dcrat | 6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-10-2024 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
Size

4.9MB
MD5

98f6d1c7482e03953bd88b57feb7d6b0
SHA1

437f469f92fea1fe222fb031353065152eb4d95e
SHA256

6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890
SHA512

240e23c6a92008588b5e70969bbc94b2adfb12fb74e5f31ee4d3fc3b918b160bb13868ab29f14b29029a5889f0aff635a97507c6c1ae13dcadaaa6998d6f8165
SSDEEP

49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	264	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2692	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2692	schtasks.exe	30

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/2644-3-0x000000001B580000-0x000000001B6AE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2392	powershell.exe
2624	powershell.exe
1916	powershell.exe
1504	powershell.exe
2000	powershell.exe
2072	powershell.exe
2580	powershell.exe
316	powershell.exe
296	powershell.exe
1368	powershell.exe
2560	powershell.exe
2400	powershell.exe

Executes dropped EXE 12 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

pid	Process
1396	winlogon.exe
2176	winlogon.exe
2104	winlogon.exe
1336	winlogon.exe
2644	winlogon.exe
2372	winlogon.exe
3048	winlogon.exe
1020	winlogon.exe
2964	winlogon.exe
2120	winlogon.exe
2372	winlogon.exe
2336	winlogon.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

winlogon.exewinlogon.exe6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Drops file in Program Files directory 8 IoCs

Processes:

6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\services.exe	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
File created	C:\Program Files (x86)\Windows Portable Devices\c5b4cb5e9653cc	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
File opened for modification	C:\Program Files\Internet Explorer\es-ES\RCXDA8.tmp	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX2D49.tmp	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\services.exe	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
File created	C:\Program Files\Internet Explorer\es-ES\csrss.exe	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
File opened for modification	C:\Program Files\Internet Explorer\es-ES\csrss.exe	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
File created	C:\Program Files\Internet Explorer\es-ES\886983d96e3d3e	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe

Drops file in Windows directory 4 IoCs

Processes:

6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe

description	ioc	Process
File created	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\winlogon.exe	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
File created	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\cc11b995f2a76d	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
File opened for modification	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\RCX1C50.tmp	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
File opened for modification	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\winlogon.exe	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
1820	schtasks.exe
1668	schtasks.exe
568	schtasks.exe
1384	schtasks.exe
2356	schtasks.exe
1636	schtasks.exe
1708	schtasks.exe
2676	schtasks.exe
2788	schtasks.exe
2540	schtasks.exe
1672	schtasks.exe
2916	schtasks.exe
904	schtasks.exe
2172	schtasks.exe
1532	schtasks.exe
2108	schtasks.exe
2240	schtasks.exe
2184	schtasks.exe
1656	schtasks.exe
2412	schtasks.exe
2416	schtasks.exe
1752	schtasks.exe
2592	schtasks.exe
2604	schtasks.exe
2224	schtasks.exe
2952	schtasks.exe
1664	schtasks.exe
532	schtasks.exe
264	schtasks.exe
2016	schtasks.exe
2136	schtasks.exe
1360	schtasks.exe
2476	schtasks.exe
2580	schtasks.exe
2560	schtasks.exe
2244	schtasks.exe
2448	schtasks.exe
1488	schtasks.exe
2424	schtasks.exe
1944	schtasks.exe
1616	schtasks.exe
2520	schtasks.exe
860	schtasks.exe
2248	schtasks.exe
2600	schtasks.exe
2628	schtasks.exe
1396	schtasks.exe
2316	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

pid	Process
2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
2580	powershell.exe
2000	powershell.exe
296	powershell.exe
1504	powershell.exe
316	powershell.exe
2560	powershell.exe
2624	powershell.exe
1916	powershell.exe
2072	powershell.exe
1368	powershell.exe
2400	powershell.exe
2392	powershell.exe
1396	winlogon.exe
2176	winlogon.exe
2104	winlogon.exe
1336	winlogon.exe
2644	winlogon.exe
2372	winlogon.exe
3048	winlogon.exe
1020	winlogon.exe
2964	winlogon.exe
2120	winlogon.exe
2372	winlogon.exe
2336	winlogon.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewinlogon.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

description	pid	Process
Token: SeDebugPrivilege	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	296	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	316	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	1396	winlogon.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	2072	powershell.exe
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	2176	winlogon.exe
Token: SeDebugPrivilege	2104	winlogon.exe
Token: SeDebugPrivilege	1336	winlogon.exe
Token: SeDebugPrivilege	2644	winlogon.exe
Token: SeDebugPrivilege	2372	winlogon.exe
Token: SeDebugPrivilege	3048	winlogon.exe
Token: SeDebugPrivilege	1020	winlogon.exe
Token: SeDebugPrivilege	2964	winlogon.exe
Token: SeDebugPrivilege	2120	winlogon.exe
Token: SeDebugPrivilege	2372	winlogon.exe
Token: SeDebugPrivilege	2336	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exewinlogon.exeWScript.exewinlogon.exeWScript.exewinlogon.exeWScript.exe

description	pid	Process	procid_target
PID 2644 wrote to memory of 2392	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	79
PID 2644 wrote to memory of 2392	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	79
PID 2644 wrote to memory of 2392	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	79
PID 2644 wrote to memory of 2580	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	80
PID 2644 wrote to memory of 2580	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	80
PID 2644 wrote to memory of 2580	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	80
PID 2644 wrote to memory of 316	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	81
PID 2644 wrote to memory of 316	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	81
PID 2644 wrote to memory of 316	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	81
PID 2644 wrote to memory of 2624	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	82
PID 2644 wrote to memory of 2624	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	82
PID 2644 wrote to memory of 2624	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	82
PID 2644 wrote to memory of 296	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	84
PID 2644 wrote to memory of 296	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	84
PID 2644 wrote to memory of 296	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	84
PID 2644 wrote to memory of 1368	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	85
PID 2644 wrote to memory of 1368	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	85
PID 2644 wrote to memory of 1368	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	85
PID 2644 wrote to memory of 1916	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	86
PID 2644 wrote to memory of 1916	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	86
PID 2644 wrote to memory of 1916	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	86
PID 2644 wrote to memory of 2560	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	87
PID 2644 wrote to memory of 2560	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	87
PID 2644 wrote to memory of 2560	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	87
PID 2644 wrote to memory of 2400	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	88
PID 2644 wrote to memory of 2400	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	88
PID 2644 wrote to memory of 2400	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	88
PID 2644 wrote to memory of 1504	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	89
PID 2644 wrote to memory of 1504	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	89
PID 2644 wrote to memory of 1504	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	89
PID 2644 wrote to memory of 2000	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	90
PID 2644 wrote to memory of 2000	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	90
PID 2644 wrote to memory of 2000	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	90
PID 2644 wrote to memory of 2072	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	91
PID 2644 wrote to memory of 2072	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	91
PID 2644 wrote to memory of 2072	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	91
PID 2644 wrote to memory of 1396	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	102
PID 2644 wrote to memory of 1396	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	102
PID 2644 wrote to memory of 1396	2644	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe	102
PID 1396 wrote to memory of 1476	1396	winlogon.exe	104
PID 1396 wrote to memory of 1476	1396	winlogon.exe	104
PID 1396 wrote to memory of 1476	1396	winlogon.exe	104
PID 1396 wrote to memory of 556	1396	winlogon.exe	105
PID 1396 wrote to memory of 556	1396	winlogon.exe	105
PID 1396 wrote to memory of 556	1396	winlogon.exe	105
PID 1476 wrote to memory of 2176	1476	WScript.exe	106
PID 1476 wrote to memory of 2176	1476	WScript.exe	106
PID 1476 wrote to memory of 2176	1476	WScript.exe	106
PID 2176 wrote to memory of 988	2176	winlogon.exe	107
PID 2176 wrote to memory of 988	2176	winlogon.exe	107
PID 2176 wrote to memory of 988	2176	winlogon.exe	107
PID 2176 wrote to memory of 2032	2176	winlogon.exe	108
PID 2176 wrote to memory of 2032	2176	winlogon.exe	108
PID 2176 wrote to memory of 2032	2176	winlogon.exe	108
PID 988 wrote to memory of 2104	988	WScript.exe	109
PID 988 wrote to memory of 2104	988	WScript.exe	109
PID 988 wrote to memory of 2104	988	WScript.exe	109
PID 2104 wrote to memory of 848	2104	winlogon.exe	110
PID 2104 wrote to memory of 848	2104	winlogon.exe	110
PID 2104 wrote to memory of 848	2104	winlogon.exe	110
PID 2104 wrote to memory of 1768	2104	winlogon.exe	111
PID 2104 wrote to memory of 1768	2104	winlogon.exe	111
PID 2104 wrote to memory of 1768	2104	winlogon.exe	111
PID 848 wrote to memory of 1336	848	WScript.exe	112

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe
"C:\Users\Admin\AppData\Local\Temp\6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
  "C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1396
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8672dacd-a940-424e-8cc4-8c1950c0450e.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
      C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2176
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f6815a2-ecc9-4eb8-853e-0dc90e3628c8.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:988
      - C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2104
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5addf2b-e33e-47bd-8a59-b801b3c8cfa9.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:848
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1336
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\92657327-9d8a-45ce-85c4-54f02435a2be.vbs"
        9⤵
        
        PID:2012
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2644
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4ffdf79-55b8-48ab-9f82-92fce5376c8e.vbs"
        11⤵
        
        PID:2880
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2372
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\50c12924-f1ba-49cc-aa6f-342a286f0e0a.vbs"
        13⤵
        
        PID:2876
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3048
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d0c32c4-18ab-482b-84af-e0d3a11afded.vbs"
        15⤵
        
        PID:864
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f58ea56d-8737-4c34-b2f7-7ff39b4367a2.vbs"
        17⤵
        
        PID:2072
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\88def022-6136-45c4-bd52-db6b1c8c966b.vbs"
        19⤵
        
        PID:2368
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2120
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36ba73b4-a016-4b99-9bce-9e7431301ea6.vbs"
        21⤵
        
        PID:2276
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2372
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\49a260f7-e962-4ab9-a52e-1892fe10d3db.vbs"
        23⤵
        
        PID:2676
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe
        24⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2336
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d283112-9413-4f4e-a920-f0849b0dd1db.vbs"
        25⤵
        
        PID:1876
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c21cf230-c94b-4dc4-bdb8-e26bb98a0592.vbs"
        25⤵
        
        PID:1468
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e29fbf6-cf0c-4530-b722-32b396adc284.vbs"
        23⤵
        
        PID:3016
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af7187f8-8859-4c03-8a89-dfa1e6bc7a6a.vbs"
        21⤵
        
        PID:2788
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b83f8304-b9e5-4119-855d-1723753f1ef3.vbs"
        19⤵
        
        PID:792
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e36347c2-ef5a-4284-a4f2-6a88c3555c60.vbs"
        17⤵
        
        PID:1764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ca200088-c9d0-4769-a2d8-3b9fcd69a74e.vbs"
        15⤵
        
        PID:920
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\90d0b59c-177e-4ec9-b2d6-18dedcf79152.vbs"
        13⤵
        
        PID:2868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6ad46e63-06f1-440f-9ffd-855bc0b3c5c2.vbs"
        11⤵
        
        PID:1780
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a364c9fc-be53-4170-a176-71c3d784beb7.vbs"
        9⤵
        
        PID:2732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78d0e690-136d-40d9-b479-3a9e97a5a99a.vbs"
        7⤵
        
        PID:1768
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67dcf7fe-f4cf-4b1b-bc50-d99894e29003.vbs"
        5⤵
        
        PID:2032
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26b12dfb-eaee-4be8-a065-6320fedc1202.vbs"
    3⤵
    PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\es-ES\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c828906" /sc MINUTE /mo 5 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c828906" /sc MINUTE /mo 12 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Libraries\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Public\Libraries\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Libraries\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\26b12dfb-eaee-4be8-a065-6320fedc1202.vbs

Filesize
513B

MD5
bb28356b7112d650aca96850c1b7ba44

SHA1
03911dd315d6e0ffe1668da569e044f5bd3db2f0

SHA256
939c4ae502637711ad70a2ca2524b3ac4f0cf6f379d239b104ea6d077f4e1ed3

SHA512
f717b8e18a4d569f481019132c31f2f8276e078a685c03974cb2fa9e9067a48b1447e1a8b24173ef903229d43488fe079aae2676aeb9056fa65e89dd028a53cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\2d0c32c4-18ab-482b-84af-e0d3a11afded.vbs

Filesize
737B

MD5
8a28cd01c08d70e74e0ebb1ecb036d69

SHA1
6a90a9262504fc9a48694c8e0b6b56c180e632ac

SHA256
7d225728dbfdd0e709aa1401fdfcecec3594ce71071e93107d2f06ccb3532f77

SHA512
2fac2e6f24c7cc29e638c2873ad840845c2bad55dc71af11b8c3af8cb22b2de83930962dea4ace62d025d21977b971d7484fe4567cb108f8d0445133b93746a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2d283112-9413-4f4e-a920-f0849b0dd1db.vbs

Filesize
737B

MD5
7253418bfe3b584ee0f02f28f5f16947

SHA1
845b8239b7bcf3f0bd1779454f9642b8064f9d1b

SHA256
0f988ecd0d3cb22bfc31f16c8cf5e44c87b7a882600cc6332d7b2c3685b0e4c1

SHA512
b7acdecdcd450519920083eea221e270de9d20087e2fb51474b3cc62f3f124926208870ec86bf33c1cee2758ee3970e13e7d2168c49252a082d53d9244d0b8e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\36ba73b4-a016-4b99-9bce-9e7431301ea6.vbs

Filesize
737B

MD5
3890b304d0d0099030760b0fdee4374a

SHA1
0024dc6f460a5eef8e0e9c722c1f7e21b2a617fd

SHA256
384506d3fe105c4f862067bee55f05c3a3d0194c703df1c8b5f8fb996e2623db

SHA512
c6f080ef060f2668bb1bab02454ffea17ac26a6e4a46679496c065648b9c96688864c37cf5799f58655cc0bb89620bf82ee8f1e47eec16713fee0b9fb9196e8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\4f6815a2-ecc9-4eb8-853e-0dc90e3628c8.vbs

Filesize
737B

MD5
723a9ccaf16d05fe0698ea6d4d5355b1

SHA1
e75846e6460b61a7c132aab5c3f2b9362a8789ad

SHA256
538d69cf8e4a6e71a9b6eaac201a9410d5dc5fd1ee49b11577dfffe120d626c3

SHA512
35d95ad237a0cbdc6e7980838ae00fc48dc26de5b8c90ba302ed73f7008b9e702bf3c29ea0d58c693fbad716471fe803b4f85f1030bb2d0a5ad6e5b39a688615

Download Submit
C:\Users\Admin\AppData\Local\Temp\50c12924-f1ba-49cc-aa6f-342a286f0e0a.vbs

Filesize
737B

MD5
40d6fb1e9a8fa287b92384c6158c9873

SHA1
38c9fa77365a586989362e3ac7fa9a4c60dea8d3

SHA256
5484c5b675153f7878437179c6430f43921ab1a438c387beb694a323dcf1dc97

SHA512
9822a3b1e0a14a86252bb70f7c02ea542d17e69fc11bd3fdb43d660b284335b5546ebeb86b09ed61449381c64c076a4a90a4d436d66584fcd4fa90277a96231e

Download Submit
C:\Users\Admin\AppData\Local\Temp\8672dacd-a940-424e-8cc4-8c1950c0450e.vbs

Filesize
737B

MD5
7fb2b0f15e2283e2f2f50f391ef60f2f

SHA1
2f6feb80620c6f9ddb2576b1cea66cb8989a4a70

SHA256
fcc1105f11bc76c1e1feca097e563cee657adc414168528251eeea5dcb85265a

SHA512
78598bf774bd11c6a72339710a79a27b8bdebbca1c39d30d7b4b10b9a5dc2408d99bddfd559aa647a1c97915bc7e72cd30a8a2c7cf8f9be710a0704a7b82b4d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\88def022-6136-45c4-bd52-db6b1c8c966b.vbs

Filesize
737B

MD5
9302c353ee1e8d5edb86dc1deb44ae1d

SHA1
5d2a949f22e48b18c923590994996a5b3e15ba4a

SHA256
edc26825bafc8aacaf4bb2dd99db58a3a1bacef1ac3f3d576da1e741a49cfd4c

SHA512
54e39440d34ac025e7b51271fdab09b342bedba0e3e8f030ee9f72d97445b9f52e73738cc2988c9c4a60211c003e34184fcc87789c130a29039a752782141995

Download Submit
C:\Users\Admin\AppData\Local\Temp\92657327-9d8a-45ce-85c4-54f02435a2be.vbs

Filesize
737B

MD5
14145c16fc6a087c87140d19d56a8bbd

SHA1
933bd90d1dc7da9113f1ed2bf435bc7f7853105a

SHA256
6b9f7796d6c6c8a24caae267b4f11ccab4b12080fc670f872c9f7f3f5fa2fb4c

SHA512
6dee5ccd6ddb85979241b6ab43e8590043ae070abb43dad4ef17636bf410ad8204189b7adcc67b1771300a5e5a078d736d82f7e18e16556ad425a2be358b269c

Download Submit
C:\Users\Admin\AppData\Local\Temp\b4ffdf79-55b8-48ab-9f82-92fce5376c8e.vbs

Filesize
737B

MD5
b2cc418d3b23218a1f21b62e87fde264

SHA1
01300868ab6130f12403781b79dbeb44bb0a0f44

SHA256
d3ed5463a8dbcbcb679ddebfe743346dd76b306d056ae51372d1b11c5ce3ca73

SHA512
9dd2e963b661d3b570dcff80454489e5e85b972f77ef59a8c5fce18d753d06a985154000947b1d53dce50dc4bb64ee82a6df1c31b33edaa85ec7c5badece51cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\f58ea56d-8737-4c34-b2f7-7ff39b4367a2.vbs

Filesize
737B

MD5
22491dafe2b931f884076f1a077e252e

SHA1
1be57244e928766d517761748d2d9bb93253f4ce

SHA256
3d8f0d6b3f5668414cc2dabad77d10912e8046d68fd18de4809b08c242e8bab5

SHA512
739fdd0d9846635b551e7053938f162cca7b1421d2d64b4251ebf757b33fcb991e022cbd3630cb5c60bfa596219f1aa1ef705094ac821bf73434d3dc6668cbc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\f5addf2b-e33e-47bd-8a59-b801b3c8cfa9.vbs

Filesize
737B

MD5
c6e72bde532a131efd3b508dc7bebebc

SHA1
d8ffee7caaf0bfc60b88b13f0ed478f080f8df73

SHA256
62120efa8c227fff6046d87957cc16876cce6c5db88457ef86e4a5106bfaa377

SHA512
3dd33cb343d8a9e299641bac68491d2baa19c289d037240cc766920283c02e74bbd451a872da6c40b573dc11794acb5bfb4f711e74af886d60fbb8b2107cdb84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp400C.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\14YLJLD6OS5OR9K6OU5T.temp

Filesize
7KB

MD5
6eaca5505359e118bf2e769fd37983e7

SHA1
d2c59150014eb3687c10afcd67a96ef699336f62

SHA256
8c3a648093c4990863cf6179ae79a875adac861e8c8d13e39177db6cbd974e50

SHA512
3a77cc9cb59f8610182b2d8ad869121d03bbb840f788187c588aa6ea1e03ac604fd46c057a03167b5cd72c17c5ef155df59e11c81a1809e535fd4013f8dc01a9

Download Submit
C:\Users\Default\RCX28D4.tmp

Filesize
4.9MB

MD5
e0391ebecb67aded879c3c47ddb3ce8c

SHA1
97251895c8d9af2a469144211c5192eaa447942d

SHA256
3119acaec15b3f4d144b6daafed467f7070ec2831a71586fa6d1faebe11c54b9

SHA512
a6f7918c4bfec2f0b37519db373f2ba339f4f15819abb123c43c1f57edae630ae84f7b3eec3c786d56693b5d4df47c516602c64167feaf32560d22402c103311

Download Submit
C:\Users\Public\Libraries\explorer.exe

Filesize
4.9MB

MD5
98f6d1c7482e03953bd88b57feb7d6b0

SHA1
437f469f92fea1fe222fb031353065152eb4d95e

SHA256
6b446d1d3f1ed5c7cc712e7c6516ad5e620a94eadb0023abb3961afc17c82890

SHA512
240e23c6a92008588b5e70969bbc94b2adfb12fb74e5f31ee4d3fc3b918b160bb13868ab29f14b29029a5889f0aff635a97507c6c1ae13dcadaaa6998d6f8165

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/296-188-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/1020-338-0x00000000000B0000-0x00000000005A4000-memory.dmp

Filesize
5.0MB

Download
memory/1336-277-0x0000000000230000-0x0000000000724000-memory.dmp

Filesize
5.0MB

Download
memory/1396-184-0x0000000001250000-0x0000000001744000-memory.dmp

Filesize
5.0MB

Download
memory/2104-262-0x00000000008B0000-0x0000000000DA4000-memory.dmp

Filesize
5.0MB

Download
memory/2120-369-0x0000000000A10000-0x0000000000F04000-memory.dmp

Filesize
5.0MB

Download
memory/2176-247-0x0000000000070000-0x0000000000564000-memory.dmp

Filesize
5.0MB

Download
memory/2372-384-0x0000000000CD0000-0x00000000011C4000-memory.dmp

Filesize
5.0MB

Download
memory/2372-308-0x00000000003B0000-0x00000000008A4000-memory.dmp

Filesize
5.0MB

Download
memory/2580-187-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/2644-9-0x0000000000B90000-0x0000000000B9A000-memory.dmp

Filesize
40KB

Download
memory/2644-6-0x0000000000940000-0x0000000000950000-memory.dmp

Filesize
64KB

Download
memory/2644-11-0x0000000002450000-0x000000000245A000-memory.dmp

Filesize
40KB

Download
memory/2644-13-0x0000000002470000-0x000000000247E000-memory.dmp

Filesize
56KB

Download
memory/2644-10-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/2644-0-0x000007FEF5FE3000-0x000007FEF5FE4000-memory.dmp

Filesize
4KB

Download
memory/2644-15-0x0000000002510000-0x0000000002518000-memory.dmp

Filesize
32KB

Download
memory/2644-174-0x000007FEF5FE0000-0x000007FEF69CC000-memory.dmp

Filesize
9.9MB

Download
memory/2644-8-0x00000000009D0000-0x00000000009E0000-memory.dmp

Filesize
64KB

Download
memory/2644-292-0x00000000008C0000-0x0000000000DB4000-memory.dmp

Filesize
5.0MB

Download
memory/2644-293-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/2644-7-0x0000000000B70000-0x0000000000B86000-memory.dmp

Filesize
88KB

Download
memory/2644-14-0x0000000002500000-0x0000000002508000-memory.dmp

Filesize
32KB

Download
memory/2644-12-0x0000000002460000-0x000000000246E000-memory.dmp

Filesize
56KB

Download
memory/2644-1-0x0000000000310000-0x0000000000804000-memory.dmp

Filesize
5.0MB

Download
memory/2644-5-0x0000000000930000-0x0000000000938000-memory.dmp

Filesize
32KB

Download
memory/2644-160-0x000007FEF5FE0000-0x000007FEF69CC000-memory.dmp

Filesize
9.9MB

Download
memory/2644-4-0x0000000000910000-0x000000000092C000-memory.dmp

Filesize
112KB

Download
memory/2644-16-0x0000000002520000-0x000000000252C000-memory.dmp

Filesize
48KB

Download
memory/2644-2-0x000007FEF5FE0000-0x000007FEF69CC000-memory.dmp

Filesize
9.9MB

Download
memory/2644-3-0x000000001B580000-0x000000001B6AE000-memory.dmp

Filesize
1.2MB

Download
memory/2644-150-0x000007FEF5FE3000-0x000007FEF5FE4000-memory.dmp

Filesize
4KB

Download
memory/2964-354-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

Filesize
72KB

Download
memory/2964-353-0x0000000000100000-0x00000000005F4000-memory.dmp

Filesize
5.0MB

Download
memory/3048-323-0x0000000001140000-0x0000000001634000-memory.dmp

Filesize
5.0MB

Download