colibri | 462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2024, 04:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Size

4.9MB
MD5

c1f0457e3b42916b24283a393f95dbaf
SHA1

d8d721403c9c56e12c0951f67fb66c0ecdbdf4f5
SHA256

462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2
SHA512

65e0b12e0c106495fca56efe31d6d02c63f4038ea86d6bc77884d8c1e6194cdc5fc50e8790cc8f25742a96adab92040e92d1a1b08506c347308309849a457958
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri

DcRat 60 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2980	schtasks.exe
		2928	schtasks.exe
		5060	schtasks.exe
		4080	schtasks.exe
		2088	schtasks.exe
		4644	schtasks.exe
		3232	schtasks.exe
File created	C:\Program Files\Crashpad\reports\f3b6ecef712a24		462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
		4288	schtasks.exe
		4748	schtasks.exe
		4136	schtasks.exe
		2960	schtasks.exe
		2188	schtasks.exe
		3864	schtasks.exe
		2728	schtasks.exe
		2436	schtasks.exe
		4772	schtasks.exe
		1780	schtasks.exe
		3352	schtasks.exe
		1092	schtasks.exe
		2828	schtasks.exe
		5020	schtasks.exe
		4204	schtasks.exe
		2464	schtasks.exe
		736	schtasks.exe
		2336	schtasks.exe
		748	schtasks.exe
		1684	schtasks.exe
		4304	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
		4372	schtasks.exe
		2804	schtasks.exe
		3064	schtasks.exe
		4640	schtasks.exe
		2220	schtasks.exe
		4284	schtasks.exe
		4512	schtasks.exe
		1208	schtasks.exe
		4380	schtasks.exe
		228	schtasks.exe
		2392	schtasks.exe
		3920	schtasks.exe
		4048	schtasks.exe
		2572	schtasks.exe
		720	schtasks.exe
		5084	schtasks.exe
		3076	schtasks.exe
		4088	schtasks.exe
		2568	schtasks.exe
		2336	schtasks.exe
		1988	schtasks.exe
		2432	schtasks.exe
		4732	schtasks.exe
		1288	schtasks.exe
		4528	schtasks.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\29c1c3cc0f7685		462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
		4136	schtasks.exe
		3108	schtasks.exe
		3376	schtasks.exe
		436	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4136	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4640	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4204	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4288	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4136	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3864	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	736	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3352	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5084	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	720	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3920	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2988	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	2988	schtasks.exe	86

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2664-2-0x000000001B550000-0x000000001B67E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1900	powershell.exe
4920	powershell.exe
1652	powershell.exe
1908	powershell.exe
4772	powershell.exe
3628	powershell.exe
4880	powershell.exe
3364	powershell.exe
2392	powershell.exe
1964	powershell.exe
4696	powershell.exe
936	powershell.exe
4136	powershell.exe
2384	powershell.exe
5084	powershell.exe
3120	powershell.exe
4788	powershell.exe
1472	powershell.exe
4284	powershell.exe
4768	powershell.exe
3376	powershell.exe
920	powershell.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	csrss.exe

Executes dropped EXE 39 IoCs

pid	Process
3236	tmp8BF8.tmp.exe
1604	tmp8BF8.tmp.exe
4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
1632	tmpB297.tmp.exe
4088	tmpB297.tmp.exe
4288	csrss.exe
4920	tmpDB5C.tmp.exe
3392	tmpDB5C.tmp.exe
4416	csrss.exe
660	tmpDD6.tmp.exe
904	tmpDD6.tmp.exe
3120	csrss.exe
1808	csrss.exe
1908	tmp58E9.tmp.exe
2708	tmp58E9.tmp.exe
1208	tmp58E9.tmp.exe
3864	tmp58E9.tmp.exe
3680	csrss.exe
4480	tmp89DC.tmp.exe
3220	tmp89DC.tmp.exe
2396	csrss.exe
4428	tmpBA71.tmp.exe
3708	tmpBA71.tmp.exe
1808	csrss.exe
4784	tmpE971.tmp.exe
4788	tmpE971.tmp.exe
1796	csrss.exe
4488	tmp1999.tmp.exe
4848	tmp1999.tmp.exe
4324	csrss.exe
3728	tmp4869.tmp.exe
2304	tmp4869.tmp.exe
1864	csrss.exe
4120	tmp77B7.tmp.exe
4848	tmp77B7.tmp.exe
2576	csrss.exe
2788	tmpA81D.tmp.exe
2436	tmpA81D.tmp.exe
5056	tmpA81D.tmp.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 3236 set thread context of 1604	3236	tmp8BF8.tmp.exe	102
PID 1632 set thread context of 4088	1632	tmpB297.tmp.exe	186
PID 4920 set thread context of 3392	4920	tmpDB5C.tmp.exe	216
PID 660 set thread context of 904	660	tmpDD6.tmp.exe	228
PID 1208 set thread context of 3864	1208	tmp58E9.tmp.exe	244
PID 4480 set thread context of 3220	4480	tmp89DC.tmp.exe	253
PID 4428 set thread context of 3708	4428	tmpBA71.tmp.exe	263
PID 4784 set thread context of 4788	4784	tmpE971.tmp.exe	272
PID 4488 set thread context of 4848	4488	tmp1999.tmp.exe	290
PID 3728 set thread context of 2304	3728	tmp4869.tmp.exe	299
PID 4120 set thread context of 4848	4120	tmp77B7.tmp.exe	308
PID 2436 set thread context of 5056	2436	tmpA81D.tmp.exe	322

Drops file in Program Files directory 29 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\csrss.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File opened for modification	C:\Program Files\Crashpad\reports\RCX8C18.tmp	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Program Files\Google\Chrome\Application\27d1bcfc3c54e0	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\System.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Program Files\Uninstall Information\e1ef82546f0b02	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Program Files\Crashpad\reports\spoolsv.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\Idle.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\OfficeClickToRun.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\OfficeClickToRun.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Program Files\Uninstall Information\SppExtComObj.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Program Files\7-Zip\Lang\6203df4a6bafc7	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Program Files\Google\Chrome\Application\System.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\e6c9b481da804f	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lsass.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Program Files\Crashpad\reports\f3b6ecef712a24	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCX8A03.tmp	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Program Files\7-Zip\Lang\5b884080fd4f94	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fontdrvhost.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\29c1c3cc0f7685	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Program Files\7-Zip\Lang\lsass.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\csrss.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\6ccacd8608530f	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\Idle.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Program Files\MSBuild\Microsoft\886983d96e3d3e	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File opened for modification	C:\Program Files\Uninstall Information\SppExtComObj.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File opened for modification	C:\Program Files\Crashpad\reports\spoolsv.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Program Files\7-Zip\Lang\fontdrvhost.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\RemotePackages\RemoteApps\886983d96e3d3e	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File opened for modification	C:\Windows\RemotePackages\RemoteApps\csrss.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
File created	C:\Windows\RemotePackages\RemoteApps\csrss.exe	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA81D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE971.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB297.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBA71.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8BF8.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp58E9.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp58E9.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp89DC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4869.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA81D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDB5C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp58E9.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1999.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp77B7.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDD6.tmp.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	csrss.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2220	schtasks.exe
4136	schtasks.exe
2960	schtasks.exe
3064	schtasks.exe
4048	schtasks.exe
436	schtasks.exe
3920	schtasks.exe
1208	schtasks.exe
2336	schtasks.exe
4772	schtasks.exe
736	schtasks.exe
4372	schtasks.exe
4380	schtasks.exe
1684	schtasks.exe
2728	schtasks.exe
2804	schtasks.exe
5020	schtasks.exe
4512	schtasks.exe
5084	schtasks.exe
5060	schtasks.exe
748	schtasks.exe
720	schtasks.exe
2828	schtasks.exe
2392	schtasks.exe
2088	schtasks.exe
2436	schtasks.exe
4640	schtasks.exe
4284	schtasks.exe
1780	schtasks.exe
1988	schtasks.exe
3108	schtasks.exe
4732	schtasks.exe
3076	schtasks.exe
3376	schtasks.exe
2568	schtasks.exe
4748	schtasks.exe
4304	schtasks.exe
2464	schtasks.exe
2572	schtasks.exe
1288	schtasks.exe
3352	schtasks.exe
1092	schtasks.exe
4136	schtasks.exe
4288	schtasks.exe
3232	schtasks.exe
4644	schtasks.exe
3864	schtasks.exe
2336	schtasks.exe
228	schtasks.exe
2432	schtasks.exe
2928	schtasks.exe
4088	schtasks.exe
4204	schtasks.exe
2980	schtasks.exe
4080	schtasks.exe
2188	schtasks.exe
4528	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
1900	powershell.exe
1900	powershell.exe
2384	powershell.exe
2384	powershell.exe
4768	powershell.exe
4768	powershell.exe
3364	powershell.exe
3364	powershell.exe
3120	powershell.exe
3120	powershell.exe
5084	powershell.exe
5084	powershell.exe
4920	powershell.exe
4920	powershell.exe
4768	powershell.exe
3628	powershell.exe
3628	powershell.exe
4880	powershell.exe
4880	powershell.exe
1652	powershell.exe
1652	powershell.exe
3364	powershell.exe
3628	powershell.exe
4920	powershell.exe
920	powershell.exe
920	powershell.exe
1652	powershell.exe
3120	powershell.exe
2384	powershell.exe
1900	powershell.exe
4880	powershell.exe
5084	powershell.exe
920	powershell.exe
4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
4772	powershell.exe
4772	powershell.exe
4284	powershell.exe
4284	powershell.exe
4696	powershell.exe
4696	powershell.exe
1964	powershell.exe
1964	powershell.exe
3376	powershell.exe
3376	powershell.exe
1908	powershell.exe
1908	powershell.exe
4788	powershell.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	3628	powershell.exe
Token: SeDebugPrivilege	3364	powershell.exe
Token: SeDebugPrivilege	3120	powershell.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Token: SeDebugPrivilege	4284	powershell.exe
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	4136	powershell.exe
Token: SeDebugPrivilege	936	powershell.exe
Token: SeDebugPrivilege	4288	csrss.exe
Token: SeDebugPrivilege	4416	csrss.exe
Token: SeDebugPrivilege	3120	csrss.exe
Token: SeDebugPrivilege	1808	csrss.exe
Token: SeDebugPrivilege	3680	csrss.exe
Token: SeDebugPrivilege	2396	csrss.exe
Token: SeDebugPrivilege	1808	csrss.exe
Token: SeDebugPrivilege	1796	csrss.exe
Token: SeDebugPrivilege	4324	csrss.exe
Token: SeDebugPrivilege	1864	csrss.exe
Token: SeDebugPrivilege	2576	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 3236	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	100
PID 2664 wrote to memory of 3236	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	100
PID 2664 wrote to memory of 3236	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	100
PID 3236 wrote to memory of 1604	3236	tmp8BF8.tmp.exe	102
PID 3236 wrote to memory of 1604	3236	tmp8BF8.tmp.exe	102
PID 3236 wrote to memory of 1604	3236	tmp8BF8.tmp.exe	102
PID 3236 wrote to memory of 1604	3236	tmp8BF8.tmp.exe	102
PID 3236 wrote to memory of 1604	3236	tmp8BF8.tmp.exe	102
PID 3236 wrote to memory of 1604	3236	tmp8BF8.tmp.exe	102
PID 3236 wrote to memory of 1604	3236	tmp8BF8.tmp.exe	102
PID 2664 wrote to memory of 920	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	105
PID 2664 wrote to memory of 920	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	105
PID 2664 wrote to memory of 2384	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	106
PID 2664 wrote to memory of 2384	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	106
PID 2664 wrote to memory of 3628	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	107
PID 2664 wrote to memory of 3628	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	107
PID 2664 wrote to memory of 5084	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	108
PID 2664 wrote to memory of 5084	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	108
PID 2664 wrote to memory of 4768	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	109
PID 2664 wrote to memory of 4768	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	109
PID 2664 wrote to memory of 4880	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	110
PID 2664 wrote to memory of 4880	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	110
PID 2664 wrote to memory of 4920	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	111
PID 2664 wrote to memory of 4920	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	111
PID 2664 wrote to memory of 1900	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	112
PID 2664 wrote to memory of 1900	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	112
PID 2664 wrote to memory of 1652	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	114
PID 2664 wrote to memory of 1652	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	114
PID 2664 wrote to memory of 3364	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	121
PID 2664 wrote to memory of 3364	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	121
PID 2664 wrote to memory of 3120	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	122
PID 2664 wrote to memory of 3120	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	122
PID 2664 wrote to memory of 648	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	126
PID 2664 wrote to memory of 648	2664	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	126
PID 648 wrote to memory of 2120	648	cmd.exe	129
PID 648 wrote to memory of 2120	648	cmd.exe	129
PID 648 wrote to memory of 4508	648	cmd.exe	134
PID 648 wrote to memory of 4508	648	cmd.exe	134
PID 4508 wrote to memory of 1632	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	184
PID 4508 wrote to memory of 1632	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	184
PID 4508 wrote to memory of 1632	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	184
PID 1632 wrote to memory of 4088	1632	tmpB297.tmp.exe	186
PID 1632 wrote to memory of 4088	1632	tmpB297.tmp.exe	186
PID 1632 wrote to memory of 4088	1632	tmpB297.tmp.exe	186
PID 1632 wrote to memory of 4088	1632	tmpB297.tmp.exe	186
PID 1632 wrote to memory of 4088	1632	tmpB297.tmp.exe	186
PID 1632 wrote to memory of 4088	1632	tmpB297.tmp.exe	186
PID 1632 wrote to memory of 4088	1632	tmpB297.tmp.exe	186
PID 4508 wrote to memory of 1908	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	188
PID 4508 wrote to memory of 1908	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	188
PID 4508 wrote to memory of 3376	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	189
PID 4508 wrote to memory of 3376	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	189
PID 4508 wrote to memory of 4788	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	190
PID 4508 wrote to memory of 4788	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	190
PID 4508 wrote to memory of 2392	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	191
PID 4508 wrote to memory of 2392	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	191
PID 4508 wrote to memory of 1964	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	192
PID 4508 wrote to memory of 1964	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	192
PID 4508 wrote to memory of 1472	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	193
PID 4508 wrote to memory of 1472	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	193
PID 4508 wrote to memory of 4284	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	194
PID 4508 wrote to memory of 4284	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	194
PID 4508 wrote to memory of 4696	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	195
PID 4508 wrote to memory of 4696	4508	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe	195

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
"C:\Users\Admin\AppData\Local\Temp\462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe"
1⤵
- DcRat
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2664
- C:\Users\Admin\AppData\Local\Temp\tmp8BF8.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8BF8.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Users\Admin\AppData\Local\Temp\tmp8BF8.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp8BF8.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:1604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6zDfnUQuHU.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:648
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2120
- - C:\Users\Admin\AppData\Local\Temp\462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe
    "C:\Users\Admin\AppData\Local\Temp\462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\tmpB297.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpB297.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\tmpB297.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpB297.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:4088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4772
  - - C:\Program Files\MSBuild\Microsoft\csrss.exe
      "C:\Program Files\MSBuild\Microsoft\csrss.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:4288
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5fc4f793-2796-42aa-a3c9-e0ec6930d6b9.vbs"
        5⤵
        
        PID:2236
      - C:\Program Files\MSBuild\Microsoft\csrss.exe
        
        "C:\Program Files\MSBuild\Microsoft\csrss.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4416
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9a15fe22-aff9-4c18-abe6-ac355edab16e.vbs"
        7⤵
        
        PID:2436
        
        C:\Program Files\MSBuild\Microsoft\csrss.exe
        
        "C:\Program Files\MSBuild\Microsoft\csrss.exe"
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3120
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4427c957-71c0-40e6-96be-35c84047527c.vbs"
        9⤵
        
        PID:2820
        
        C:\Program Files\MSBuild\Microsoft\csrss.exe
        
        "C:\Program Files\MSBuild\Microsoft\csrss.exe"
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\63f00e78-a057-4fe5-9ef8-fe6e4f218a1e.vbs"
        11⤵
        
        PID:1700
        
        C:\Program Files\MSBuild\Microsoft\csrss.exe
        
        "C:\Program Files\MSBuild\Microsoft\csrss.exe"
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\571dc848-1f9e-45d8-b50c-c6114e16e7e1.vbs"
        13⤵
        
        PID:4572
        
        C:\Program Files\MSBuild\Microsoft\csrss.exe
        
        "C:\Program Files\MSBuild\Microsoft\csrss.exe"
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2396
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da4c6c97-c9ab-4374-8c6c-bc3f7fa81a4b.vbs"
        15⤵
        
        PID:4884
        
        C:\Program Files\MSBuild\Microsoft\csrss.exe
        
        "C:\Program Files\MSBuild\Microsoft\csrss.exe"
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\974aa802-d9d8-4883-b6dd-36ee4ae6fcf9.vbs"
        17⤵
        
        PID:1956
        
        C:\Program Files\MSBuild\Microsoft\csrss.exe
        
        "C:\Program Files\MSBuild\Microsoft\csrss.exe"
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1796
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\054f1114-c011-4ea3-afdf-34c3751d6554.vbs"
        19⤵
        
        PID:3448
        
        C:\Program Files\MSBuild\Microsoft\csrss.exe
        
        "C:\Program Files\MSBuild\Microsoft\csrss.exe"
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4324
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\95522c8e-5e59-47da-9917-f09a20651bbd.vbs"
        21⤵
        
        PID:4136
        
        C:\Program Files\MSBuild\Microsoft\csrss.exe
        
        "C:\Program Files\MSBuild\Microsoft\csrss.exe"
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1864
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78f81c40-667b-42c2-946a-8eeb438eb617.vbs"
        23⤵
        
        PID:2060
        
        C:\Program Files\MSBuild\Microsoft\csrss.exe
        
        "C:\Program Files\MSBuild\Microsoft\csrss.exe"
        24⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2576
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\696a62c3-7e77-4780-8d89-cb93a382a0f1.vbs"
        25⤵
        
        PID:2064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2bffd87a-cf09-450e-8c6c-a186e4123a38.vbs"
        25⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\tmpA81D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA81D.tmp.exe"
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\tmpA81D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA81D.tmp.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\tmpA81D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA81D.tmp.exe"
        27⤵
        Executes dropped EXE
        
        PID:5056
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f17b0e10-173f-4394-9826-94dc7c8985f9.vbs"
        23⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\tmp77B7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp77B7.tmp.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\tmp77B7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp77B7.tmp.exe"
        24⤵
        Executes dropped EXE
        
        PID:4848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38881ec0-d767-4428-82d1-08eb4617ef26.vbs"
        21⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\tmp4869.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4869.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\tmp4869.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4869.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:2304
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d5752830-58cb-4166-bbfb-cccd843b0b54.vbs"
        19⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\tmp1999.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1999.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\tmp1999.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1999.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:4848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\45b5ccf7-9eb3-484f-bd44-6cd4933bc2ea.vbs"
        17⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\tmpE971.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE971.tmp.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\tmpE971.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE971.tmp.exe"
        18⤵
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d59dfa02-bb84-4aee-8b85-2ec9d0e738b1.vbs"
        15⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\tmpBA71.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBA71.tmp.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\tmpBA71.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBA71.tmp.exe"
        16⤵
        Executes dropped EXE
        
        PID:3708
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c1cdab2-9c50-497b-aa0a-56996d56e2c0.vbs"
        13⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\tmp89DC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp89DC.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\tmp89DC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp89DC.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:3220
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fc25034e-1dcd-4e69-8f8f-d5d0b228ed3e.vbs"
        11⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\tmp58E9.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp58E9.tmp.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\tmp58E9.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp58E9.tmp.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\tmp58E9.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp58E9.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\tmp58E9.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp58E9.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:3864
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2b459815-3405-4eb1-ac2c-160a2916a4e6.vbs"
        9⤵
        
        PID:2728
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\089e4108-99b0-450d-90b3-b2b64b4e1c04.vbs"
        7⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\tmpDD6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDD6.tmp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:660
        
        C:\Users\Admin\AppData\Local\Temp\tmpDD6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDD6.tmp.exe"
        8⤵
        Executes dropped EXE
        
        PID:904
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dcc26666-243c-4d92-b91b-706d0cd0aa10.vbs"
        5⤵
        
        PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\tmpDB5C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDB5C.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\tmpDB5C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDB5C.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Crashpad\reports\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Crashpad\reports\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Crashpad\reports\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\RemotePackages\RemoteApps\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\RemotePackages\RemoteApps\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\Application\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\Lang\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\SppExtComObj.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Videos\SppExtComObj.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Admin\Videos\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Videos\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\Microsoft\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Microsoft OneDrive\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft OneDrive\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Microsoft OneDrive\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\9e8d7a4ca61bd9

Filesize
948B

MD5
2ffef16e876227d8a689ec851e362a9f

SHA1
1ca48ee10097cdc11920c15fa40f49edc94c81d5

SHA256
7cc1b9cb369fbafffc84858cb46742ff55d4c751fbcc9f2bba0699ebeadf7f84

SHA512
c13d0a4fd7a99362fe9add309b686945d1b9bfd14e75869cb49671eaa71af1fccbfd89d43aa64fada7533faea1535fb7898f92fa37ea54880be5b3d879edee96

Download Submit
C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
4.9MB

MD5
c1f0457e3b42916b24283a393f95dbaf

SHA1
d8d721403c9c56e12c0951f67fb66c0ecdbdf4f5

SHA256
462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2

SHA512
65e0b12e0c106495fca56efe31d6d02c63f4038ea86d6bc77884d8c1e6194cdc5fc50e8790cc8f25742a96adab92040e92d1a1b08506c347308309849a457958

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\462a177ebf51d1033f5dff1d511d38703da60801b066028828a6b68a7d2224e2.exe.log

Filesize
1KB

MD5
bbb951a34b516b66451218a3ec3b0ae1

SHA1
7393835a2476ae655916e0a9687eeaba3ee876e9

SHA256
eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a

SHA512
63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e448fe0d240184c6597a31d3be2ced58

SHA1
372b8d8c19246d3e38cd3ba123cc0f56070f03cd

SHA256
c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

SHA512
0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
01fff31a70e26012f37789b179059e32

SHA1
555b6f05cce7daf46920df1c01eb5c55dc62c9e6

SHA256
adf65afaf1c83572f05a99bf2ede8eb7be1aab0717d5254f501d5e09ba6f587b

SHA512
ac310c9bc5c1effc45e1e425972b09d1f961af216b50e1a504caa046b7f1a5f3179760e0b29591d83756ecb686d17a24770cf06fcea57e6f287ca5bbf6b6971b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2ea91e7d1b473f8290ae52d13e105194

SHA1
5e565d99a7733250427e70f5f6e1951a081deed6

SHA256
712db2b991a3c11ccd71b36cfe99fad0b5b1eb1026b12d28c35a43334128671a

SHA512
0d6e2f0f8963986cb27a5cb853c5a87af5d2b65142ff082b4a12681b467d4a72efbcaea71307513523915aa4f27e7b238c67f4ab563f69525938f38253599424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
624e41a75a6dfd62039973dbbfdbe622

SHA1
f791e4cc85d6ae7039acef57a9025b173d7e963b

SHA256
ced1b5ac330145fa608627ad4de1dfb3533375f19b6da3d02ad202d0b7732bc1

SHA512
a13a128a5ea8aad3bcd5f3dbffa5fbfe7763370d8e43b546a1df1da3b0ec0d520cf5fcc8c25c22fd1e73ea1d00da1bee99305e028e71e193339e4fa8ce8f0b2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
32b16440fab3a1055d9c22b90935bdfb

SHA1
ee350c4a65b81468487a3660dfe4f373660b9070

SHA256
ee68b728a82fefc941eba10390d9d70f5aeb442039c901eaf9a18477761cfd35

SHA512
5a1f36ab56e25548fd2875d364cfec39830e855b89628718f786bb8158147ee6fd66f2b7477d1b57b0d8cec5b8f10d173face18f4131ecec0dc67ca9ae56216c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be67063c62a242565760a02a642a9f02

SHA1
d1043a892b44d6676f71b568f578fff947266a19

SHA256
56f158298dc5f781d6636a0b15d040f9cffb1d46cd11079aa40a26b662217f48

SHA512
90d2cbd882ff8043412ad25e74df0cf6b71d6f3fbdfa6f1efa0efc8eed86a925606c7d2e967f112a34d3f0e04f01a396898508571400dcf7e6fd69e78f406638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a672fcf7facce635c83caf7b195d0bf8

SHA1
fec2f6c2456efe713ba08fa692a4a356f2f37ba8

SHA256
71945453f618f8cf9c2ddb24132d7e0522643e13ce42a59ff65476938f56082c

SHA512
12713a140e8a73c9dd8b3bc309e3ff1256c16ecd019d1ded31ab47c71651b11dcdcf48ef889805e5bc87bdeb323c5663ff34313cc41170d2d9b45051107dc31f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3505effaead0f06d098f1aec01836881

SHA1
94bafdbeb2f5adbd8cec709574df5b8dbcc5eba3

SHA256
5d39a25ff8842c7c14aa14f99c5e3e1606fb7516c57f03dc41069df3c3de0517

SHA512
934d8eab5bc2ec20e800c668f3c3434829feade4771918a22d712f7ba39f91f93877a1e9dc1beac966646af0c9dd2cf118041535143b3abc585fea8dfb1299f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\4427c957-71c0-40e6-96be-35c84047527c.vbs

Filesize
720B

MD5
5beab4762b8a441cc86c5486b9ac0274

SHA1
2c304335d6ef11e137c8c0007cd98151c91da0ad

SHA256
fcce64864de0df9b657c270e5b9f8c0fc715111af046cbec46e38cf5b5ea0186

SHA512
094ff59ba82654a23818219626b52820084785362f52b0d8f1a7f08ae5b76b9d5a7aebd85440f00791fea2ae9bfc7a39a61bbdc6028163e10d5e85f3d642b8ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\571dc848-1f9e-45d8-b50c-c6114e16e7e1.vbs

Filesize
720B

MD5
9e9ee45c7599ba1ccdd5e2d7da7377fb

SHA1
c6296ec9dbcf3420f10bcedc73c7451647cd4a9f

SHA256
565ba7e7c2caa58b7053b004017a37f18099d57de91fc6234d084b64853a9655

SHA512
5fb081e562ab4b90a69764504d62e64be6cae597411af28c2bfa5ab06fb74d381415fba49bf1044cbfadf6b7879a1ff7cc5fa9cea97bed746b5bb479ce7a613d

Download Submit
C:\Users\Admin\AppData\Local\Temp\5fc4f793-2796-42aa-a3c9-e0ec6930d6b9.vbs

Filesize
720B

MD5
59504a54a33f44340af1c356baff7bb6

SHA1
2f58c5ac9c87cc70e598108e42322a3eebe83b53

SHA256
b9b189f3b653c464f686e7c9140f51789ae7327cfa3e46b7743d48605952a427

SHA512
c77daccbaf97d35e14187bad3ecfd5de0f902a2beaba3254e3075087ba2d9a4b7af7ccc6714bdca7b7f5d21e95025968e07b4dcc3cc0038c2b069de5988ff2f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\63f00e78-a057-4fe5-9ef8-fe6e4f218a1e.vbs

Filesize
720B

MD5
ac1f3065453d69e070008f437f5ce5dd

SHA1
888b574b413c87a04b5b0abeb07d7e3687a6311e

SHA256
8c2be33e264ce9f5743979e7cf2311a07085786f7b7cbb39ab167a2aaf90ce4e

SHA512
0084620e0afb32b4f6e49c2a60987dc33381dafdd3e90e5e07f6f8309c172eab063695d98e1154f47f88a096d3f5ae24db24fbd4a0127a261a50162b3cd343a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\6zDfnUQuHU.bat

Filesize
267B

MD5
3446e761b36bddfedff6f2658539cbf5

SHA1
8e2f44b9e14c854386a2e5d335444c1921fd1797

SHA256
add36727b8f0f51f1163f756ad62af5fcc1a0957d38214585ac76d653f97b593

SHA512
f36859d89fd4edb1da6aaba9c73110136e079ca84614cb3ae4158d4f352a1f6ebf3bffc762837f590267dd80185490cf2c272f9f12548615f8b07beb9b9ee13d

Download Submit
C:\Users\Admin\AppData\Local\Temp\9a15fe22-aff9-4c18-abe6-ac355edab16e.vbs

Filesize
720B

MD5
36c09d3e913a56073e1bcf39d420d8e8

SHA1
0db2eb875fffa93700cd97416bcb740590f11574

SHA256
9002736b2900f9ad9b8483942e996399d5158a50b878f33888399763b39b9584

SHA512
8d213c0be2b3805a5a3c1b79417834a4936a225c5705b30dd64e7d383e7cc5691723ab7032a5882a33b5b5966cb47834f81fd3fa067102a929c5bfde3235e47b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wl52nig5.viz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcc26666-243c-4d92-b91b-706d0cd0aa10.vbs

Filesize
496B

MD5
23185932f9abc3afcee5dd77ba6c4118

SHA1
65fa76ce1f6a064667a043bac317bad425a99a8f

SHA256
e9060a2b467986243ebed5a007efff55d66aa18175dca2dcb8a0811f7bd0988d

SHA512
8cf918889ba8b7c0a7e1ba77a6821976c925510793855e0527230685c3d6324a28158649322bec11211b9b3227c94f211a6635e9937110283cc0e7a4d93a5c94

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8BF8.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
memory/1604-67-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2664-12-0x000000001C150000-0x000000001C678000-memory.dmp

Filesize
5.2MB

Download
memory/2664-6-0x0000000000FD0000-0x0000000000FD8000-memory.dmp

Filesize
32KB

Download
memory/2664-75-0x00007FFE2E220000-0x00007FFE2ECE1000-memory.dmp

Filesize
10.8MB

Download
memory/2664-17-0x000000001BC50000-0x000000001BC58000-memory.dmp

Filesize
32KB

Download
memory/2664-18-0x000000001BD60000-0x000000001BD6C000-memory.dmp

Filesize
48KB

Download
memory/2664-16-0x000000001BC40000-0x000000001BC48000-memory.dmp

Filesize
32KB

Download
memory/2664-1-0x00000000001C0000-0x00000000006B4000-memory.dmp

Filesize
5.0MB

Download
memory/2664-14-0x000000001BC20000-0x000000001BC2E000-memory.dmp

Filesize
56KB

Download
memory/2664-15-0x000000001BC30000-0x000000001BC3E000-memory.dmp

Filesize
56KB

Download
memory/2664-13-0x000000001BBC0000-0x000000001BBCA000-memory.dmp

Filesize
40KB

Download
memory/2664-0-0x00007FFE2E223000-0x00007FFE2E225000-memory.dmp

Filesize
8KB

Download
memory/2664-11-0x000000001BBB0000-0x000000001BBC2000-memory.dmp

Filesize
72KB

Download
memory/2664-10-0x000000001BBA0000-0x000000001BBAA000-memory.dmp

Filesize
40KB

Download
memory/2664-9-0x000000001B530000-0x000000001B540000-memory.dmp

Filesize
64KB

Download
memory/2664-8-0x000000001BB80000-0x000000001BB96000-memory.dmp

Filesize
88KB

Download
memory/2664-7-0x000000001B520000-0x000000001B530000-memory.dmp

Filesize
64KB

Download
memory/2664-2-0x000000001B550000-0x000000001B67E000-memory.dmp

Filesize
1.2MB

Download
memory/2664-5-0x000000001BBD0000-0x000000001BC20000-memory.dmp

Filesize
320KB

Download
memory/2664-3-0x00007FFE2E220000-0x00007FFE2ECE1000-memory.dmp

Filesize
10.8MB

Download
memory/2664-4-0x000000001B2F0000-0x000000001B30C000-memory.dmp

Filesize
112KB

Download
memory/4416-480-0x000000001D9F0000-0x000000001DA02000-memory.dmp

Filesize
72KB

Download
memory/4508-202-0x000000001B320000-0x000000001B332000-memory.dmp

Filesize
72KB

Download
memory/4768-102-0x00000223CAD40000-0x00000223CAD62000-memory.dmp

Filesize
136KB

Download