dcrat | 6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
01-11-2024 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Size

4.9MB
MD5

325d72ca61c441e5eda24a533fb9771e
SHA1

f54eccb4118598ac4e51c6318ec91e5780ae4687
SHA256

6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3
SHA512

d2d17feefd6cf6a28425ca5204ed1ce17475f7657cc73487a7ddc2edea470edb2f2e79b60c29944257f08033073c3e89cf4f11cf97b90d7bf812e9cea143df6c
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2856	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2856	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2856	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2856	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2856	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2856	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2856	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2856	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2856	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	2856	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2856	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2856	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2856	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2856	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2856	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	520	2856	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2856	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2856	schtasks.exe	31

UAC bypass 3 TTPs 30 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2296-2-0x000000001B550000-0x000000001B67E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3024	powershell.exe
2500	powershell.exe
3008	powershell.exe
2792	powershell.exe
2060	powershell.exe
2292	powershell.exe
1200	powershell.exe
1308	powershell.exe
3048	powershell.exe
1652	powershell.exe
2000	powershell.exe
3056	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
2544	csrss.exe
628	csrss.exe
2764	csrss.exe
568	csrss.exe
3008	csrss.exe
2404	csrss.exe
812	csrss.exe
752	csrss.exe
2412	csrss.exe

Checks whether UAC is enabled 1 TTPs 20 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\c5b4cb5e9653cc	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX21A6.tmp	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\services.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\services.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\schemas\RCX28E9.tmp	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Windows\schemas\taskhost.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Windows\tracing\RCX2B6A.tmp	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File opened for modification	C:\Windows\tracing\csrss.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Windows\schemas\taskhost.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Windows\schemas\b75386f1303e64	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Windows\tracing\csrss.exe	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
File created	C:\Windows\tracing\886983d96e3d3e	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2604	schtasks.exe
2360	schtasks.exe
2932	schtasks.exe
2772	schtasks.exe
2860	schtasks.exe
2616	schtasks.exe
2580	schtasks.exe
1620	schtasks.exe
520	schtasks.exe
1648	schtasks.exe
2980	schtasks.exe
2912	schtasks.exe
2684	schtasks.exe
2728	schtasks.exe
2640	schtasks.exe
2668	schtasks.exe
2240	schtasks.exe
1244	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
1652	powershell.exe
2000	powershell.exe
3024	powershell.exe
3048	powershell.exe
1308	powershell.exe
2792	powershell.exe
1200	powershell.exe
3056	powershell.exe
3008	powershell.exe
2060	powershell.exe
2292	powershell.exe
2500	powershell.exe
2544	csrss.exe
628	csrss.exe
2764	csrss.exe
568	csrss.exe
3008	csrss.exe
2404	csrss.exe
812	csrss.exe
752	csrss.exe
2412	csrss.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	2544	csrss.exe
Token: SeDebugPrivilege	628	csrss.exe
Token: SeDebugPrivilege	2764	csrss.exe
Token: SeDebugPrivilege	568	csrss.exe
Token: SeDebugPrivilege	3008	csrss.exe
Token: SeDebugPrivilege	2404	csrss.exe
Token: SeDebugPrivilege	812	csrss.exe
Token: SeDebugPrivilege	752	csrss.exe
Token: SeDebugPrivilege	2412	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1652	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	50
PID 2296 wrote to memory of 1652	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	50
PID 2296 wrote to memory of 1652	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	50
PID 2296 wrote to memory of 2000	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	51
PID 2296 wrote to memory of 2000	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	51
PID 2296 wrote to memory of 2000	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	51
PID 2296 wrote to memory of 2060	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	52
PID 2296 wrote to memory of 2060	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	52
PID 2296 wrote to memory of 2060	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	52
PID 2296 wrote to memory of 2792	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	55
PID 2296 wrote to memory of 2792	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	55
PID 2296 wrote to memory of 2792	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	55
PID 2296 wrote to memory of 2500	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	56
PID 2296 wrote to memory of 2500	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	56
PID 2296 wrote to memory of 2500	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	56
PID 2296 wrote to memory of 2292	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	57
PID 2296 wrote to memory of 2292	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	57
PID 2296 wrote to memory of 2292	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	57
PID 2296 wrote to memory of 3056	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	58
PID 2296 wrote to memory of 3056	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	58
PID 2296 wrote to memory of 3056	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	58
PID 2296 wrote to memory of 3024	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	59
PID 2296 wrote to memory of 3024	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	59
PID 2296 wrote to memory of 3024	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	59
PID 2296 wrote to memory of 3048	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	61
PID 2296 wrote to memory of 3048	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	61
PID 2296 wrote to memory of 3048	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	61
PID 2296 wrote to memory of 3008	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	62
PID 2296 wrote to memory of 3008	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	62
PID 2296 wrote to memory of 3008	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	62
PID 2296 wrote to memory of 1200	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	63
PID 2296 wrote to memory of 1200	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	63
PID 2296 wrote to memory of 1200	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	63
PID 2296 wrote to memory of 1308	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	64
PID 2296 wrote to memory of 1308	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	64
PID 2296 wrote to memory of 1308	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	64
PID 2296 wrote to memory of 2544	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	74
PID 2296 wrote to memory of 2544	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	74
PID 2296 wrote to memory of 2544	2296	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe	74
PID 2544 wrote to memory of 1884	2544	csrss.exe	75
PID 2544 wrote to memory of 1884	2544	csrss.exe	75
PID 2544 wrote to memory of 1884	2544	csrss.exe	75
PID 2544 wrote to memory of 2452	2544	csrss.exe	76
PID 2544 wrote to memory of 2452	2544	csrss.exe	76
PID 2544 wrote to memory of 2452	2544	csrss.exe	76
PID 1884 wrote to memory of 628	1884	WScript.exe	77
PID 1884 wrote to memory of 628	1884	WScript.exe	77
PID 1884 wrote to memory of 628	1884	WScript.exe	77
PID 628 wrote to memory of 1068	628	csrss.exe	78
PID 628 wrote to memory of 1068	628	csrss.exe	78
PID 628 wrote to memory of 1068	628	csrss.exe	78
PID 628 wrote to memory of 2716	628	csrss.exe	79
PID 628 wrote to memory of 2716	628	csrss.exe	79
PID 628 wrote to memory of 2716	628	csrss.exe	79
PID 1068 wrote to memory of 2764	1068	WScript.exe	80
PID 1068 wrote to memory of 2764	1068	WScript.exe	80
PID 1068 wrote to memory of 2764	1068	WScript.exe	80
PID 2764 wrote to memory of 584	2764	csrss.exe	81
PID 2764 wrote to memory of 584	2764	csrss.exe	81
PID 2764 wrote to memory of 584	2764	csrss.exe	81
PID 2764 wrote to memory of 548	2764	csrss.exe	82
PID 2764 wrote to memory of 548	2764	csrss.exe	82
PID 2764 wrote to memory of 548	2764	csrss.exe	82
PID 584 wrote to memory of 568	584	WScript.exe	83

System policy modification 1 TTPs 30 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe
"C:\Users\Admin\AppData\Local\Temp\6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1308
- C:\Users\Default User\csrss.exe
  "C:\Users\Default User\csrss.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2544
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4c3ad57-1558-4953-9c89-3f65abcafb60.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Users\Default User\csrss.exe
      "C:\Users\Default User\csrss.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:628
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\06d1b426-8445-496d-9e96-d9a6de6f03ca.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1068
      - C:\Users\Default User\csrss.exe
        
        "C:\Users\Default User\csrss.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d93f8199-f159-4969-bb41-78dbb235d57d.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:584
        
        C:\Users\Default User\csrss.exe
        
        "C:\Users\Default User\csrss.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:568
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27c13ee9-e9c8-4681-813b-bfa06a7185e8.vbs"
        9⤵
        
        PID:808
        
        C:\Users\Default User\csrss.exe
        
        "C:\Users\Default User\csrss.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\16bd1c43-c412-409a-a6e8-3bc6574ed3a8.vbs"
        11⤵
        
        PID:2052
        
        C:\Users\Default User\csrss.exe
        
        "C:\Users\Default User\csrss.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2404
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2de0ea6-45d0-4959-8c36-08eb6c794247.vbs"
        13⤵
        
        PID:1968
        
        C:\Users\Default User\csrss.exe
        
        "C:\Users\Default User\csrss.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:812
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f776c5b6-da3c-4d1e-9319-fc353c0bef4b.vbs"
        15⤵
        
        PID:1912
        
        C:\Users\Default User\csrss.exe
        
        "C:\Users\Default User\csrss.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:752
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad0ff5f4-6417-4dc9-80a4-3cade7f8a3a5.vbs"
        17⤵
        
        PID:3060
        
        C:\Users\Default User\csrss.exe
        
        "C:\Users\Default User\csrss.exe"
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2412
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dfbd4c10-825a-4e6b-af89-a1fd91434e54.vbs"
        19⤵
        
        PID:808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8944396b-4e82-4978-927c-1cb5dd7641f4.vbs"
        19⤵
        
        PID:2988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8aea4b13-12e7-498a-b733-b44f473e24fc.vbs"
        17⤵
        
        PID:844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce67b832-229f-4319-8630-8ccdceeb92d0.vbs"
        15⤵
        
        PID:1124
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d5ebee2f-3788-408e-bfd4-5468c3eec112.vbs"
        13⤵
        
        PID:2776
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4f50ea8-ad61-4a5a-9983-c88c34fa38bc.vbs"
        11⤵
        
        PID:3000
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\066bcec8-bf06-499f-9459-b66bc16d40dc.vbs"
        9⤵
        
        PID:1648
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ba13b26e-d5c7-4b3c-93b7-a2a01bff3054.vbs"
        7⤵
        
        PID:548
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd5783a3-5cba-404a-a026-01f109ef9363.vbs"
        5⤵
        
        PID:2716
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a2c7d82-3dfe-4313-835d-a1327dab8b1d.vbs"
    3⤵
    PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Windows\schemas\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\schemas\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Windows\schemas\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\tracing\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\tracing\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\tracing\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\06d1b426-8445-496d-9e96-d9a6de6f03ca.vbs

Filesize
706B

MD5
0b0a8e38c9de978d4494bfcff81bcfa4

SHA1
165133509a3c21d9cc5ddd181a05b068a963c00f

SHA256
7e7365501b15e6a3cb588ff781c7a4788571a32c8290824b00052cf2acc3c949

SHA512
3739e19c463bb208295989d2350737a80e173e3b7538970a5d25d9f1134ba7c17848451ba7e289fdb596b218519b66af067cd85de11d7d1bedbb26ac6da84ff3

Download Submit
C:\Users\Admin\AppData\Local\Temp\16bd1c43-c412-409a-a6e8-3bc6574ed3a8.vbs

Filesize
707B

MD5
12e790aac8ce63a0efa3fe6d7f4ca46b

SHA1
cd0fbbdc36f2e1b3c09c10b4ad1c51a21d12e838

SHA256
ad723dd4355c1c49cf050915ebc4f81396a4a2d03310afd3a3b99133e5b0106b

SHA512
214c90f09e3decbdbc454c0bd5ddbee8c82fa6a848fa58059c8bcc7477e144f7a8ef3192d7eb72af2f334e1adb537b142bf4d53374b518507181547e1b1c7a3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1a2c7d82-3dfe-4313-835d-a1327dab8b1d.vbs

Filesize
483B

MD5
c0db55ea8887af275355901bbf4e5b3d

SHA1
5de779f6ca76eb61b1e70a20036190657776dbf7

SHA256
81bd8f6866c887f6ba18d326e2b7ada8e7c8f6b9284eb730bdfaea201f14bbbf

SHA512
80ce45374b160962d6600774e0b3f07f965a6e7c526cd8c0bcd115b6d5d445dc2689eb7b41b4f998ff057d3765281eff125510b84d21bc2ae979e9b26e30792c

Download Submit
C:\Users\Admin\AppData\Local\Temp\27c13ee9-e9c8-4681-813b-bfa06a7185e8.vbs

Filesize
706B

MD5
b26ab08eb86e5ae2eda3acb9a3bc144a

SHA1
55a7a5ae598591c807b3154f4f903ac9a6470176

SHA256
b2e729dc15d0400783bdaea225cbd1efb95a83f829584c0bbd1e6749af2a7ef2

SHA512
f6a00b1e0220b56c84eaedef0f0047b4a67c41c43eb7570246c0e4dca5777b1fe38bb3cc231f9e595694e66dab95ba28ac5507ed24693c67e2ad030425264b71

Download Submit
C:\Users\Admin\AppData\Local\Temp\ad0ff5f4-6417-4dc9-80a4-3cade7f8a3a5.vbs

Filesize
706B

MD5
9cadbd386c896d05f560ee21f9d78525

SHA1
9f47161e51c52df9ad8ece893037c9de9ec34685

SHA256
2f8c32fd645ae2acf8e67a1e24cbbc2ad44d97d400f3a799a70cfcae8a7cc5da

SHA512
e65eb7300ef381bcbbc5dd1a8ca6bd751c267b3dd10a33582e95d33fbcb9a841a88e38bca4d5384c6fce951a0358bc3868b4ab195be996737a453fa39670524d

Download Submit
C:\Users\Admin\AppData\Local\Temp\b4c3ad57-1558-4953-9c89-3f65abcafb60.vbs

Filesize
707B

MD5
0b47a46365de0297a45abe44682ccd08

SHA1
d4460f1984be5ab378495b72c2fa5b856054d999

SHA256
6e94f3da92efb97285c1b5c1661e150e7745e69d730be2f0dd2413305cd5b97c

SHA512
19f4eab23dd52e2d30c28279cc31565834e039281ad2a26844997f4f3563d402f05ea91ac0042564ea2903fc6843dec64a0fa22fd219e0cb55392364c5594da4

Download Submit
C:\Users\Admin\AppData\Local\Temp\d93f8199-f159-4969-bb41-78dbb235d57d.vbs

Filesize
707B

MD5
97243bf6f506c792487a866d9cec227a

SHA1
b44180a3addafcb444d6daabbce396bb55b45498

SHA256
2a26db8a572bf54828d36be3021c00a13a2c192cb66045e8b4c801c437a0e2e9

SHA512
c5841f5847d028b9404f742800e4f694eaf1fa582143e4e2b4d5abf4343dd5da365d8bdb41b98d87a09230ade4ae498f424a7c3062b068f084141b9a26cddb69

Download Submit
C:\Users\Admin\AppData\Local\Temp\dfbd4c10-825a-4e6b-af89-a1fd91434e54.vbs

Filesize
707B

MD5
737a9b80e6fa790bfb6c9fb5c3f282cc

SHA1
dd56ab200962ce1733d36602be4e38eea852e06e

SHA256
4ebef03d8c9257d36fab12f46eed127cd8f379a8be52956039de2cda9c4cac4f

SHA512
0669b4b558f1f8a6773c383ace8f918cb0e1405f735e33cf2647e75a39277f471ae45ef208bda4125bcd66695804e5b8ac14a7c1ac5cb90b0875d03224627b95

Download Submit
C:\Users\Admin\AppData\Local\Temp\f2de0ea6-45d0-4959-8c36-08eb6c794247.vbs

Filesize
707B

MD5
03fe85c57489b274f4d0630a99265583

SHA1
6970a018d1dc54abdfaf79718dc5788ea3cb3dd2

SHA256
e27671c45475deed9a2bd9947dabf9c14d7fa2b2a93efccca1bfd1bf0848a5f1

SHA512
937311ee210ff99afe09751e929fb916eee3320be1d9f5c363c8a9b500b7b94b71d941d4116cadf38cec0207f7df33bbc775426777fff7c8b400c061c2ed84ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\f776c5b6-da3c-4d1e-9319-fc353c0bef4b.vbs

Filesize
706B

MD5
5c589f537dd4713009af834f60ba7d5e

SHA1
7e97f4a733371e7b05da1b41b6a83469966be0a8

SHA256
8ff0a0799eb59249e70e97ed8e18c40d048c3a2d6f3d4be08390d82447c2828b

SHA512
50122670d47aa3f09e4112f80df6cca251cf4936b573d768d8beced47d46dd86b5d7e0d7b299b502360d2ca402224c75a904c19552bab298d67e8f7c46108e67

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4682.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4454bedcc00488c08de8e6f8146e249e

SHA1
4c30b32f545528c80ce26b647dcc3ce8664f15bc

SHA256
f5b78f3faf42133f67e111eaa5c4663b6cfa7117dbf6f0ee84405179f389e829

SHA512
58f4238da37d0ef2ff223212ee0ca3c0585a3b4784afc7362bd9e7c974c54a0cb85095935356df7cbfa5d09b5dab18c2dfe335438778dfc567ac768ddd839712

Download Submit
C:\Users\Default\csrss.exe

Filesize
4.9MB

MD5
1d2a549bc4fe868a6accf7050833b79e

SHA1
b1121f2dfdd90948068a45abc4a20a77ca2631a6

SHA256
144ef82f0a9eb133de8ff67dd1a7b890dbe30dc047fd95474efeaaa4b7dc67fe

SHA512
bce50af89a68af2569c686045c102f078f67dab5215f6ccbe9fbd5c8374802a63cc57acbad185d739a462780cb2597f63c765e2aaa4e13b81122483e4a2a762b

Download Submit
C:\Windows\tracing\RCX2B6A.tmp

Filesize
4.9MB

MD5
87099f457e2b78adc53a39c75271fbb5

SHA1
9f610241f9159c1f90f85af980e5d1472a13a2cf

SHA256
6f4eb7260c718bdcd927aa6834b240204bec67e8d777ecf465ef1b3de20e7a94

SHA512
7a858ccc397c384f7f9041f61537c1f18ed3b5b0c74e57b12a49336f858859e41835ad5f7820524f8f5a21b77fde85ad775fe59d50e33903e00e6f1e3cdf6fd0

Download Submit
C:\Windows\tracing\csrss.exe

Filesize
4.9MB

MD5
325d72ca61c441e5eda24a533fb9771e

SHA1
f54eccb4118598ac4e51c6318ec91e5780ae4687

SHA256
6f520e24c288bcfd97376ff3365418438179a494a676798a9c56351bd42d5fb3

SHA512
d2d17feefd6cf6a28425ca5204ed1ce17475f7657cc73487a7ddc2edea470edb2f2e79b60c29944257f08033073c3e89cf4f11cf97b90d7bf812e9cea143df6c

Download Submit
memory/568-185-0x0000000001310000-0x0000000001804000-memory.dmp

Filesize
5.0MB

Download
memory/628-156-0x0000000000CF0000-0x00000000011E4000-memory.dmp

Filesize
5.0MB

Download
memory/1652-87-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

Filesize
32KB

Download
memory/2000-85-0x000000001B3B0000-0x000000001B692000-memory.dmp

Filesize
2.9MB

Download
memory/2296-11-0x0000000000C40000-0x0000000000C4A000-memory.dmp

Filesize
40KB

Download
memory/2296-7-0x00000000003B0000-0x00000000003C6000-memory.dmp

Filesize
88KB

Download
memory/2296-16-0x0000000002590000-0x000000000259C000-memory.dmp

Filesize
48KB

Download
memory/2296-15-0x0000000000C80000-0x0000000000C88000-memory.dmp

Filesize
32KB

Download
memory/2296-88-0x000007FEF5833000-0x000007FEF5834000-memory.dmp

Filesize
4KB

Download
memory/2296-1-0x0000000000C90000-0x0000000001184000-memory.dmp

Filesize
5.0MB

Download
memory/2296-142-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download
memory/2296-12-0x0000000000C50000-0x0000000000C5E000-memory.dmp

Filesize
56KB

Download
memory/2296-10-0x0000000000C30000-0x0000000000C42000-memory.dmp

Filesize
72KB

Download
memory/2296-9-0x0000000000C20000-0x0000000000C2A000-memory.dmp

Filesize
40KB

Download
memory/2296-14-0x0000000000C70000-0x0000000000C78000-memory.dmp

Filesize
32KB

Download
memory/2296-0-0x000007FEF5833000-0x000007FEF5834000-memory.dmp

Filesize
4KB

Download
memory/2296-8-0x00000000005E0000-0x00000000005F0000-memory.dmp

Filesize
64KB

Download
memory/2296-13-0x0000000000C60000-0x0000000000C6E000-memory.dmp

Filesize
56KB

Download
memory/2296-6-0x0000000000320000-0x0000000000330000-memory.dmp

Filesize
64KB

Download
memory/2296-5-0x0000000000310000-0x0000000000318000-memory.dmp

Filesize
32KB

Download
memory/2296-2-0x000000001B550000-0x000000001B67E000-memory.dmp

Filesize
1.2MB

Download
memory/2296-4-0x00000000002F0000-0x000000000030C000-memory.dmp

Filesize
112KB

Download
memory/2296-3-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download
memory/2404-214-0x0000000000610000-0x0000000000622000-memory.dmp

Filesize
72KB

Download
memory/2412-257-0x0000000000020000-0x0000000000514000-memory.dmp

Filesize
5.0MB

Download
memory/2544-107-0x0000000000280000-0x0000000000774000-memory.dmp

Filesize
5.0MB

Download