dcrat | a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-10-2024 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
Size

4.9MB
MD5

7faed207d5f74070e86f9f0b67985bd7
SHA1

dc6e45da39c6e7bd949c70b768006b23a424f238
SHA256

a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b
SHA512

615da33c5d754be2e9f9ee43c766cbb248fd701d92933484d0c8cc6f7764063e6238da368a50ae31d3a88c3437338ad039c4d801a3f43f5554706861bec97057
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	332	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	2752	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2752	schtasks.exe	30

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2528-3-0x000000001B6F0000-0x000000001B81E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
816	powershell.exe
756	powershell.exe
1708	powershell.exe
896	powershell.exe
848	powershell.exe
2376	powershell.exe
1424	powershell.exe
1960	powershell.exe
1252	powershell.exe
2336	powershell.exe
2044	powershell.exe
2036	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
1608	explorer.exe
1176	explorer.exe
1620	explorer.exe
2724	explorer.exe
2860	explorer.exe
2424	explorer.exe
2836	explorer.exe
2904	explorer.exe
1312	explorer.exe
1524	explorer.exe
2876	explorer.exe
584	explorer.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\es-ES\smss.exe	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
File created	C:\Program Files (x86)\Windows Sidebar\es-ES\69ddcba757bf72	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
File opened for modification	C:\Program Files\Windows Sidebar\en-US\RCXBC16.tmp	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\explorer.exe	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\es-ES\RCXB791.tmp	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\es-ES\smss.exe	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
File opened for modification	C:\Program Files\Windows Sidebar\en-US\lsass.exe	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\RCXC08A.tmp	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
File created	C:\Program Files\Windows Sidebar\en-US\lsass.exe	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
File created	C:\Program Files\Windows Sidebar\en-US\6203df4a6bafc7	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
File created	C:\Program Files\Windows Defender\en-US\explorer.exe	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
File created	C:\Program Files\Windows Defender\en-US\7a0fd90576e088	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Offline Web Pages\RCXBE19.tmp	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
File opened for modification	C:\Windows\Offline Web Pages\WmiPrvSE.exe	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
File created	C:\Windows\Boot\spoolsv.exe	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
File created	C:\Windows\Offline Web Pages\WmiPrvSE.exe	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
File created	C:\Windows\Offline Web Pages\24dbde2999530e	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2848	schtasks.exe
2636	schtasks.exe
2924	schtasks.exe
1644	schtasks.exe
2908	schtasks.exe
2488	schtasks.exe
2664	schtasks.exe
2056	schtasks.exe
1572	schtasks.exe
3016	schtasks.exe
1444	schtasks.exe
2804	schtasks.exe
2736	schtasks.exe
2608	schtasks.exe
332	schtasks.exe
1796	schtasks.exe
2632	schtasks.exe
3048	schtasks.exe
1724	schtasks.exe
2700	schtasks.exe
2764	schtasks.exe
2160	schtasks.exe
3060	schtasks.exe
2084	schtasks.exe
1532	schtasks.exe
3036	schtasks.exe
2156	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
1960	powershell.exe
2044	powershell.exe
2036	powershell.exe
2376	powershell.exe
848	powershell.exe
896	powershell.exe
2336	powershell.exe
756	powershell.exe
1252	powershell.exe
1424	powershell.exe
816	powershell.exe
1708	powershell.exe
1608	explorer.exe
1176	explorer.exe
1620	explorer.exe
2724	explorer.exe
2860	explorer.exe
2424	explorer.exe
2836	explorer.exe
2904	explorer.exe
1312	explorer.exe
1524	explorer.exe
2876	explorer.exe
584	explorer.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	848	powershell.exe
Token: SeDebugPrivilege	896	powershell.exe
Token: SeDebugPrivilege	2336	powershell.exe
Token: SeDebugPrivilege	756	powershell.exe
Token: SeDebugPrivilege	1252	powershell.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	816	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	1608	explorer.exe
Token: SeDebugPrivilege	1176	explorer.exe
Token: SeDebugPrivilege	1620	explorer.exe
Token: SeDebugPrivilege	2724	explorer.exe
Token: SeDebugPrivilege	2860	explorer.exe
Token: SeDebugPrivilege	2424	explorer.exe
Token: SeDebugPrivilege	2836	explorer.exe
Token: SeDebugPrivilege	2904	explorer.exe
Token: SeDebugPrivilege	1312	explorer.exe
Token: SeDebugPrivilege	1524	explorer.exe
Token: SeDebugPrivilege	2876	explorer.exe
Token: SeDebugPrivilege	584	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2036	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	58
PID 2528 wrote to memory of 2036	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	58
PID 2528 wrote to memory of 2036	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	58
PID 2528 wrote to memory of 1424	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	59
PID 2528 wrote to memory of 1424	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	59
PID 2528 wrote to memory of 1424	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	59
PID 2528 wrote to memory of 1960	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	60
PID 2528 wrote to memory of 1960	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	60
PID 2528 wrote to memory of 1960	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	60
PID 2528 wrote to memory of 2376	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	61
PID 2528 wrote to memory of 2376	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	61
PID 2528 wrote to memory of 2376	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	61
PID 2528 wrote to memory of 1252	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	62
PID 2528 wrote to memory of 1252	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	62
PID 2528 wrote to memory of 1252	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	62
PID 2528 wrote to memory of 2336	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	63
PID 2528 wrote to memory of 2336	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	63
PID 2528 wrote to memory of 2336	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	63
PID 2528 wrote to memory of 816	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	64
PID 2528 wrote to memory of 816	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	64
PID 2528 wrote to memory of 816	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	64
PID 2528 wrote to memory of 2044	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	65
PID 2528 wrote to memory of 2044	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	65
PID 2528 wrote to memory of 2044	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	65
PID 2528 wrote to memory of 756	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	66
PID 2528 wrote to memory of 756	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	66
PID 2528 wrote to memory of 756	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	66
PID 2528 wrote to memory of 1708	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	67
PID 2528 wrote to memory of 1708	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	67
PID 2528 wrote to memory of 1708	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	67
PID 2528 wrote to memory of 896	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	68
PID 2528 wrote to memory of 896	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	68
PID 2528 wrote to memory of 896	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	68
PID 2528 wrote to memory of 848	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	69
PID 2528 wrote to memory of 848	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	69
PID 2528 wrote to memory of 848	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	69
PID 2528 wrote to memory of 1608	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	82
PID 2528 wrote to memory of 1608	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	82
PID 2528 wrote to memory of 1608	2528	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe	82
PID 1608 wrote to memory of 2140	1608	explorer.exe	84
PID 1608 wrote to memory of 2140	1608	explorer.exe	84
PID 1608 wrote to memory of 2140	1608	explorer.exe	84
PID 1608 wrote to memory of 2968	1608	explorer.exe	85
PID 1608 wrote to memory of 2968	1608	explorer.exe	85
PID 1608 wrote to memory of 2968	1608	explorer.exe	85
PID 2140 wrote to memory of 1176	2140	WScript.exe	86
PID 2140 wrote to memory of 1176	2140	WScript.exe	86
PID 2140 wrote to memory of 1176	2140	WScript.exe	86
PID 1176 wrote to memory of 2776	1176	explorer.exe	87
PID 1176 wrote to memory of 2776	1176	explorer.exe	87
PID 1176 wrote to memory of 2776	1176	explorer.exe	87
PID 1176 wrote to memory of 2756	1176	explorer.exe	88
PID 1176 wrote to memory of 2756	1176	explorer.exe	88
PID 1176 wrote to memory of 2756	1176	explorer.exe	88
PID 2776 wrote to memory of 1620	2776	WScript.exe	89
PID 2776 wrote to memory of 1620	2776	WScript.exe	89
PID 2776 wrote to memory of 1620	2776	WScript.exe	89
PID 1620 wrote to memory of 1112	1620	explorer.exe	90
PID 1620 wrote to memory of 1112	1620	explorer.exe	90
PID 1620 wrote to memory of 1112	1620	explorer.exe	90
PID 1620 wrote to memory of 1504	1620	explorer.exe	91
PID 1620 wrote to memory of 1504	1620	explorer.exe	91
PID 1620 wrote to memory of 1504	1620	explorer.exe	91
PID 1112 wrote to memory of 2724	1112	WScript.exe	92

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe
"C:\Users\Admin\AppData\Local\Temp\a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:848
- C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe
  "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1608
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c5b4edc9-db85-4126-923a-46eebe362c7d.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe
      "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1176
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\49f2a248-c41f-456a-a061-81c64c345618.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2776
      - C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e9c50061-3f0b-423d-8150-ae818e8273ee.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2724
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\303280eb-ba4a-4870-9cb6-4b091b92195c.vbs"
        9⤵
        
        PID:2736
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2860
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\afe7ed3b-096a-4188-a1f1-965425c03bd7.vbs"
        11⤵
        
        PID:1856
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2424
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\120a6364-ab45-4953-9de2-1acf76c5ff10.vbs"
        13⤵
        
        PID:2076
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f756c1b3-706c-4e23-9f51-4da5719532f2.vbs"
        15⤵
        
        PID:2164
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2904
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d927e870-8fc7-4b37-9853-16a9e5e92587.vbs"
        17⤵
        
        PID:1724
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe"
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1312
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\03e7dd29-ec18-4722-88d7-267390708580.vbs"
        19⤵
        
        PID:2260
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe"
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1524
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1604cac6-730f-4f94-9453-bfe4d9a1f811.vbs"
        21⤵
        
        PID:924
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe"
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2876
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4966d58a-8947-476f-ad20-9c978f573453.vbs"
        23⤵
        
        PID:1208
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe"
        24⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44ad6a94-f46b-4b32-aa88-165f3272acf6.vbs"
        25⤵
        
        PID:756
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\061faaf8-92bf-4e1a-8f56-810ca3b57ac2.vbs"
        25⤵
        
        PID:2984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91f9de50-59fe-4fbb-855e-5e17bb685812.vbs"
        23⤵
        
        PID:2384
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e57ec047-7f11-4a4e-8eb7-3c5f2238b775.vbs"
        21⤵
        
        PID:1280
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ae660a0-4db8-4cfc-a0a6-574c142faeb2.vbs"
        19⤵
        
        PID:2744
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc54b85d-d6a5-4fc2-87f5-17381ef9c4f9.vbs"
        17⤵
        
        PID:2668
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76c37baa-a1a5-4a58-8fd2-15c90daddc11.vbs"
        15⤵
        
        PID:2104
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8996141-1fe1-454d-82f5-ea50fcc6878b.vbs"
        13⤵
        
        PID:2556
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f64e521-3aa8-416c-ad18-632c80623573.vbs"
        11⤵
        
        PID:2320
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e7082b8d-c8f0-4a0d-8570-2f59ef4d588c.vbs"
        9⤵
        
        PID:1776
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\153e39bb-2032-4924-8f63-02430bf0caf4.vbs"
        7⤵
        
        PID:1504
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04e462d3-9006-4aaa-9c34-3a078ae01086.vbs"
        5⤵
        
        PID:2756
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0bb9a63-06c5-43a0-a538-3a5ff2ac5c4c.vbs"
    3⤵
    PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Users\Public\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Public\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Users\Public\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Microsoft Help\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft Help\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Microsoft Help\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Sidebar\en-US\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Windows\Offline Web Pages\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Windows\Offline Web Pages\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\en-US\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\en-US\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\en-US\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe

Filesize
4.9MB

MD5
96998172633cd95dc1e995c2c7bc8fbe

SHA1
8b5df05e0e8ab29fbb56c1a57e8397d6ff36906e

SHA256
26674787bf8cb33d5c60ccb2a21cb753b4d3e063de7997228c6a285102da09fb

SHA512
1580767cde21675ec183e5b3b05b3b705c3155ded875bcc6d70a13ba8ea3b6b0ca9bfded5b6b466c9772dc48e30240f9a234c933fe50ad4be8e583483a87cbde

Download Submit
C:\ProgramData\Adobe\Acrobat\9.0\Replicate\dwm.exe

Filesize
4.9MB

MD5
7faed207d5f74070e86f9f0b67985bd7

SHA1
dc6e45da39c6e7bd949c70b768006b23a424f238

SHA256
a59ee5da5832f84997cb73323970bdd1b0726255079d0a0bcccdf517b685776b

SHA512
615da33c5d754be2e9f9ee43c766cbb248fd701d92933484d0c8cc6f7764063e6238da368a50ae31d3a88c3437338ad039c4d801a3f43f5554706861bec97057

Download Submit
C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\RCXC2FB.tmp

Filesize
4.9MB

MD5
f0edd34aafbd17e44f09a444c1cef533

SHA1
8945bf441324eb43ab6fb8c7a801a4aa4bb10538

SHA256
f41555de5a6dfc3f1089a6709e106ae36f3863c622a6f6fd9017d7fd6d1a340e

SHA512
ac996ddb75cfc1314ef339a7975b13638d7428a826ec1360643554964ded831e0a2bd7fe5dd9c1f999aed867725b7e25a91e9c1937432e7a5d767146d3ed361d

Download Submit
C:\Users\Admin\AppData\Local\Temp\03e7dd29-ec18-4722-88d7-267390708580.vbs

Filesize
751B

MD5
a58286df36609866b60fbe1128b13452

SHA1
e12b20f94eb4f32eb2579fc2dabd0213c19dc019

SHA256
24d3d68fa9ca0fcb6bdbcbca5b8720e4c45f80268fbe7c23f98bf56df65f6177

SHA512
202e044cb694dcfc7c45eb51837c46990874cc9cbc9ab6ee2fac8689d3b2e6fc2660689e2c75ab2376092732d83fecab03534d1adae690454d1d3aa123ad8c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\120a6364-ab45-4953-9de2-1acf76c5ff10.vbs

Filesize
751B

MD5
541dd71a8898d074d1f912af1b058dd9

SHA1
a89eddb921738a3dedba8abeb27b2a100ade5323

SHA256
a639409c40ab4e63172c921ca4d70ae8b897adeca5c440e75e2af4ad78a0b2df

SHA512
fcb57a2877b3269de9eca3d3b89d797fb8e838415371da8bade65f4ff0b4b1916ffb9dc8222942f91e9d0ee7e9ed7b7969dbe77a2b9e3bb35399a97ad7d12f61

Download Submit
C:\Users\Admin\AppData\Local\Temp\1604cac6-730f-4f94-9453-bfe4d9a1f811.vbs

Filesize
751B

MD5
bdc08c3cda03334db9307abe3f04d6d5

SHA1
5ff093db7545b0469c984108afd11c6d93233c18

SHA256
25f568cc53f8ba00fcfd46ed5c9b714a3abd5134c9e30ebb30057a0d55877770

SHA512
c5dff22552b03b544b9c36f465421975cfc09b84994e1c958dcee58f7378fde471cd49bcacdcd97281ed36bfd812a5071008a535b4f0d67fb286c0351d173495

Download Submit
C:\Users\Admin\AppData\Local\Temp\303280eb-ba4a-4870-9cb6-4b091b92195c.vbs

Filesize
751B

MD5
857e8520f19db2701e4735669835a73e

SHA1
c78f7c76f9f2c0bf3fc2a147d8d3e96b1d1001ae

SHA256
eb5cda96e4d303ecf73d1e0f6c9ad4950873968afe5ad8030eee872c4be4975f

SHA512
fc54c6aef9cf9bf1dcf9c4165b0ba8909ed0c0ca98f1679930b0b323f0513b35d7c43fc31e5b07e79677f1f30951c333a157883505a3d39f77504ffcb07064cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\44ad6a94-f46b-4b32-aa88-165f3272acf6.vbs

Filesize
750B

MD5
84b32a2444de17db23277af27a04dc80

SHA1
ec4a9c8cc3938ecdbec8e004b9575b79abe111be

SHA256
14ac29301820056ac6088f46d054c0218f4d4c0688081f50bd3c49b8609ab693

SHA512
1f3caf865a452c2e89291e1a470434079b7f77fcf2ab13e9d1805a98235481ecce1066875a85e57496d17bcc4e96364bc36e8eb6e48cb0ff175cdde0f1283820

Download Submit
C:\Users\Admin\AppData\Local\Temp\4966d58a-8947-476f-ad20-9c978f573453.vbs

Filesize
751B

MD5
4d7c9da6c59f997f7862d630f8a901a7

SHA1
54cfd0daf882b5a8203001896a14b1d5e502d9c4

SHA256
77c06800bbdd0d2b3e6894f655dc279bdd2f20c32b9296d7802becbfcbe7757e

SHA512
6e01b24f52d02bbf81a66442202dd7aca4c838ffbb00678375ac695840e770a6467626567b7ed8d00057418513ec6d034594645de0685e567e13bf35844f291b

Download Submit
C:\Users\Admin\AppData\Local\Temp\49f2a248-c41f-456a-a061-81c64c345618.vbs

Filesize
751B

MD5
cebeb7494bed61e42ca095175d3506f6

SHA1
40455580fa0f6e9432550ad6cb5e7e212858a90d

SHA256
a4c4686d172b420c2d32a3e83770686a281d8e07141c875d44fbe59265b02218

SHA512
8daeaaa0688614a6e978f9108f39c026ea99d75816743454a2f372a1abe48b4f292bcea503e74f736d0dd2599eae2128aace526f33d849b4fa524b932b1cc59b

Download Submit
C:\Users\Admin\AppData\Local\Temp\afe7ed3b-096a-4188-a1f1-965425c03bd7.vbs

Filesize
751B

MD5
8167a5c285a285a71ae0061a5a639068

SHA1
7e752ce38d4d9f7b09cf2912ed84f9095600dde0

SHA256
55d86468657bb463fdba0e6b683faf7db45cc182ae038336a0221dcc28ffc572

SHA512
8b680f98bb906e1f7dcb88967924c03703b3d6653239d5ea28a46ebf03bf472ca6c7b5193e001aef74222e496a93e488d682ff8d125f117939f82e57996763f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\c0bb9a63-06c5-43a0-a538-3a5ff2ac5c4c.vbs

Filesize
527B

MD5
c72d2b63af3b3c848e81b98a8124368d

SHA1
c353bd966df183238e60716c0ca1572ecf190b21

SHA256
dc63c798367fe8827034795d9a3d431b6e7b6a81f9b323f99bf72c98bde5cdfa

SHA512
f727bb060506af7314c543c7ca3df08415cc7ea02403ea605079c19b3cb4418710ac35653e142b86992ad18019b3cf4e2e193fd07c7c162c4bafc33da9b924ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5b4edc9-db85-4126-923a-46eebe362c7d.vbs

Filesize
751B

MD5
bb049cb881e55402d0abb70a6589b04f

SHA1
22b3859e377104bb552d4b77e847f263eb2a1b45

SHA256
0068dcbe2decfd57c5da7300b0da1611b474332cc788c0dd27fcdeb2933c0c25

SHA512
93d5da5dcbd2048682e01ecb7fd7589413af6a888c6bc53a8674063b016f179e91af53ad09ddb0e3dbd97af9c8d9d0bc6d6d918441aeae6cf589589cedb4fb9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\d927e870-8fc7-4b37-9853-16a9e5e92587.vbs

Filesize
751B

MD5
a2940264effff3d2a84b72ed83a58e8f

SHA1
0e6f60e5339fe179d7f190f74c3f3aefe6a57c8a

SHA256
e1f11eaffc0a322aee74d0b9139a709f8828e09bfc4b8d0f1f5da0082ff65adb

SHA512
ceef78933a98e02ff49c1d527e954ba6feabfaa2f8adc6e48cb98b8995bfcb9137397198e7b65c9096f44c3d5cc8b18c09316d779326b055b71c548c1b8cabff

Download Submit
C:\Users\Admin\AppData\Local\Temp\e9c50061-3f0b-423d-8150-ae818e8273ee.vbs

Filesize
751B

MD5
a3dba0a9472de63ca343d8223fd91e53

SHA1
62790983f0dbdbcd649fffccb9e73b59d0bc27af

SHA256
04291fd95f281cffca974ebc8ce7a2a7da8d699d8a86fc719cafc8e0a074e84a

SHA512
bec35abd06bd95784439a83ef920340c2b61ee9a0c13b8d14b115a87ccd95308b3dfd454fd118ee9de2daff23a10f3e1a5ccf86706a22e32d7ba1eb89b1647ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\f756c1b3-706c-4e23-9f51-4da5719532f2.vbs

Filesize
751B

MD5
86d30e66c153c3e9856eca22e3d2f6ca

SHA1
7e1afc763324609309f1aafd9a5b9f246b1487bf

SHA256
29846f39ca10239aa5d430b9a9c50ac28dc9136bb65309ad4c638d1deddc533b

SHA512
994984963de27f0e4f208017582b02913cc73d2ed3d3756569db47d692ee2f81cc657d5e68f1aa37ce205a8fdac9c0c071232f98e3b6deca453c73f342385543

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD48E.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
22ec88e415b484a922e57143b5631373

SHA1
803d1420e26ec680470a70b7958d53ab5a122e3c

SHA256
733a558554a36d772d5d72c641c4cba0f61a29e1593f11854def775448c3574b

SHA512
31775cb2ef3c5380ce6fe4bb25d150994f2ffd74c0ef8cb5b22bc200a1c74fdfd41aee378ee3a938c8960c794c314ad1bab32a13a27e4a921fbf11eb10eb30eb

Download Submit
memory/1176-163-0x0000000000C30000-0x0000000001124000-memory.dmp

Filesize
5.0MB

Download
memory/1524-280-0x0000000001330000-0x0000000001824000-memory.dmp

Filesize
5.0MB

Download
memory/1608-148-0x0000000000260000-0x0000000000754000-memory.dmp

Filesize
5.0MB

Download
memory/1620-178-0x00000000012C0000-0x00000000017B4000-memory.dmp

Filesize
5.0MB

Download
memory/1960-104-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/1960-112-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/2528-11-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

Filesize
40KB

Download
memory/2528-3-0x000000001B6F0000-0x000000001B81E000-memory.dmp

Filesize
1.2MB

Download
memory/2528-12-0x0000000000BF0000-0x0000000000BFE000-memory.dmp

Filesize
56KB

Download
memory/2528-149-0x000007FEF6640000-0x000007FEF702C000-memory.dmp

Filesize
9.9MB

Download
memory/2528-4-0x00000000002B0000-0x00000000002CC000-memory.dmp

Filesize
112KB

Download
memory/2528-13-0x0000000000C00000-0x0000000000C0E000-memory.dmp

Filesize
56KB

Download
memory/2528-5-0x00000000002D0000-0x00000000002D8000-memory.dmp

Filesize
32KB

Download
memory/2528-6-0x0000000000460000-0x0000000000470000-memory.dmp

Filesize
64KB

Download
memory/2528-8-0x0000000000490000-0x00000000004A0000-memory.dmp

Filesize
64KB

Download
memory/2528-0-0x000007FEF6643000-0x000007FEF6644000-memory.dmp

Filesize
4KB

Download
memory/2528-10-0x0000000000BD0000-0x0000000000BE2000-memory.dmp

Filesize
72KB

Download
memory/2528-7-0x0000000000470000-0x0000000000486000-memory.dmp

Filesize
88KB

Download
memory/2528-9-0x0000000000BC0000-0x0000000000BCA000-memory.dmp

Filesize
40KB

Download
memory/2528-1-0x0000000000F30000-0x0000000001424000-memory.dmp

Filesize
5.0MB

Download
memory/2528-16-0x0000000000CB0000-0x0000000000CBC000-memory.dmp

Filesize
48KB

Download
memory/2528-15-0x0000000000CA0000-0x0000000000CA8000-memory.dmp

Filesize
32KB

Download
memory/2528-2-0x000007FEF6640000-0x000007FEF702C000-memory.dmp

Filesize
9.9MB

Download
memory/2528-14-0x0000000000C90000-0x0000000000C98000-memory.dmp

Filesize
32KB

Download
memory/2724-193-0x00000000012B0000-0x00000000012C2000-memory.dmp

Filesize
72KB

Download
memory/2836-237-0x0000000000A20000-0x0000000000A32000-memory.dmp

Filesize
72KB

Download
memory/2836-236-0x0000000000160000-0x0000000000654000-memory.dmp

Filesize
5.0MB

Download