colibri | 991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2024 02:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Size

4.9MB
MD5

b5578d55623a79cf105d62dc41402e67
SHA1

2914b5f5b47c4d4e7ab756aa8529a1648df22947
SHA256

991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b
SHA512

09160ba1ef2cfdac9a125cc4660ccc0b4a6b01f7b7334494cdda34fd9845e8b70fe4eae96d2d2a1a63d839c0593ba144176f8754311a5dd8237ce92e4040477e
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri

DcRat 32 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		3952	schtasks.exe
		5012	schtasks.exe
		3308	schtasks.exe
		1552	schtasks.exe
		4556	schtasks.exe
		1060	schtasks.exe
		4604	schtasks.exe
		4664	schtasks.exe
		208	schtasks.exe
		3040	schtasks.exe
		4488	schtasks.exe
		1816	schtasks.exe
File created	C:\Windows\PrintDialog\microsoft.system.package.metadata\56085415360792		991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
		1836	schtasks.exe
		380	schtasks.exe
		864	schtasks.exe
		1564	schtasks.exe
		3444	schtasks.exe
		1492	schtasks.exe
		1528	schtasks.exe
		1064	schtasks.exe
		4480	schtasks.exe
		5108	schtasks.exe
		3888	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
		4812	schtasks.exe
		1652	schtasks.exe
		388	schtasks.exe
		4236	schtasks.exe
		396	schtasks.exe
		2716	schtasks.exe
		3224	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3224	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3308	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	5036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	5036	schtasks.exe	87

UAC bypass 3 TTPs 45 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1796-3-0x000000001B8D0000-0x000000001B9FE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2604	powershell.exe
2324	powershell.exe
5100	powershell.exe
872	powershell.exe
1104	powershell.exe
3596	powershell.exe
4468	powershell.exe
3916	powershell.exe
620	powershell.exe
3608	powershell.exe
4352	powershell.exe
432	powershell.exe
4996	powershell.exe
2128	powershell.exe
3900	powershell.exe
1600	powershell.exe
2984	powershell.exe
1252	powershell.exe
1608	powershell.exe
4228	powershell.exe
1792	powershell.exe
3668	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	conhost.exe

Executes dropped EXE 42 IoCs

pid	Process
1108	tmpB0A6.tmp.exe
5116	tmpB0A6.tmp.exe
4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
4876	tmpD6C8.tmp.exe
3600	tmpD6C8.tmp.exe
5540	conhost.exe
6136	tmpF2BC.tmp.exe
916	tmpF2BC.tmp.exe
5328	conhost.exe
5768	tmp125A.tmp.exe
5448	tmp125A.tmp.exe
5840	conhost.exe
5860	conhost.exe
3704	tmp6193.tmp.exe
1052	tmp6193.tmp.exe
6044	conhost.exe
1460	tmp7EDF.tmp.exe
2380	tmp7EDF.tmp.exe
1224	conhost.exe
5832	tmpAF85.tmp.exe
5488	tmpAF85.tmp.exe
1552	conhost.exe
1928	tmpDFCC.tmp.exe
1492	tmpDFCC.tmp.exe
2984	conhost.exe
4008	tmpFC3D.tmp.exe
2480	tmpFC3D.tmp.exe
5284	conhost.exe
5932	tmp2BAA.tmp.exe
4232	tmp2BAA.tmp.exe
1508	conhost.exe
4104	tmp48A8.tmp.exe
4924	tmp48A8.tmp.exe
3948	conhost.exe
440	tmp78EF.tmp.exe
3704	tmp78EF.tmp.exe
388	conhost.exe
5516	tmpA9D3.tmp.exe
5328	tmpA9D3.tmp.exe
2848	conhost.exe
3760	tmpD99D.tmp.exe
4408	tmpD99D.tmp.exe

Checks whether UAC is enabled 1 TTPs 30 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe

Suspicious use of SetThreadContext 14 IoCs

description	pid	Process	procid_target
PID 1108 set thread context of 5116	1108	tmpB0A6.tmp.exe	121
PID 4876 set thread context of 3600	4876	tmpD6C8.tmp.exe	155
PID 6136 set thread context of 916	6136	tmpF2BC.tmp.exe	188
PID 5768 set thread context of 5448	5768	tmp125A.tmp.exe	197
PID 3704 set thread context of 1052	3704	tmp6193.tmp.exe	213
PID 1460 set thread context of 2380	1460	tmp7EDF.tmp.exe	222
PID 5832 set thread context of 5488	5832	tmpAF85.tmp.exe	232
PID 1928 set thread context of 1492	1928	tmpDFCC.tmp.exe	241
PID 4008 set thread context of 2480	4008	tmpFC3D.tmp.exe	250
PID 5932 set thread context of 4232	5932	tmp2BAA.tmp.exe	260
PID 4104 set thread context of 4924	4104	tmp48A8.tmp.exe	273
PID 440 set thread context of 3704	440	tmp78EF.tmp.exe	286
PID 5516 set thread context of 5328	5516	tmpA9D3.tmp.exe	295
PID 3760 set thread context of 4408	3760	tmpD99D.tmp.exe	308

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\MSBuild\csrss.exe	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File created	C:\Program Files (x86)\MSBuild\886983d96e3d3e	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File created	C:\Program Files (x86)\MSBuild\5940a34987c991	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\OfficeClickToRun.exe	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\38384e6a620884	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File created	C:\Program Files (x86)\MSBuild\dllhost.exe	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File opened for modification	C:\Program Files (x86)\MSBuild\dllhost.exe	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File created	C:\Program Files (x86)\MSBuild\csrss.exe	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Migration\WTR\TextInputHost.exe	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File created	C:\Windows\Migration\WTR\22eafd247d37c3	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File created	C:\Windows\PrintDialog\microsoft.system.package.metadata\wininit.exe	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File created	C:\Windows\PrintDialog\microsoft.system.package.metadata\56085415360792	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File opened for modification	C:\Windows\PrintDialog\microsoft.system.package.metadata\RCXADC6.tmp	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File opened for modification	C:\Windows\PrintDialog\microsoft.system.package.metadata\wininit.exe	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File created	C:\Windows\TAPI\conhost.exe	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File created	C:\Windows\TAPI\088424020bedd6	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File opened for modification	C:\Windows\Migration\WTR\TextInputHost.exe	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
File opened for modification	C:\Windows\TAPI\conhost.exe	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF2BC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDFCC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp78EF.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA9D3.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB0A6.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpD6C8.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpFC3D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp48A8.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp7EDF.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpD99D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp125A.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp6193.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpAF85.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2BAA.tmp.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	conhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5012	schtasks.exe
1552	schtasks.exe
4604	schtasks.exe
1816	schtasks.exe
208	schtasks.exe
2716	schtasks.exe
5108	schtasks.exe
388	schtasks.exe
1060	schtasks.exe
4812	schtasks.exe
380	schtasks.exe
4488	schtasks.exe
3444	schtasks.exe
3888	schtasks.exe
1564	schtasks.exe
4480	schtasks.exe
1064	schtasks.exe
3952	schtasks.exe
3224	schtasks.exe
864	schtasks.exe
4556	schtasks.exe
396	schtasks.exe
1652	schtasks.exe
1528	schtasks.exe
3308	schtasks.exe
4236	schtasks.exe
3040	schtasks.exe
1492	schtasks.exe
1836	schtasks.exe
4664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
2324	powershell.exe
2324	powershell.exe
1792	powershell.exe
1792	powershell.exe
872	powershell.exe
872	powershell.exe
1104	powershell.exe
1104	powershell.exe
432	powershell.exe
432	powershell.exe
2128	powershell.exe
2128	powershell.exe
4352	powershell.exe
4352	powershell.exe
3596	powershell.exe
3596	powershell.exe
5100	powershell.exe
5100	powershell.exe
4228	powershell.exe
4228	powershell.exe
3608	powershell.exe
3608	powershell.exe
2128	powershell.exe
432	powershell.exe
3608	powershell.exe
2324	powershell.exe
4352	powershell.exe
872	powershell.exe
1792	powershell.exe
1104	powershell.exe
4228	powershell.exe
5100	powershell.exe
3596	powershell.exe
4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
1600	powershell.exe
1600	powershell.exe
3668	powershell.exe
3668	powershell.exe
4468	powershell.exe
4468	powershell.exe
1608	powershell.exe
1608	powershell.exe
3900	powershell.exe
3900	powershell.exe
620	powershell.exe
620	powershell.exe
1252	powershell.exe
1252	powershell.exe
2604	powershell.exe
2604	powershell.exe
4996	powershell.exe
4996	powershell.exe
3916	powershell.exe
3916	powershell.exe
2984	powershell.exe
2984	powershell.exe
2604	powershell.exe
1600	powershell.exe
3668	powershell.exe
620	powershell.exe
1608	powershell.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	2128	powershell.exe
Token: SeDebugPrivilege	872	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	432	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	3596	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	3608	powershell.exe
Token: SeDebugPrivilege	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	3668	powershell.exe
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeDebugPrivilege	3900	powershell.exe
Token: SeDebugPrivilege	620	powershell.exe
Token: SeDebugPrivilege	1252	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	5540	conhost.exe
Token: SeDebugPrivilege	5328	conhost.exe
Token: SeDebugPrivilege	5840	conhost.exe
Token: SeDebugPrivilege	5860	conhost.exe
Token: SeDebugPrivilege	6044	conhost.exe
Token: SeDebugPrivilege	1224	conhost.exe
Token: SeDebugPrivilege	1552	conhost.exe
Token: SeDebugPrivilege	2984	conhost.exe
Token: SeDebugPrivilege	5284	conhost.exe
Token: SeDebugPrivilege	1508	conhost.exe
Token: SeDebugPrivilege	3948	conhost.exe
Token: SeDebugPrivilege	388	conhost.exe
Token: SeDebugPrivilege	2848	conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 3608	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	95
PID 1796 wrote to memory of 3608	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	95
PID 1796 wrote to memory of 2324	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	96
PID 1796 wrote to memory of 2324	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	96
PID 1796 wrote to memory of 2128	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	97
PID 1796 wrote to memory of 2128	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	97
PID 1796 wrote to memory of 1792	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	98
PID 1796 wrote to memory of 1792	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	98
PID 1796 wrote to memory of 872	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	100
PID 1796 wrote to memory of 872	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	100
PID 1796 wrote to memory of 4352	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	101
PID 1796 wrote to memory of 4352	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	101
PID 1796 wrote to memory of 5100	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	102
PID 1796 wrote to memory of 5100	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	102
PID 1796 wrote to memory of 3596	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	103
PID 1796 wrote to memory of 3596	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	103
PID 1796 wrote to memory of 1104	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	104
PID 1796 wrote to memory of 1104	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	104
PID 1796 wrote to memory of 432	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	105
PID 1796 wrote to memory of 432	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	105
PID 1796 wrote to memory of 4228	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	106
PID 1796 wrote to memory of 4228	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	106
PID 1796 wrote to memory of 2176	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	116
PID 1796 wrote to memory of 2176	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	116
PID 1796 wrote to memory of 1108	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	118
PID 1796 wrote to memory of 1108	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	118
PID 1796 wrote to memory of 1108	1796	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	118
PID 1108 wrote to memory of 5116	1108	tmpB0A6.tmp.exe	121
PID 1108 wrote to memory of 5116	1108	tmpB0A6.tmp.exe	121
PID 1108 wrote to memory of 5116	1108	tmpB0A6.tmp.exe	121
PID 1108 wrote to memory of 5116	1108	tmpB0A6.tmp.exe	121
PID 1108 wrote to memory of 5116	1108	tmpB0A6.tmp.exe	121
PID 1108 wrote to memory of 5116	1108	tmpB0A6.tmp.exe	121
PID 1108 wrote to memory of 5116	1108	tmpB0A6.tmp.exe	121
PID 2176 wrote to memory of 4812	2176	cmd.exe	122
PID 2176 wrote to memory of 4812	2176	cmd.exe	122
PID 2176 wrote to memory of 4832	2176	cmd.exe	126
PID 2176 wrote to memory of 4832	2176	cmd.exe	126
PID 4832 wrote to memory of 4876	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	153
PID 4832 wrote to memory of 4876	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	153
PID 4832 wrote to memory of 4876	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	153
PID 4876 wrote to memory of 3600	4876	tmpD6C8.tmp.exe	155
PID 4876 wrote to memory of 3600	4876	tmpD6C8.tmp.exe	155
PID 4876 wrote to memory of 3600	4876	tmpD6C8.tmp.exe	155
PID 4876 wrote to memory of 3600	4876	tmpD6C8.tmp.exe	155
PID 4876 wrote to memory of 3600	4876	tmpD6C8.tmp.exe	155
PID 4876 wrote to memory of 3600	4876	tmpD6C8.tmp.exe	155
PID 4876 wrote to memory of 3600	4876	tmpD6C8.tmp.exe	155
PID 4832 wrote to memory of 3668	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	160
PID 4832 wrote to memory of 3668	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	160
PID 4832 wrote to memory of 4468	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	161
PID 4832 wrote to memory of 4468	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	161
PID 4832 wrote to memory of 2984	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	162
PID 4832 wrote to memory of 2984	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	162
PID 4832 wrote to memory of 1252	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	163
PID 4832 wrote to memory of 1252	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	163
PID 4832 wrote to memory of 3916	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	164
PID 4832 wrote to memory of 3916	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	164
PID 4832 wrote to memory of 620	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	165
PID 4832 wrote to memory of 620	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	165
PID 4832 wrote to memory of 3900	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	166
PID 4832 wrote to memory of 3900	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	166
PID 4832 wrote to memory of 1608	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	167
PID 4832 wrote to memory of 1608	4832	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe	167

System policy modification 1 TTPs 45 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
"C:\Users\Admin\AppData\Local\Temp\991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe"
1⤵
- DcRat
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\u3sYTpaNrj.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4812
- - C:\Users\Admin\AppData\Local\Temp\991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe
    "C:\Users\Admin\AppData\Local\Temp\991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\tmpD6C8.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpD6C8.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\tmpD6C8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD6C8.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:3600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2604
  - - C:\Windows\TAPI\conhost.exe
      "C:\Windows\TAPI\conhost.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:5540
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2eb3b554-b663-4c66-9c28-fc442af1fceb.vbs"
        5⤵
        
        PID:6004
      - C:\Windows\TAPI\conhost.exe
        
        C:\Windows\TAPI\conhost.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5328
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b01bb33-75be-4cb0-9894-f09f81d48ec9.vbs"
        7⤵
        
        PID:5380
        
        C:\Windows\TAPI\conhost.exe
        
        C:\Windows\TAPI\conhost.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5840
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e336f945-b2e7-4278-8f0c-c0ba3f4e2eb4.vbs"
        9⤵
        
        PID:4716
        
        C:\Windows\TAPI\conhost.exe
        
        C:\Windows\TAPI\conhost.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5860
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0956700-dd99-428e-a2c2-e9638fffb29b.vbs"
        11⤵
        
        PID:2780
        
        C:\Windows\TAPI\conhost.exe
        
        C:\Windows\TAPI\conhost.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:6044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91f0ec19-ac59-4c7f-87a3-fa79a1b3375d.vbs"
        13⤵
        
        PID:5160
        
        C:\Windows\TAPI\conhost.exe
        
        C:\Windows\TAPI\conhost.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1224
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15bf0d9a-c69a-40bb-99bb-5eeb495850c8.vbs"
        15⤵
        
        PID:5596
        
        C:\Windows\TAPI\conhost.exe
        
        C:\Windows\TAPI\conhost.exe
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad635795-fb55-4db7-9506-94efb163008c.vbs"
        17⤵
        
        PID:4284
        
        C:\Windows\TAPI\conhost.exe
        
        C:\Windows\TAPI\conhost.exe
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b1458a1-ab12-49c5-8d59-601b8b002679.vbs"
        19⤵
        
        PID:4828
        
        C:\Windows\TAPI\conhost.exe
        
        C:\Windows\TAPI\conhost.exe
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5284
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e4c0447e-f552-4be3-8eed-c8395c08bce8.vbs"
        21⤵
        
        PID:1936
        
        C:\Windows\TAPI\conhost.exe
        
        C:\Windows\TAPI\conhost.exe
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94e939f5-1e40-4f87-aab0-d112e792d48b.vbs"
        23⤵
        
        PID:2012
        
        C:\Windows\TAPI\conhost.exe
        
        C:\Windows\TAPI\conhost.exe
        24⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\193d7c85-6466-4d99-90f1-2ec9f2a726ad.vbs"
        25⤵
        
        PID:1648
        
        C:\Windows\TAPI\conhost.exe
        
        C:\Windows\TAPI\conhost.exe
        26⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:388
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62a2b892-02d7-42b2-906e-f40304c17ee9.vbs"
        27⤵
        
        PID:620
        
        C:\Windows\TAPI\conhost.exe
        
        C:\Windows\TAPI\conhost.exe
        28⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af23a63d-9c6f-42b0-9be5-956e320e816b.vbs"
        29⤵
        
        PID:5660
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\215e8816-819e-4ec7-9ab9-5af8cfe8e44e.vbs"
        29⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\tmpD99D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD99D.tmp.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\tmpD99D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD99D.tmp.exe"
        30⤵
        Executes dropped EXE
        
        PID:4408
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\830627ca-1a71-4fc0-9d4f-6dd88220a59e.vbs"
        27⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\tmpA9D3.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA9D3.tmp.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\tmpA9D3.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA9D3.tmp.exe"
        28⤵
        Executes dropped EXE
        
        PID:5328
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\608012bf-ca78-427b-8870-ac30c422f0e4.vbs"
        25⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\tmp78EF.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp78EF.tmp.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\tmp78EF.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp78EF.tmp.exe"
        26⤵
        Executes dropped EXE
        
        PID:3704
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4def2db6-afc2-4726-97ae-2440364a231d.vbs"
        23⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\tmp48A8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp48A8.tmp.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\tmp48A8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp48A8.tmp.exe"
        24⤵
        Executes dropped EXE
        
        PID:4924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be4d7df9-35de-435f-b8b8-83ee3d1ba143.vbs"
        21⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\tmp2BAA.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2BAA.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\tmp2BAA.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2BAA.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:4232
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1f42e1a4-a49e-4bbb-b7d6-3d6edf6deb33.vbs"
        19⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\tmpFC3D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpFC3D.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\tmpFC3D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpFC3D.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:2480
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5e00ade6-f2bc-40ff-833a-2be8ebfa0b6d.vbs"
        17⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\tmpDFCC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDFCC.tmp.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\tmpDFCC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDFCC.tmp.exe"
        18⤵
        Executes dropped EXE
        
        PID:1492
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8fdf17e0-6f50-4533-98bb-0050e1a6ed1c.vbs"
        15⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\tmpAF85.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpAF85.tmp.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\tmpAF85.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpAF85.tmp.exe"
        16⤵
        Executes dropped EXE
        
        PID:5488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a58e8cb9-1b27-4f93-a9e1-d5a3e8a0f048.vbs"
        13⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\tmp7EDF.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7EDF.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\tmp7EDF.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7EDF.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:2380
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eabce056-6b03-4872-9cb0-9b0e630fd792.vbs"
        11⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\tmp6193.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp6193.tmp.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\tmp6193.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp6193.tmp.exe"
        12⤵
        Executes dropped EXE
        
        PID:1052
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d9bfc1aa-9ee3-4baa-8271-44e1b0f1936f.vbs"
        9⤵
        
        PID:5432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0d765601-f7bf-4e95-805b-4df23df064ea.vbs"
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\tmp125A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp125A.tmp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\tmp125A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp125A.tmp.exe"
        8⤵
        Executes dropped EXE
        
        PID:5448
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e36c5fbb-ab8f-421b-85c6-46ecf7a7a97e.vbs"
        5⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\tmpF2BC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF2BC.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\tmpF2BC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF2BC.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:916
- C:\Users\Admin\AppData\Local\Temp\tmpB0A6.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpB0A6.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Users\Admin\AppData\Local\Temp\tmpB0A6.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpB0A6.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\PrintDialog\microsoft.system.package.metadata\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\PrintDialog\microsoft.system.package.metadata\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Windows\PrintDialog\microsoft.system.package.metadata\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\TAPI\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\TAPI\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\TAPI\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Admin\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\WTR\TextInputHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Windows\Migration\WTR\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\OfficeClickToRun.exe

Filesize
4.9MB

MD5
b5578d55623a79cf105d62dc41402e67

SHA1
2914b5f5b47c4d4e7ab756aa8529a1648df22947

SHA256
991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b

SHA512
09160ba1ef2cfdac9a125cc4660ccc0b4a6b01f7b7334494cdda34fd9845e8b70fe4eae96d2d2a1a63d839c0593ba144176f8754311a5dd8237ce92e4040477e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\991ad52e8f01839d1b6553cde8cd95ac42fb4da694c36dfc53d700b45a189b6b.exe.log

Filesize
1KB

MD5
bbb951a34b516b66451218a3ec3b0ae1

SHA1
7393835a2476ae655916e0a9687eeaba3ee876e9

SHA256
eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a

SHA512
63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be67063c62a242565760a02a642a9f02

SHA1
d1043a892b44d6676f71b568f578fff947266a19

SHA256
56f158298dc5f781d6636a0b15d040f9cffb1d46cd11079aa40a26b662217f48

SHA512
90d2cbd882ff8043412ad25e74df0cf6b71d6f3fbdfa6f1efa0efc8eed86a925606c7d2e967f112a34d3f0e04f01a396898508571400dcf7e6fd69e78f406638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
90355e74a38e1aab8c3a306b3021da95

SHA1
4636ca6d7a6e4e3fc740a6a220826b5329b76e1f

SHA256
5851b1399bab7cbbbec6259b420ef8b2e6d1e8e9e03938d4ee0c04e3597c7658

SHA512
63e2b243a807d3e9d8aea8829d695e48d1c5731ae1ba2324870ce94bbf37e74ed00d923f28c2816da338380800de840ea05e855aa870451d64d2274eb3d6a785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4c513fe7261cbb0fd7ec5d03873693d6

SHA1
360d69bf9f5ba328d5f039f4802b2546ac346c4b

SHA256
4dc40c8efd2b217c5552937c9fd2b7ac00bc30ac50a81526ab6655278c5a4dc9

SHA512
8c0fbffdfc5003e06c7ae0b53052b3478fbd7e2e1b9028db12248383535d04dcfeb80069295e48c5e0ec60504f45610b7bd944b8852cada005a590660caa04d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
118d5649311b514db219f613211e13a9

SHA1
485cc05e7072d26bf8226062ba1c578d7b30e1c4

SHA256
4fff6897c69cc3e8b9ae3da4d3c221ecbf329a4112d85cb346a4d413b70581dd

SHA512
b458d6703bde28f5d870542c852ad5990592a7a186eb7b4da83b475a94e2d2cdb1105b27d86414708dc613aad902937601d76cedad8304832c4d59ac1c088db4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cdf113430dd2b0560c16a4927250105c

SHA1
d6d8ec180136a243cfba776439f1a5a303cdb18a

SHA256
0fe47567ce2c2aee76f3a3befe6491b540b1367a2b4d9cdacdf5f7eea981a93d

SHA512
968843bd781bf4a65d9c973b2bc7d576c7b5cb8585fe97c5082039f97b28659f7a4fa0cce654c6f1cf121631fa04de059c186aff30bdd98c19b86f358b000bfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2c30103cc6b103339cfe44137ca0edf0

SHA1
ecdc8c1685831e906cbb8ca6065ab4bb06fe3db4

SHA256
85ea59925c660ced52ba5095323e580d61aa8f8de82f31cdde85a5ed7e75cfae

SHA512
a870be1cb86f955187170d99c7e6200f6871bc7858885d3b2f431bfa6f9af1d3d86a00add6f6f5a0396ed25fc19c4181b985cf08921ad98bf4903568fe59a482

Download Submit
C:\Users\Admin\AppData\Local\Temp\2eb3b554-b663-4c66-9c28-fc442af1fceb.vbs

Filesize
703B

MD5
c3df4f7b5df160770d8cca05d5f79f1a

SHA1
535afcf4e56db4afbbf6356d4c9441a901a9df8b

SHA256
124cda3431fba2921d9c5c0ce6d3ca7787b27bb1a4d4e5dae8c3f8afeb1596b5

SHA512
1900b2e81bf874ba1380968c3c5190be160f4f3a8de231d69709aae543a0f21321e6ddd09c772febb02988916bbfd32063b3dc67bef7669851a64af48fd8e8a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b01bb33-75be-4cb0-9894-f09f81d48ec9.vbs

Filesize
703B

MD5
4d2ce50a7e63f5fc3b9d8a15511ec93c

SHA1
72881022f4593a574a3d3fd26150085aab24595a

SHA256
40109348d74f161ff7718536d7d4c391015e65bc8870e863af41ae4b02d91da6

SHA512
2e66c22582a091e63578a7a27d2b73693a45578056a45a81cb0e83e0c92bb681ce0c96c2effcb210fe792fe4ee03a7d1525a445c056d10858958c7e066f0db7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\91f0ec19-ac59-4c7f-87a3-fa79a1b3375d.vbs

Filesize
703B

MD5
a7a939088561483621114bfc5e8e8748

SHA1
ef0e5b05181a0e6edd0733eeb0705c66d4f0bbcb

SHA256
a20ed11dcb7535c75244bc6a1d25af50e4e889b927ff224215079ee17983a9c3

SHA512
da6d98c466aa2f4b0107e0327679bc83ffd26ef0d95122bdfa1adc11ec6bcb20c333d1996e1690a084f8143c864f45e194e028679f8c15202c98f662804d799c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2cqlslo5.m22.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c0956700-dd99-428e-a2c2-e9638fffb29b.vbs

Filesize
703B

MD5
8710e9ad61b0c07299c16a09438b0acc

SHA1
d6b874a66e694ca9922abcd9f7081eb348f56bdf

SHA256
bb62b585c0da8da88c024fa0b62ed7b22eb051625484853fb765d30492b09612

SHA512
1e1522cbd9ce6ade43daa52575089cbdde8455c70a5047081f22ad0de44bd503d497706e530fd3c87b4f7522a44f6b837192c7da77e2a41e5382dbc4161ec4d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\e336f945-b2e7-4278-8f0c-c0ba3f4e2eb4.vbs

Filesize
703B

MD5
72427bed91dfabac57248ca3f99af727

SHA1
158138293d7ee9f2454f1c873f97df1c1093f10b

SHA256
bd9e4c866ee584d0b527515029abd444c26744491ea4af1ccc962cb461c7d27a

SHA512
44cc761e6873bbc5538e8eedcedddadbf8511058702e461148e787934f9069a9108f09d84238c0665828b403f11d00dc9ddb217ea7d50f064042f5a9a31e5d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\e36c5fbb-ab8f-421b-85c6-46ecf7a7a97e.vbs

Filesize
479B

MD5
84d48dbd30e3c775ef1baa15134b44d0

SHA1
f37d2cb9dec95e32f0be7689df1ed4190e7d38ed

SHA256
cad44902bd06833cb585c55c26b9db48877e341337bf81a068052c168d70a4cf

SHA512
e6fd03dd7f37f7a95d00f04c58f8180e06b4f6437ab1ede55e84ce3a0ae038dfdb57c94f4577b427490452bfee8927338791f01cf3569c9668d50c1327b53fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB0A6.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Local\Temp\u3sYTpaNrj.bat

Filesize
267B

MD5
e8da0a1f044debc59405d13de1ace9b8

SHA1
c8e7dfa37f17b0c3b853d3df5dc372f8b0539c5d

SHA256
9ca4e92d730b840710c697b1db8a85e122bf0c78a85915e169fd2f5f3608633c

SHA512
68db826fe77f753dc6025c8aac1d9530d3c50d23584a6accd483f649036c2b052324df02de78599799548304d182b3783d00a2367699ead6411d266c1b789751

Download Submit
memory/1796-12-0x000000001C5E0000-0x000000001CB08000-memory.dmp

Filesize
5.2MB

Download
memory/1796-11-0x000000001C0A0000-0x000000001C0B2000-memory.dmp

Filesize
72KB

Download
memory/1796-1-0x0000000000660000-0x0000000000B54000-memory.dmp

Filesize
5.0MB

Download
memory/1796-51-0x00007FFCBBE70000-0x00007FFCBC931000-memory.dmp

Filesize
10.8MB

Download
memory/1796-18-0x000000001C200000-0x000000001C20C000-memory.dmp

Filesize
48KB

Download
memory/1796-16-0x000000001C0E0000-0x000000001C0E8000-memory.dmp

Filesize
32KB

Download
memory/1796-17-0x000000001C0F0000-0x000000001C0F8000-memory.dmp

Filesize
32KB

Download
memory/1796-13-0x000000001C0B0000-0x000000001C0BA000-memory.dmp

Filesize
40KB

Download
memory/1796-14-0x000000001C0C0000-0x000000001C0CE000-memory.dmp

Filesize
56KB

Download
memory/1796-15-0x000000001C0D0000-0x000000001C0DE000-memory.dmp

Filesize
56KB

Download
memory/1796-0-0x00007FFCBBE73000-0x00007FFCBBE75000-memory.dmp

Filesize
8KB

Download
memory/1796-2-0x00007FFCBBE70000-0x00007FFCBC931000-memory.dmp

Filesize
10.8MB

Download
memory/1796-10-0x000000001C040000-0x000000001C04A000-memory.dmp

Filesize
40KB

Download
memory/1796-8-0x000000001C010000-0x000000001C026000-memory.dmp

Filesize
88KB

Download
memory/1796-9-0x000000001C030000-0x000000001C040000-memory.dmp

Filesize
64KB

Download
memory/1796-6-0x0000000001500000-0x0000000001508000-memory.dmp

Filesize
32KB

Download
memory/1796-7-0x000000001C000000-0x000000001C010000-memory.dmp

Filesize
64KB

Download
memory/1796-5-0x000000001C050000-0x000000001C0A0000-memory.dmp

Filesize
320KB

Download
memory/1796-4-0x000000001B8A0000-0x000000001B8BC000-memory.dmp

Filesize
112KB

Download
memory/1796-3-0x000000001B8D0000-0x000000001B9FE000-memory.dmp

Filesize
1.2MB

Download
memory/2128-52-0x0000019A32540000-0x0000019A32562000-memory.dmp

Filesize
136KB

Download
memory/2984-542-0x0000000003210000-0x0000000003222000-memory.dmp

Filesize
72KB

Download
memory/5116-72-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/5860-464-0x0000000001E30000-0x0000000001E42000-memory.dmp

Filesize
72KB

Download