0x00000000010B0000-0x00000000015A4000-memory.dmp

Filesize
5.0MB

Download
memory/1640-320-0x0000000000030000-0x0000000000524000-memory.dmp

Filesize
5.0MB

Download
memory/1680-305-0x0000000000A50000-0x0000000000F44000-memory.dmp

Filesize
5.0MB

Download
memory/1908-261-0x0000000000F80000-0x0000000001474000-memory.dmp

Filesize
5.0MB

Download
memory/1908-262-0x0000000000AB0000-0x0000000000AC2000-memory.dmp

Filesize
72KB

Download
memory/1924-290-0x0000000000050000-0x0000000000544000-memory.dmp

Filesize
5.0MB

Download
memory/1988-379-0x0000000000210000-0x0000000000704000-memory.dmp

Filesize
5.0MB

Download
memory/2844-335-0x0000000000830000-0x0000000000D24000-memory.dmp

Filesize
5.0MB

Download
memory/2884-210-0x000000001B390000-0x000000001B672000-memory.dmp

Filesize
2.9MB

Download
memory/3012-13-0x0000000000CB0000-0x0000000000CBE000-memory.dmp

Filesize
56KB

Download
memory/3012-115-0x000007FEF6403000-0x000007FEF6404000-memory.dmp

Filesize
4KB

Download
memory/3012-256-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/3012-9-0x0000000000C70000-0x0000000000C7A000-memory.dmp

Filesize
40KB

Download
memory/3012-10-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download
memory/3012-14-0x0000000000CC0000-0x0000000000CC8000-memory.dmp

Filesize
32KB

Download
memory/3012-16-0x0000000000CE0000-0x0000000000CEC000-memory.dmp

Filesize
48KB

Download
memory/3012-15-0x0000000000CD0000-0x0000000000CD8000-memory.dmp

Filesize
32KB

Download
memory/3012-11-0x0000000000C90000-0x0000000000C9A000-memory.dmp

Filesize
40KB

Download
memory/3012-12-0x0000000000CA0000-0x0000000000CAE000-memory.dmp

Filesize
56KB

Download
memory/3012-1-0x00000000012A0000-0x0000000001794000-memory.dmp

Filesize
5.0MB

Download
memory/3012-0-0x000007FEF6403000-0x000007FEF6404000-memory.dmp

Filesize
4KB

Download
memory/3012-130-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/3012-7-0x0000000000B40000-0x0000000000B56000-memory.dmp

Filesize
88KB

Download
memory/3012-8-0x0000000000B60000-0x0000000000B70000-memory.dmp

Filesize
64KB

Download
memory/3012-5-0x0000000000B20000-0x0000000000B28000-memory.dmp

Filesize
32KB

Download
memory/3012-6-0x0000000000B30000-0x0000000000B40000-memory.dmp

Filesize
64KB

Download
memory/3012-4-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3012-3-0x000000001B670000-0x000000001B79E000-memory.dmp

Filesize
1.2MB

Download
memory/3012-2-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/3020-211-0x0000000001FB0000-0x0000000001FB8000-memory.dmp

Filesize
32KB

Download