colibri | 6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Size

4.9MB
MD5

9fd149523fb2483c3541e7efc6ac71eb
SHA1

454b165a30c8da28b9f16212addaeb214d8fb77d
SHA256

6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18
SHA512

84f619c3f3d4cdc7fe5ceb12185f39f04ba84ca34b6f8b66cb34f8bfc418542090dec9c4fa8a045c8b45374f4fa36af8150e4fee2d22724392397b53570cee9a
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri

DcRat 51 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		1160	schtasks.exe
		4400	schtasks.exe
		5608	schtasks.exe
		5704	schtasks.exe
		5932	schtasks.exe
		6044	schtasks.exe
		212	schtasks.exe
		3852	schtasks.exe
		4628	schtasks.exe
		3452	schtasks.exe
		5624	schtasks.exe
		5796	schtasks.exe
		5964	schtasks.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\886983d96e3d3e		6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
		5680	schtasks.exe
		5780	schtasks.exe
		5888	schtasks.exe
		5988	schtasks.exe
		6004	schtasks.exe
		6112	schtasks.exe
		5592	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
		3684	schtasks.exe
		5820	schtasks.exe
		5876	schtasks.exe
		6020	schtasks.exe
		6100	schtasks.exe
		396	schtasks.exe
		4880	schtasks.exe
		3488	schtasks.exe
		3448	schtasks.exe
		5648	schtasks.exe
		6076	schtasks.exe
		2768	schtasks.exe
		3452	schtasks.exe
		1008	schtasks.exe
		2832	schtasks.exe
		5720	schtasks.exe
		5764	schtasks.exe
		5836	schtasks.exe
		6056	schtasks.exe
File created	C:\Program Files\Java\jdk-1.8\jre\ee2ad38f3d4382		6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
		5736	schtasks.exe
		5908	schtasks.exe
		5948	schtasks.exe
		3488	schtasks.exe
		1932	schtasks.exe
		5664	schtasks.exe
		5852	schtasks.exe
		6132	schtasks.exe
		4872	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3684	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3448	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5592	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5608	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5624	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5648	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5664	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5680	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5704	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5720	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5736	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5764	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5780	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5796	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5820	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5836	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5852	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5876	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5888	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5908	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5932	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5948	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5964	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5988	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6004	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6020	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6044	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6056	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6076	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6100	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6112	936	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6132	936	schtasks.exe	85

UAC bypass 3 TTPs 45 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/720-3-0x000000001B5A0000-0x000000001B6CE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 33 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
116	powershell.exe
4640	powershell.exe
3924	powershell.exe
4768	powershell.exe
1812	powershell.exe
1352	powershell.exe
3996	powershell.exe
4628	powershell.exe
4304	powershell.exe
4664	powershell.exe
2348	powershell.exe
1712	powershell.exe
4372	powershell.exe
4260	powershell.exe
1388	powershell.exe
3548	powershell.exe
5232	powershell.exe
3344	powershell.exe
2996	powershell.exe
3884	powershell.exe
4752	powershell.exe
2812	powershell.exe
5248	powershell.exe
3484	powershell.exe
1604	powershell.exe
2088	powershell.exe
4580	powershell.exe
4304	powershell.exe
1640	powershell.exe
1204	powershell.exe
2496	powershell.exe
992	powershell.exe
4352	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe

Executes dropped EXE 47 IoCs

pid	Process
748	tmpAEFF.tmp.exe
2200	tmpAEFF.tmp.exe
1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
3064	tmpC227.tmp.exe
2308	tmpC227.tmp.exe
5488	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
5224	tmpE9F2.tmp.exe
4456	tmpE9F2.tmp.exe
4872	OfficeClickToRun.exe
892	tmp9BF.tmp.exe
2240	tmp9BF.tmp.exe
5748	OfficeClickToRun.exe
5360	tmp2B9F.tmp.exe
5552	tmp2B9F.tmp.exe
348	OfficeClickToRun.exe
4300	tmp4C56.tmp.exe
6100	tmp4C56.tmp.exe
5700	OfficeClickToRun.exe
1672	OfficeClickToRun.exe
3660	tmp8ECE.tmp.exe
5124	tmp8ECE.tmp.exe
4696	OfficeClickToRun.exe
2024	tmpC186.tmp.exe
5652	tmpC186.tmp.exe
5900	OfficeClickToRun.exe
3368	tmpF46D.tmp.exe
5552	tmpF46D.tmp.exe
5856	tmpF46D.tmp.exe
6048	OfficeClickToRun.exe
5132	tmp2689.tmp.exe
396	tmp2689.tmp.exe
5184	tmp2689.tmp.exe
1368	OfficeClickToRun.exe
1624	tmp431A.tmp.exe
5720	tmp431A.tmp.exe
1520	tmp431A.tmp.exe
5068	OfficeClickToRun.exe
5168	tmp75C3.tmp.exe
452	tmp75C3.tmp.exe
3480	OfficeClickToRun.exe
4380	tmp934D.tmp.exe
4340	tmp934D.tmp.exe
3124	tmp934D.tmp.exe
4668	OfficeClickToRun.exe
3928	tmpC70F.tmp.exe
668	tmpC70F.tmp.exe
5156	tmpC70F.tmp.exe

Checks whether UAC is enabled 1 TTPs 30 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe

Suspicious use of SetThreadContext 14 IoCs

description	pid	Process	procid_target
PID 748 set thread context of 2200	748	tmpAEFF.tmp.exe	97
PID 3064 set thread context of 2308	3064	tmpC227.tmp.exe	138
PID 5224 set thread context of 4456	5224	tmpE9F2.tmp.exe	225
PID 892 set thread context of 2240	892	tmp9BF.tmp.exe	229
PID 5360 set thread context of 5552	5360	tmp2B9F.tmp.exe	238
PID 4300 set thread context of 6100	4300	tmp4C56.tmp.exe	244
PID 3660 set thread context of 5124	3660	tmp8ECE.tmp.exe	253
PID 2024 set thread context of 5652	2024	tmpC186.tmp.exe	260
PID 5552 set thread context of 5856	5552	tmpF46D.tmp.exe	267
PID 396 set thread context of 5184	396	tmp2689.tmp.exe	277
PID 5720 set thread context of 1520	5720	tmp431A.tmp.exe	284
PID 5168 set thread context of 452	5168	tmp75C3.tmp.exe	293
PID 4340 set thread context of 3124	4340	tmp934D.tmp.exe	300
PID 668 set thread context of 5156	668	tmpC70F.tmp.exe	309

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\RCXACDB.tmp	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\RCXAF00.tmp	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File opened for modification	C:\Program Files\Windows Defender\unsecapp.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\cc11b995f2a76d	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\sppsvc.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File opened for modification	C:\Program Files\Windows Mail\OfficeClickToRun.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Registry.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files\Windows Defender\System.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files\Windows Defender\27d1bcfc3c54e0	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files\Windows Mail\e6c9b481da804f	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files (x86)\Windows Defender\StartMenuExperienceHost.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\csrss.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\38384e6a620884	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files\dotnet\swidtag\69ddcba757bf72	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\SearchApp.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File opened for modification	C:\Program Files\dotnet\swidtag\smss.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files\Windows Defender\29c1c3cc0f7685	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File opened for modification	C:\Program Files\Windows Defender\System.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\StartMenuExperienceHost.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files\Java\jdk-1.8\jre\Registry.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\winlogon.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\winlogon.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files (x86)\Windows Defender\55b276f4edf653	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files\Java\jdk-1.8\jre\ee2ad38f3d4382	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files\Windows Mail\OfficeClickToRun.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\0a1fd5f707cd16	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\sppsvc.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\csrss.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\886983d96e3d3e	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files\Windows Defender\unsecapp.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\SearchApp.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Program Files\dotnet\swidtag\smss.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Media\eddb19405b7ce1	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Windows\en-US\lsass.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Windows\en-US\6203df4a6bafc7	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File opened for modification	C:\Windows\en-US\lsass.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Windows\Media\backgroundTaskHost.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File opened for modification	C:\Windows\Media\backgroundTaskHost.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Windows\Microsoft.NET\authman\SearchApp.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File created	C:\Windows\Microsoft.NET\authman\38384e6a620884	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
File opened for modification	C:\Windows\Microsoft.NET\authman\SearchApp.exe	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp75C3.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp934D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4C56.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC186.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2689.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE9F2.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp431A.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpAEFF.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC70F.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8ECE.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF46D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF46D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2689.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp431A.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC227.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9BF.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2B9F.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp934D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC70F.tmp.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5764	schtasks.exe
5876	schtasks.exe
5908	schtasks.exe
6100	schtasks.exe
2832	schtasks.exe
5664	schtasks.exe
5592	schtasks.exe
5820	schtasks.exe
5932	schtasks.exe
6076	schtasks.exe
3488	schtasks.exe
1008	schtasks.exe
5720	schtasks.exe
5736	schtasks.exe
5796	schtasks.exe
396	schtasks.exe
4628	schtasks.exe
5608	schtasks.exe
5648	schtasks.exe
6020	schtasks.exe
6132	schtasks.exe
4872	schtasks.exe
4880	schtasks.exe
3448	schtasks.exe
1932	schtasks.exe
6044	schtasks.exe
6112	schtasks.exe
3684	schtasks.exe
3488	schtasks.exe
5624	schtasks.exe
5836	schtasks.exe
5948	schtasks.exe
5964	schtasks.exe
5988	schtasks.exe
6056	schtasks.exe
3852	schtasks.exe
3452	schtasks.exe
5888	schtasks.exe
6004	schtasks.exe
5680	schtasks.exe
5780	schtasks.exe
3452	schtasks.exe
1160	schtasks.exe
4400	schtasks.exe
5704	schtasks.exe
5852	schtasks.exe
2768	schtasks.exe
212	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
2348	powershell.exe
2348	powershell.exe
4752	powershell.exe
4752	powershell.exe
3344	powershell.exe
3344	powershell.exe
1712	powershell.exe
1712	powershell.exe
4304	powershell.exe
4304	powershell.exe
1352	powershell.exe
1352	powershell.exe
4260	powershell.exe
4260	powershell.exe
2996	powershell.exe
2996	powershell.exe
3344	powershell.exe
1204	powershell.exe
1204	powershell.exe
1640	powershell.exe
1640	powershell.exe
3884	powershell.exe
3884	powershell.exe
3884	powershell.exe
2348	powershell.exe
1712	powershell.exe
1352	powershell.exe
2996	powershell.exe
4304	powershell.exe
4260	powershell.exe
4752	powershell.exe
1204	powershell.exe
1640	powershell.exe
1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
2812	powershell.exe
2812	powershell.exe
4768	powershell.exe
4768	powershell.exe
1604	powershell.exe
1604	powershell.exe
3484	powershell.exe
3484	powershell.exe
1388	powershell.exe
1388	powershell.exe
2496	powershell.exe
2496	powershell.exe
992	powershell.exe
992	powershell.exe
3548	powershell.exe
3548	powershell.exe
4372	powershell.exe
4372	powershell.exe
1812	powershell.exe
1812	powershell.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	3884	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeDebugPrivilege	3484	powershell.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	992	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	5488	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Token: SeDebugPrivilege	5248	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	3996	powershell.exe
Token: SeDebugPrivilege	4640	powershell.exe
Token: SeDebugPrivilege	116	powershell.exe
Token: SeDebugPrivilege	5232	powershell.exe
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	4872	OfficeClickToRun.exe
Token: SeDebugPrivilege	5748	OfficeClickToRun.exe
Token: SeDebugPrivilege	348	OfficeClickToRun.exe
Token: SeDebugPrivilege	5700	OfficeClickToRun.exe
Token: SeDebugPrivilege	1672	OfficeClickToRun.exe
Token: SeDebugPrivilege	4696	OfficeClickToRun.exe
Token: SeDebugPrivilege	5900	OfficeClickToRun.exe
Token: SeDebugPrivilege	6048	OfficeClickToRun.exe
Token: SeDebugPrivilege	1368	OfficeClickToRun.exe
Token: SeDebugPrivilege	5068	OfficeClickToRun.exe
Token: SeDebugPrivilege	3480	OfficeClickToRun.exe
Token: SeDebugPrivilege	4668	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 748	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	95
PID 720 wrote to memory of 748	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	95
PID 720 wrote to memory of 748	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	95
PID 748 wrote to memory of 2200	748	tmpAEFF.tmp.exe	97
PID 748 wrote to memory of 2200	748	tmpAEFF.tmp.exe	97
PID 748 wrote to memory of 2200	748	tmpAEFF.tmp.exe	97
PID 748 wrote to memory of 2200	748	tmpAEFF.tmp.exe	97
PID 748 wrote to memory of 2200	748	tmpAEFF.tmp.exe	97
PID 748 wrote to memory of 2200	748	tmpAEFF.tmp.exe	97
PID 748 wrote to memory of 2200	748	tmpAEFF.tmp.exe	97
PID 720 wrote to memory of 4752	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	98
PID 720 wrote to memory of 4752	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	98
PID 720 wrote to memory of 3344	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	99
PID 720 wrote to memory of 3344	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	99
PID 720 wrote to memory of 2348	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	100
PID 720 wrote to memory of 2348	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	100
PID 720 wrote to memory of 4304	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	101
PID 720 wrote to memory of 4304	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	101
PID 720 wrote to memory of 2996	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	102
PID 720 wrote to memory of 2996	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	102
PID 720 wrote to memory of 1352	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	103
PID 720 wrote to memory of 1352	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	103
PID 720 wrote to memory of 1640	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	104
PID 720 wrote to memory of 1640	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	104
PID 720 wrote to memory of 3884	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	105
PID 720 wrote to memory of 3884	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	105
PID 720 wrote to memory of 1712	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	106
PID 720 wrote to memory of 1712	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	106
PID 720 wrote to memory of 4260	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	107
PID 720 wrote to memory of 4260	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	107
PID 720 wrote to memory of 1204	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	108
PID 720 wrote to memory of 1204	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	108
PID 720 wrote to memory of 1680	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	120
PID 720 wrote to memory of 1680	720	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	120
PID 1680 wrote to memory of 3064	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	135
PID 1680 wrote to memory of 3064	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	135
PID 1680 wrote to memory of 3064	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	135
PID 3064 wrote to memory of 2308	3064	tmpC227.tmp.exe	138
PID 3064 wrote to memory of 2308	3064	tmpC227.tmp.exe	138
PID 3064 wrote to memory of 2308	3064	tmpC227.tmp.exe	138
PID 3064 wrote to memory of 2308	3064	tmpC227.tmp.exe	138
PID 3064 wrote to memory of 2308	3064	tmpC227.tmp.exe	138
PID 3064 wrote to memory of 2308	3064	tmpC227.tmp.exe	138
PID 3064 wrote to memory of 2308	3064	tmpC227.tmp.exe	138
PID 1680 wrote to memory of 3484	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	139
PID 1680 wrote to memory of 3484	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	139
PID 1680 wrote to memory of 1388	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	140
PID 1680 wrote to memory of 1388	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	140
PID 1680 wrote to memory of 3548	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	141
PID 1680 wrote to memory of 3548	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	141
PID 1680 wrote to memory of 1604	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	142
PID 1680 wrote to memory of 1604	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	142
PID 1680 wrote to memory of 4372	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	143
PID 1680 wrote to memory of 4372	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	143
PID 1680 wrote to memory of 2812	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	144
PID 1680 wrote to memory of 2812	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	144
PID 1680 wrote to memory of 2496	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	145
PID 1680 wrote to memory of 2496	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	145
PID 1680 wrote to memory of 3924	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	146
PID 1680 wrote to memory of 3924	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	146
PID 1680 wrote to memory of 4768	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	147
PID 1680 wrote to memory of 4768	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	147
PID 1680 wrote to memory of 1812	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	148
PID 1680 wrote to memory of 1812	1680	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe	148

System policy modification 1 TTPs 45 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
"C:\Users\Admin\AppData\Local\Temp\6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe"
1⤵
- DcRat
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:720
- C:\Users\Admin\AppData\Local\Temp\tmpAEFF.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpAEFF.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Users\Admin\AppData\Local\Temp\tmpAEFF.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpAEFF.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:2200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Users\Admin\AppData\Local\Temp\6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
  "C:\Users\Admin\AppData\Local\Temp\6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1680
- - C:\Users\Admin\AppData\Local\Temp\tmpC227.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpC227.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\tmpC227.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpC227.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:2308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:992
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MShxucCbpR.bat"
    3⤵
    PID:528
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe
      "C:\Users\Admin\AppData\Local\Temp\6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\tmpE9F2.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE9F2.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\tmpE9F2.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE9F2.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:4456
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5232
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2088
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5248
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4352
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4304
    - - C:\Program Files\Windows Mail\OfficeClickToRun.exe
        
        "C:\Program Files\Windows Mail\OfficeClickToRun.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4872
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c357ddc4-ad78-4387-839f-6a7ccd9051e3.vbs"
        6⤵
        
        PID:4456
        
        C:\Program Files\Windows Mail\OfficeClickToRun.exe
        
        "C:\Program Files\Windows Mail\OfficeClickToRun.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5748
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af81b89a-ce8f-4044-8ac3-2339f2b2ea1f.vbs"
        8⤵
        
        PID:5876
        
        C:\Program Files\Windows Mail\OfficeClickToRun.exe
        
        "C:\Program Files\Windows Mail\OfficeClickToRun.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:348
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0534337c-6a08-4ec5-8961-9383306f5b2b.vbs"
        10⤵
        
        PID:2200
        
        C:\Program Files\Windows Mail\OfficeClickToRun.exe
        
        "C:\Program Files\Windows Mail\OfficeClickToRun.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5700
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7aad5d42-ba25-4924-9a8a-aeff84705dbd.vbs"
        12⤵
        
        PID:2772
        
        C:\Program Files\Windows Mail\OfficeClickToRun.exe
        
        "C:\Program Files\Windows Mail\OfficeClickToRun.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1672
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\440dade3-b427-4997-a725-734e1c99dae9.vbs"
        14⤵
        
        PID:5788
        
        C:\Program Files\Windows Mail\OfficeClickToRun.exe
        
        "C:\Program Files\Windows Mail\OfficeClickToRun.exe"
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\038a229c-4d68-46b0-b1ad-f1fdbc30b335.vbs"
        16⤵
        
        PID:5368
        
        C:\Program Files\Windows Mail\OfficeClickToRun.exe
        
        "C:\Program Files\Windows Mail\OfficeClickToRun.exe"
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5900
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a478d03-8cb2-4481-9f51-7a9f8a9e76de.vbs"
        18⤵
        
        PID:5740
        
        C:\Program Files\Windows Mail\OfficeClickToRun.exe
        
        "C:\Program Files\Windows Mail\OfficeClickToRun.exe"
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:6048
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\702d94bd-946e-4d89-a1dc-981be31ab75a.vbs"
        20⤵
        
        PID:3436
        
        C:\Program Files\Windows Mail\OfficeClickToRun.exe
        
        "C:\Program Files\Windows Mail\OfficeClickToRun.exe"
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1368
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c0c534c-c86d-4007-9b02-5e7e6783198b.vbs"
        22⤵
        
        PID:6128
        
        C:\Program Files\Windows Mail\OfficeClickToRun.exe
        
        "C:\Program Files\Windows Mail\OfficeClickToRun.exe"
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e727a276-8fb2-4c58-8e27-1f39dcd551ab.vbs"
        24⤵
        
        PID:2660
        
        C:\Program Files\Windows Mail\OfficeClickToRun.exe
        
        "C:\Program Files\Windows Mail\OfficeClickToRun.exe"
        25⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3480
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb796352-8f50-4312-9226-a09d0ca2a1b8.vbs"
        26⤵
        
        PID:4908
        
        C:\Program Files\Windows Mail\OfficeClickToRun.exe
        
        "C:\Program Files\Windows Mail\OfficeClickToRun.exe"
        27⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4668
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3ae91187-8444-4413-9ab5-b334018da5fd.vbs"
        28⤵
        
        PID:4344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\213ef6f4-9c9b-489e-b382-8f32935bef91.vbs"
        28⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\tmpC70F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC70F.tmp.exe"
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\tmpC70F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC70F.tmp.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\tmpC70F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC70F.tmp.exe"
        30⤵
        Executes dropped EXE
        
        PID:5156
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e56fc495-ca0a-4230-8c90-dcac2248a314.vbs"
        26⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\tmp934D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp934D.tmp.exe"
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\tmp934D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp934D.tmp.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\tmp934D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp934D.tmp.exe"
        28⤵
        Executes dropped EXE
        
        PID:3124
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c07e5383-98a4-4cee-9fc5-e87321b3a4db.vbs"
        24⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\tmp75C3.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp75C3.tmp.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\tmp75C3.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp75C3.tmp.exe"
        25⤵
        Executes dropped EXE
        
        PID:452
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ff5d15b3-0f74-4959-8a74-27a2eabb9349.vbs"
        22⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\tmp431A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp431A.tmp.exe"
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\tmp431A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp431A.tmp.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\tmp431A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp431A.tmp.exe"
        24⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bbd49d97-111e-4754-889f-01179cf22c1b.vbs"
        20⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\tmp2689.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2689.tmp.exe"
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\tmp2689.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2689.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\tmp2689.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2689.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:5184
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70ba5fcb-3beb-4896-abde-62c189c476e7.vbs"
        18⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\tmpF46D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF46D.tmp.exe"
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\tmpF46D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF46D.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\tmpF46D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF46D.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:5856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d63de79a-3c35-4487-9117-7e17465ef921.vbs"
        16⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\tmpC186.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC186.tmp.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\tmpC186.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC186.tmp.exe"
        17⤵
        Executes dropped EXE
        
        PID:5652
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\21c83abf-595e-4112-b6ad-2c0bbb2de2b9.vbs"
        14⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\tmp8ECE.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8ECE.tmp.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\tmp8ECE.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8ECE.tmp.exe"
        15⤵
        Executes dropped EXE
        
        PID:5124
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\429bca67-83c3-4f92-b8d8-1c03b49fa889.vbs"
        12⤵
        
        PID:2808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a74165dd-0fca-4302-9983-d9226f970d4b.vbs"
        10⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\tmp4C56.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4C56.tmp.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\tmp4C56.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4C56.tmp.exe"
        11⤵
        Executes dropped EXE
        
        PID:6100
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5ccbc38d-29f9-4a8a-9d57-fc46d1a6ee8f.vbs"
        8⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\tmp2B9F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2B9F.tmp.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\tmp2B9F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2B9F.tmp.exe"
        9⤵
        Executes dropped EXE
        
        PID:5552
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df28e1a1-9602-41d6-8c2e-5c9220991063.vbs"
        6⤵
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\tmp9BF.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9BF.tmp.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\tmp9BF.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9BF.tmp.exe"
        7⤵
        Executes dropped EXE
        
        PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\lua\http\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\http\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\VideoLAN\VLC\lua\http\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jdk-1.8\jre\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\jre\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jdk-1.8\jre\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be186" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18" /sc ONLOGON /tr "'C:\Users\All Users\6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be186" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Windows\Media\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\Media\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Windows\Media\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\unsecapp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Defender\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Desktop\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Desktop\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Windows\Microsoft.NET\authman\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\authman\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Windows\Microsoft.NET\authman\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Windows\en-US\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files\dotnet\swidtag\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files\dotnet\swidtag\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\VideoLAN\VLC\lua\http\csrss.exe

Filesize
4.9MB

MD5
9fd149523fb2483c3541e7efc6ac71eb

SHA1
454b165a30c8da28b9f16212addaeb214d8fb77d

SHA256
6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18

SHA512
84f619c3f3d4cdc7fe5ceb12185f39f04ba84ca34b6f8b66cb34f8bfc418542090dec9c4fa8a045c8b45374f4fa36af8150e4fee2d22724392397b53570cee9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\6db47bae41ef69eb40bbb7a664032dd23799c6d8a04327878abf3c0cf264be18.exe.log

Filesize
1KB

MD5
bbb951a34b516b66451218a3ec3b0ae1

SHA1
7393835a2476ae655916e0a9687eeaba3ee876e9

SHA256
eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a

SHA512
63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OfficeClickToRun.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3b444d3f0ddea49d84cc7b3972abe0e6

SHA1
0a896b3808e68d5d72c2655621f43b0b2c65ae02

SHA256
ab075b491d20c6f66c7bd40b57538c1cfdaab5aac4715bfe3bbc7f4745860a74

SHA512
eb0ab5d68472ec42de4c9b6d84306d7bca3874be1d0ac572030a070f21a698432418068e1a6006ff88480be8c8f54c769dee74b2def403f734109dba7261f36b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4c557aa00dc4a6ff86db4be1735e9d30

SHA1
7c155ad08e280926832bdad0aa948843de2ce5a2

SHA256
aad198f453bdcef5e479c7e622c005782f94d0b391798245284aad9506fa7e48

SHA512
2c311b272941308197e3f2fe9d961dda9682dfd514cc48bc63b156afb0d18cace8635f0d080b9f77ed43e67b551232a6fb5b86e88c2414f8bd2f32cbe5521ae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a9451a6b9669d49bd90704dff21beb85

SHA1
5f93d2dec01a31e04fc90c28eb1c5ca62c6fff80

SHA256
b2ff191507379930b97a212f869c3774c20b274e8fc9fcc96da5c154fb0e3056

SHA512
06634cb578f6ce8d721e6306004082073fc224b91ceea37ef870df87b12b2d5f59e7d08b20b520787a1d13f3edbbb004197bf70f180f86dd7f401a5ad289ccb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6019bc03fe1dc3367a67c76d08b55399

SHA1
3d0b6d4d99b6b8e49829a3992072c3d9df7ad672

SHA256
7f88db7b83b11cd8ea233efc3a1498635b68771482658255750df564a065f7d0

SHA512
6b5409780a23e977b0bbe463e351f1d474539100aeaa01b0b7fe72aa6dbfb3c0fec64fe9db65b63d188a279b65eae7f31ef0b6880c67ada9ab175da419f595eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
74e1d5e1542229f7bd83963681b9286a

SHA1
b18ac6cc34b753199d66c14090dfc3b9770627ae

SHA256
3e0fb279acba7f0fc2078695ffdfe1daed5fc420323b1c060892ebbd9c720c36

SHA512
b8c7326beaf5fa9bd605fef93587b89cbe4028223cb55bb416c6bbac1f9a2f2b38248212b5c7974912d7f8c0debf457eb3a56f58642e45edd99501d9a1a415b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b740f7616c3c3d006afd7e1586758eeb

SHA1
c465af4c07ecb9e3de239c410d3b2ed5de93cdde

SHA256
c11b84252afa74e4f323fcbae853cb45217a65d70ac44dea182f9ec872bd9872

SHA512
d4dd7531d48a9f6d6432fe0d55cefc76139566c54514ba722d76e5bd4371bfca0e491939795883de21901eac98b1af7236ea83281a7dde8befe16719993f185e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6115924914d99b02793be952e93f1b2d

SHA1
1d3d4b64d1a9d6b634caf6c7e6acb2151f689f8d

SHA256
471a4b98b4c5ad7326cafe5520c19ec60bb2eb11424d34e3260b2732b4991b86

SHA512
b52003ce863e808fd4cfabc6abdf39d479f174eb04104879f068f8ad1c068f3fc40b94f438bae6376729fedfeefab5322d07d3b2eebd5501cafff18f53de1e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2d6baabb78161c2401e97f08de1b3b4e

SHA1
7bd22cebd5f310d8ac2ef8027caf6a0ec3bf709e

SHA256
1cea816e9897ec6852edb3671e5a93b05ea817bc969c4d47ee70f5573f95df42

SHA512
9f35b70cdb0159002143296f11dd22bec6e28836d36bb2ec0527692935cfc3f43df54871a9397bbdf2aaf6912943968310320433ca51a39e360d7227262c754c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3007e3802489bf130f1133c9b0e99381

SHA1
b7f208ba906b15aff81665e2fa9a19f79aba5739

SHA256
38cdc46f1fd4bc045d3367df0ac4c7387b82694c9956cca951021f00f3954cec

SHA512
0f40c84ac17ca7f5409f09629acb91888290ca0dce2ff50675676287143f8b27f1d50caa56a64db7946e308b4de0b9d0826dda2573c07a02e1fdbfbcccb19713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8d9b95fdab142bb52f794b152e9b8230

SHA1
badb1d4568eb62dca12181d0c7fb093779c9a4de

SHA256
b2b0ff5c6f0f0bbe286910bc2424d7b747fce3b7d7609cc6434aea99372aaa39

SHA512
3f05056bdec2e72f1342f45639c5a89aa175a3a4fdb8494dda31b346faf970b10cc0ab322533514d8f5b591e051a2a35595b0448918e25dbbc6cf02854276b1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c65338524586fc00cf00e679a7d4a1f4

SHA1
62abf26bfb979dcbf7c7649cf8a681c2a8c7c9ae

SHA256
faa246e6b356f55ad8b18cea908dbf9035f67feaa06f8259d934306e13e88bf6

SHA512
c6721362afa4998c60ff60225a7b7571aaf1dbc8cb624ad7557b365a37df26e629763fa052dc31904b3175587e940d7e0630362620870c2c7351960a14c29310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e638941ffaa4cf0fa089f32f52800571

SHA1
5faf0e4b0b46ae35f4e4e6ad9024eab811090f0c

SHA256
4637b0810a15d4a3bde10912c17a0cfe65f930138459aa9b98931302bbd1c5a9

SHA512
f8e38bbcd74a9224abee993006ac89ece59c7367aa69419b2e83c9f1129d95b24164db149777c7e1b476bd1a30bafc2fbb212c6adc1aabb6306dd08a9ec37d19

Download Submit
C:\Users\Admin\AppData\Local\Temp\0534337c-6a08-4ec5-8961-9383306f5b2b.vbs

Filesize
725B

MD5
a4a6516640ee63eb60b3ba8af96bf78c

SHA1
5aaa8bb07f4c61beaf9dc9272d6386fdcc69cd81

SHA256
d9bc1c30f34d8ae005cad8ec3053d635081db7e2b30ca72c261dc02254c34b8e

SHA512
b037370fdfba40f60bb62ca53038d3ad1e8a6c0873dbc0de9354f65e44e393ae455b143a35c6994f01f57fb0bce263ef8e877347b5baa83c5a08fe679f826253

Download Submit
C:\Users\Admin\AppData\Local\Temp\MShxucCbpR.bat

Filesize
267B

MD5
794d585b5bbb63eff31f8ae3fa4661d5

SHA1
1be2b113d52ee06745e16b871439bdf88f260c43

SHA256
29d03da5df1ee57c7ab02eefa85f3e63b79b69dc3e26c68a125413197e1a4f49

SHA512
ee4200fff0ee9891ebbe10b81febe2622c4b643731a3648b8cd7a3a521820bc14a486ac3c18a05dd2063ce4eab321430468c94a7f96049e7b3f3b0f8d859a2ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y2shd5ow.kwa.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\af81b89a-ce8f-4044-8ac3-2339f2b2ea1f.vbs

Filesize
726B

MD5
a873f7805812c31884a9fc089e5d7bdf

SHA1
d40fe7c6caa002fd3f3868585ce32c31ea7fb188

SHA256
a487a6534151e90a4eea4b063730d79dac11476df42990f71f483114b2fcffbc

SHA512
77351ac4930b195d969802899077dc70c975b37aea25c1869e09db8c60b107ce9111a2ed8b0e8bfa174fcbb9b5afff5b87eb8d625c55ae764e4d7b110f8aeecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\c357ddc4-ad78-4387-839f-6a7ccd9051e3.vbs

Filesize
726B

MD5
02ebe98afd587de5f72808f8e9dee7f0

SHA1
656b5373171d7820109c1ce893968c4b7d767eba

SHA256
0903a835206c881abab4e3ee16fcaa87ae863a2aa5aad82d2bbf7c75efb4a866

SHA512
fd58ab403fe719c52655e63e5678a0253d8a18afa6847b28bcf74df8be0cb018f4dca0b5c0edb09a6416b1ddfeb90cbc846712c95037596aca08ccda54a44016

Download Submit
C:\Users\Admin\AppData\Local\Temp\df28e1a1-9602-41d6-8c2e-5c9220991063.vbs

Filesize
502B

MD5
9536ce53a66882d1747bbac5b38996e7

SHA1
5853494e0b9dd87ea8ea01143969eaf9e36dcf91

SHA256
f887e51267a196d9500758f87fa34351d21bbaa9b516d74deb08f01ad3fdebc2

SHA512
9b0649fa1258dc5914420e178a8028fa3fa3fd00878c8e1333e173058fa21717d97c9c26ecf88add2d15bb48c6c6e50c8bd204dfbbb5c852130e69cadf870083

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAEFF.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
memory/720-11-0x000000001B500000-0x000000001B512000-memory.dmp

Filesize
72KB

Download
memory/720-8-0x00000000029F0000-0x0000000002A06000-memory.dmp

Filesize
88KB

Download
memory/720-17-0x000000001B550000-0x000000001B558000-memory.dmp

Filesize
32KB

Download
memory/720-18-0x000000001B560000-0x000000001B56C000-memory.dmp

Filesize
48KB

Download
memory/720-13-0x000000001B510000-0x000000001B51A000-memory.dmp

Filesize
40KB

Download
memory/720-14-0x000000001B520000-0x000000001B52E000-memory.dmp

Filesize
56KB

Download
memory/720-15-0x000000001B530000-0x000000001B53E000-memory.dmp

Filesize
56KB

Download
memory/720-12-0x000000001C250000-0x000000001C778000-memory.dmp

Filesize
5.2MB

Download
memory/720-155-0x00007FF9E86D0000-0x00007FF9E9191000-memory.dmp

Filesize
10.8MB

Download
memory/720-10-0x0000000002A20000-0x0000000002A2A000-memory.dmp

Filesize
40KB

Download
memory/720-9-0x0000000002A10000-0x0000000002A20000-memory.dmp

Filesize
64KB

Download
memory/720-16-0x000000001B540000-0x000000001B548000-memory.dmp

Filesize
32KB

Download
memory/720-6-0x0000000001130000-0x0000000001138000-memory.dmp

Filesize
32KB

Download
memory/720-7-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/720-5-0x000000001BCD0000-0x000000001BD20000-memory.dmp

Filesize
320KB

Download
memory/720-4-0x0000000002860000-0x000000000287C000-memory.dmp

Filesize
112KB

Download
memory/720-2-0x00007FF9E86D0000-0x00007FF9E9191000-memory.dmp

Filesize
10.8MB

Download
memory/720-0-0x00007FF9E86D3000-0x00007FF9E86D5000-memory.dmp

Filesize
8KB

Download
memory/720-1-0x0000000000250000-0x0000000000744000-memory.dmp

Filesize
5.0MB

Download
memory/720-3-0x000000001B5A0000-0x000000001B6CE000-memory.dmp

Filesize
1.2MB

Download
memory/2200-49-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3344-66-0x00000236DFB20000-0x00000236DFB42000-memory.dmp

Filesize
136KB

Download