Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
03-11-2024 09:52
Behavioral task
behavioral1
Sample
004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe
Resource
win10v2004-20241007-en
General
-
Target
004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe
-
Size
952KB
-
MD5
b86ee30e813ada623950e69411e39f20
-
SHA1
8027da1ceaf274b125b2499404f44933ce8c1cf3
-
SHA256
004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766cee
-
SHA512
c9d16edd860b01f893ee47dd65dea0ee3779015b4039a0fdf05a6567dd5ecdb87ec8012a8306e0237a0675a27e9b3db6553a10fb941336f26fd468fa85ef5fd9
-
SSDEEP
24576:2+O7F9smBDJwWmIezBLwsHuWbxR4AK5ZJXX:R8/KfRTK
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\audiodg.exe\", \"C:\\Windows\\System32\\dispex\\wininit.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\de-DE\\System.exe\", \"C:\\Documents and Settings\\lsass.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\audiodg.exe\", \"C:\\Windows\\System32\\dispex\\wininit.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\de-DE\\System.exe\", \"C:\\Documents and Settings\\lsass.exe\", \"C:\\Users\\Default User\\taskhost.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\audiodg.exe\", \"C:\\Windows\\System32\\dispex\\wininit.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\de-DE\\System.exe\", \"C:\\Documents and Settings\\lsass.exe\", \"C:\\Users\\Default User\\taskhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe\", \"C:\\Windows\\System32\\RestartManagerUninstall\\smss.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\audiodg.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\audiodg.exe\", \"C:\\Windows\\System32\\dispex\\wininit.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\de-DE\\System.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\audiodg.exe\", \"C:\\Windows\\System32\\dispex\\wininit.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\de-DE\\System.exe\", \"C:\\Documents and Settings\\lsass.exe\", \"C:\\Users\\Default User\\taskhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\lsass.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\audiodg.exe\", \"C:\\Windows\\System32\\dispex\\wininit.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\de-DE\\System.exe\", \"C:\\Documents and Settings\\lsass.exe\", \"C:\\Users\\Default User\\taskhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\audiodg.exe\", \"C:\\Windows\\System32\\dispex\\wininit.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\de-DE\\System.exe\", \"C:\\Documents and Settings\\lsass.exe\", \"C:\\Users\\Default User\\taskhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe\", \"C:\\Windows\\System32\\RestartManagerUninstall\\smss.exe\", \"C:\\Windows\\System32\\ipsecsnp\\services.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\audiodg.exe\", \"C:\\Windows\\System32\\dispex\\wininit.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe -
Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2684 2656 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2672 2656 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2488 2656 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2708 2656 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2700 2656 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1168 2656 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1888 2656 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 884 2656 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2584 2656 schtasks.exe 30 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" audiodg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" audiodg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" audiodg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe -
resource yara_rule behavioral1/memory/2128-1-0x0000000001320000-0x0000000001414000-memory.dmp dcrat behavioral1/files/0x0005000000019489-20.dat dcrat behavioral1/memory/1452-150-0x0000000000A40000-0x0000000000B34000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
pid Process 1452 audiodg.exe -
Adds Run key to start application 2 TTPs 18 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\System32\\RestartManagerUninstall\\smss.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\System32\\ipsecsnp\\services.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\System32\\dispex\\wininit.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\de-DE\\System.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Documents and Settings\\lsass.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Documents and Settings\\lsass.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Default User\\taskhost.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\lsass.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\System32\\ipsecsnp\\services.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Documents and Settings\\audiodg.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Documents and Settings\\audiodg.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\System32\\dispex\\wininit.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Default User\\taskhost.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN = "\"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\System32\\RestartManagerUninstall\\smss.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN = "\"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\de-DE\\System.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\lsass.exe\"" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA audiodg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" audiodg.exe -
Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\System32\RestartManagerUninstall\smss.exe 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File created C:\Windows\System32\ipsecsnp\services.exe 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File opened for modification C:\Windows\System32\RestartManagerUninstall\RCX9407.tmp 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File opened for modification C:\Windows\System32\ipsecsnp\RCX963A.tmp 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File created C:\Windows\System32\dispex\560854153607923c4c5f107085a7db67be01f252 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File created C:\Windows\System32\RestartManagerUninstall\69ddcba757bf72f7d36c464c71f42baab150b2b9 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File opened for modification C:\Windows\System32\RestartManagerUninstall\RCX9406.tmp 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File opened for modification C:\Windows\System32\RestartManagerUninstall\smss.exe 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File opened for modification C:\Windows\System32\ipsecsnp\services.exe 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File created C:\Windows\System32\dispex\wininit.exe 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File created C:\Windows\System32\ipsecsnp\c5b4cb5e9653cce737f29f72ba880dd4c4bab27d 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File opened for modification C:\Windows\System32\dispex\RCX870F.tmp 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File opened for modification C:\Windows\System32\dispex\RCX871F.tmp 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File opened for modification C:\Windows\System32\ipsecsnp\RCX962A.tmp 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File opened for modification C:\Windows\System32\dispex\wininit.exe 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows NT\Accessories\de-DE\System.exe 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File created C:\Program Files (x86)\Windows NT\Accessories\de-DE\System.exe 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File created C:\Program Files (x86)\Windows NT\Accessories\de-DE\27d1bcfc3c54e0e44ea423ffd4ee81fe73670a2a 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\de-DE\RCX8990.tmp 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\de-DE\RCX89A1.tmp 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2684 schtasks.exe 2708 schtasks.exe 1888 schtasks.exe 884 schtasks.exe 2584 schtasks.exe 2672 schtasks.exe 2488 schtasks.exe 2700 schtasks.exe 1168 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2128 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2128 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Token: SeDebugPrivilege 1452 audiodg.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2128 wrote to memory of 948 2128 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe 40 PID 2128 wrote to memory of 948 2128 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe 40 PID 2128 wrote to memory of 948 2128 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe 40 PID 948 wrote to memory of 112 948 cmd.exe 42 PID 948 wrote to memory of 112 948 cmd.exe 42 PID 948 wrote to memory of 112 948 cmd.exe 42 PID 948 wrote to memory of 1452 948 cmd.exe 43 PID 948 wrote to memory of 1452 948 cmd.exe 43 PID 948 wrote to memory of 1452 948 cmd.exe 43 -
System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" audiodg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" audiodg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" audiodg.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe"C:\Users\Admin\AppData\Local\Temp\004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2128 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Xg4aZZWmiX.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:112
-
-
C:\Documents and Settings\audiodg.exe"C:\Documents and Settings\audiodg.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1452
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Documents and Settings\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\dispex\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\de-DE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Documents and Settings\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1168
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1888
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\System32\RestartManagerUninstall\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\ipsecsnp\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
201B
MD5b7fe229944cfe750f720d6b31c06219c
SHA10c285b0904b838e8078c2008d31ab9eee4d816cb
SHA256c2349a7b2520eb1dc9c66a661c41547dd6e1736774dc19fb7b35016bf0b60090
SHA51297e46ba04c36d21b61c13d56914d2d9b0ca39e9eb40b7e3a104677f636454f86d4d7919c00a067f9950a3a2a3ca78556558002f005db34898546f2e8543d8bc7
-
Filesize
952KB
MD5b86ee30e813ada623950e69411e39f20
SHA18027da1ceaf274b125b2499404f44933ce8c1cf3
SHA256004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766cee
SHA512c9d16edd860b01f893ee47dd65dea0ee3779015b4039a0fdf05a6567dd5ecdb87ec8012a8306e0237a0675a27e9b3db6553a10fb941336f26fd468fa85ef5fd9