dcrat | e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-11-2024 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
Size

1.8MB
MD5

a2e72e24af123d7c43c0b2a998f829f0
SHA1

31d2f614def3942ca91743f6006ff1dc90f1ce94
SHA256

e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80
SHA512

1a3df078ec2c913ea60b091ef2e7e46cd30c742d0a4325d11412d58b432474a1d7f2cd86e549ee6dc27a1f776c2eed88092874205ac98d463765bd13db867d9b
SSDEEP

49152:OhjAJVllHZrhbBruPk+xjSMX4ODTDF8OcFSkMh:OgVTVXYNX9mOWSkM

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2872	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2872	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2872	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	2872	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	2872	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2872	schtasks.exe	30

UAC bypass 3 TTPs 21 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

OSPPSVC.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exee4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exeOSPPSVC.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/2248-1-0x0000000000CC0000-0x0000000000E8E000-memory.dmp	dcrat
behavioral1/files/0x0003000000011c28-26.dat	dcrat
behavioral1/memory/1252-59-0x0000000000130000-0x00000000002FE000-memory.dmp	dcrat
behavioral1/memory/1968-72-0x0000000000B50000-0x0000000000D1E000-memory.dmp	dcrat
behavioral1/memory/1908-85-0x0000000000290000-0x000000000045E000-memory.dmp	dcrat
behavioral1/memory/2096-98-0x0000000000940000-0x0000000000B0E000-memory.dmp	dcrat
behavioral1/memory/1548-111-0x00000000011E0000-0x00000000013AE000-memory.dmp	dcrat
behavioral1/memory/1468-124-0x0000000000080000-0x000000000024E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid	Process
2892	powershell.exe
2904	powershell.exe
2996	powershell.exe

Executes dropped EXE 6 IoCs

Processes:

OSPPSVC.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exe

pid	Process
1252	OSPPSVC.exe
1968	OSPPSVC.exe
1908	OSPPSVC.exe
2096	OSPPSVC.exe
1548	OSPPSVC.exe
1468	OSPPSVC.exe

Checks whether UAC is enabled 1 TTPs 14 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe

Drops file in Program Files directory 4 IoCs

Processes:

e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\System.exe	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
File opened for modification	C:\Program Files (x86)\MSBuild\System.exe	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
File created	C:\Program Files (x86)\MSBuild\27d1bcfc3c54e0	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
File opened for modification	C:\Program Files (x86)\MSBuild\RCX1A7.tmp	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe

Drops file in Windows directory 4 IoCs

Processes:

e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe

description	ioc	Process
File opened for modification	C:\Windows\system\OSPPSVC.exe	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
File created	C:\Windows\system\OSPPSVC.exe	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
File created	C:\Windows\system\1610b97d3ab4a7	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
File opened for modification	C:\Windows\system\RCX3CA.tmp	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
2716	schtasks.exe
2592	schtasks.exe
2556	schtasks.exe
780	schtasks.exe
2588	schtasks.exe
3016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exepowershell.exepowershell.exepowershell.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exe

pid	Process
2248	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
2892	powershell.exe
2996	powershell.exe
2904	powershell.exe
1252	OSPPSVC.exe
1968	OSPPSVC.exe
1908	OSPPSVC.exe
2096	OSPPSVC.exe
1548	OSPPSVC.exe
1468	OSPPSVC.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exepowershell.exepowershell.exepowershell.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exe

description	pid	Process
Token: SeDebugPrivilege	2248	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	1252	OSPPSVC.exe
Token: SeDebugPrivilege	1968	OSPPSVC.exe
Token: SeDebugPrivilege	1908	OSPPSVC.exe
Token: SeDebugPrivilege	2096	OSPPSVC.exe
Token: SeDebugPrivilege	1548	OSPPSVC.exe
Token: SeDebugPrivilege	1468	OSPPSVC.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exeOSPPSVC.exeWScript.exeOSPPSVC.exeWScript.exeOSPPSVC.exeWScript.exeOSPPSVC.exeWScript.exeOSPPSVC.exeWScript.exeOSPPSVC.exe

description	pid	Process	procid_target
PID 2248 wrote to memory of 2892	2248	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe	37
PID 2248 wrote to memory of 2892	2248	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe	37
PID 2248 wrote to memory of 2892	2248	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe	37
PID 2248 wrote to memory of 2904	2248	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe	38
PID 2248 wrote to memory of 2904	2248	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe	38
PID 2248 wrote to memory of 2904	2248	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe	38
PID 2248 wrote to memory of 2996	2248	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe	39
PID 2248 wrote to memory of 2996	2248	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe	39
PID 2248 wrote to memory of 2996	2248	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe	39
PID 2248 wrote to memory of 1252	2248	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe	43
PID 2248 wrote to memory of 1252	2248	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe	43
PID 2248 wrote to memory of 1252	2248	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe	43
PID 1252 wrote to memory of 2240	1252	OSPPSVC.exe	44
PID 1252 wrote to memory of 2240	1252	OSPPSVC.exe	44
PID 1252 wrote to memory of 2240	1252	OSPPSVC.exe	44
PID 1252 wrote to memory of 2352	1252	OSPPSVC.exe	45
PID 1252 wrote to memory of 2352	1252	OSPPSVC.exe	45
PID 1252 wrote to memory of 2352	1252	OSPPSVC.exe	45
PID 2240 wrote to memory of 1968	2240	WScript.exe	46
PID 2240 wrote to memory of 1968	2240	WScript.exe	46
PID 2240 wrote to memory of 1968	2240	WScript.exe	46
PID 1968 wrote to memory of 1636	1968	OSPPSVC.exe	47
PID 1968 wrote to memory of 1636	1968	OSPPSVC.exe	47
PID 1968 wrote to memory of 1636	1968	OSPPSVC.exe	47
PID 1968 wrote to memory of 1992	1968	OSPPSVC.exe	48
PID 1968 wrote to memory of 1992	1968	OSPPSVC.exe	48
PID 1968 wrote to memory of 1992	1968	OSPPSVC.exe	48
PID 1636 wrote to memory of 1908	1636	WScript.exe	49
PID 1636 wrote to memory of 1908	1636	WScript.exe	49
PID 1636 wrote to memory of 1908	1636	WScript.exe	49
PID 1908 wrote to memory of 2684	1908	OSPPSVC.exe	50
PID 1908 wrote to memory of 2684	1908	OSPPSVC.exe	50
PID 1908 wrote to memory of 2684	1908	OSPPSVC.exe	50
PID 1908 wrote to memory of 2860	1908	OSPPSVC.exe	51
PID 1908 wrote to memory of 2860	1908	OSPPSVC.exe	51
PID 1908 wrote to memory of 2860	1908	OSPPSVC.exe	51
PID 2684 wrote to memory of 2096	2684	WScript.exe	52
PID 2684 wrote to memory of 2096	2684	WScript.exe	52
PID 2684 wrote to memory of 2096	2684	WScript.exe	52
PID 2096 wrote to memory of 2756	2096	OSPPSVC.exe	53
PID 2096 wrote to memory of 2756	2096	OSPPSVC.exe	53
PID 2096 wrote to memory of 2756	2096	OSPPSVC.exe	53
PID 2096 wrote to memory of 536	2096	OSPPSVC.exe	54
PID 2096 wrote to memory of 536	2096	OSPPSVC.exe	54
PID 2096 wrote to memory of 536	2096	OSPPSVC.exe	54
PID 2756 wrote to memory of 1548	2756	WScript.exe	55
PID 2756 wrote to memory of 1548	2756	WScript.exe	55
PID 2756 wrote to memory of 1548	2756	WScript.exe	55
PID 1548 wrote to memory of 2192	1548	OSPPSVC.exe	56
PID 1548 wrote to memory of 2192	1548	OSPPSVC.exe	56
PID 1548 wrote to memory of 2192	1548	OSPPSVC.exe	56
PID 1548 wrote to memory of 2436	1548	OSPPSVC.exe	57
PID 1548 wrote to memory of 2436	1548	OSPPSVC.exe	57
PID 1548 wrote to memory of 2436	1548	OSPPSVC.exe	57
PID 2192 wrote to memory of 1468	2192	WScript.exe	59
PID 2192 wrote to memory of 1468	2192	WScript.exe	59
PID 2192 wrote to memory of 1468	2192	WScript.exe	59
PID 1468 wrote to memory of 888	1468	OSPPSVC.exe	60
PID 1468 wrote to memory of 888	1468	OSPPSVC.exe	60
PID 1468 wrote to memory of 888	1468	OSPPSVC.exe	60
PID 1468 wrote to memory of 2748	1468	OSPPSVC.exe	61
PID 1468 wrote to memory of 2748	1468	OSPPSVC.exe	61
PID 1468 wrote to memory of 2748	1468	OSPPSVC.exe	61

System policy modification 1 TTPs 21 IoCs

evasion

Modify Registry

T1112

Processes:

e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exeOSPPSVC.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe
"C:\Users\Admin\AppData\Local\Temp\e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80N.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\system\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- C:\Windows\system\OSPPSVC.exe
  "C:\Windows\system\OSPPSVC.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1252
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e30788f0-b2cc-4472-a4e4-4537c9407837.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Windows\system\OSPPSVC.exe
      C:\Windows\system\OSPPSVC.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1968
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a8418fe1-ff6d-491c-bb3c-414edce14406.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1636
      - C:\Windows\system\OSPPSVC.exe
        
        C:\Windows\system\OSPPSVC.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1908
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9c80d69-27f7-411c-9afd-37fa4f03675a.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\system\OSPPSVC.exe
        
        C:\Windows\system\OSPPSVC.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2096
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\780aaead-354b-4847-a6ef-d75fe857503b.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\system\OSPPSVC.exe
        
        C:\Windows\system\OSPPSVC.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0328c20c-ce8a-4426-ae94-7bf22cd6fbb2.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\system\OSPPSVC.exe
        
        C:\Windows\system\OSPPSVC.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1468
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0ef9cda0-5905-4948-a8a0-22cf2a9615d4.vbs"
        13⤵
        
        PID:888
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\369b4521-c8bb-45b5-bf80-c4f504a264ae.vbs"
        13⤵
        
        PID:2748
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d66f3b9c-b4d9-4e6f-80cd-d08061cacade.vbs"
        11⤵
        
        PID:2436
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b777ef52-9bdd-43e6-bfba-b60fcf1b4911.vbs"
        9⤵
        
        PID:536
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e1e154f3-c734-42cc-a087-5786f4eea890.vbs"
        7⤵
        
        PID:2860
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44390f1f-1170-42ea-95b4-58dfb6005892.vbs"
        5⤵
        
        PID:1992
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df621851-0ee6-40aa-a559-eed929479ae1.vbs"
    3⤵
    PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Windows\system\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\system\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Windows\system\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\MSBuild\System.exe

Filesize
1.8MB

MD5
a2e72e24af123d7c43c0b2a998f829f0

SHA1
31d2f614def3942ca91743f6006ff1dc90f1ce94

SHA256
e4fbbe932e19ec5e676668a71c8376ee9ae4da4284f42969ff04bc6ff97bdd80

SHA512
1a3df078ec2c913ea60b091ef2e7e46cd30c742d0a4325d11412d58b432474a1d7f2cd86e549ee6dc27a1f776c2eed88092874205ac98d463765bd13db867d9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\0328c20c-ce8a-4426-ae94-7bf22cd6fbb2.vbs

Filesize
705B

MD5
5217cb9d2ba261f5e8aba665d854aa05

SHA1
f556117fc7e0900b08592e827d6fe50be7bfcf51

SHA256
980e100a4d32cc6a6cbab9e42cd23c15add7af8bfae53b72253b619ecd976670

SHA512
2090ee10863647cc01074a67b20026ca98829c05cf21db6ec5a30c1ea4833705b86a968c4a1744ed7e3519013c77cb1bb11dbc78fb5eddc4f8d270a77a0a8974

Download Submit
C:\Users\Admin\AppData\Local\Temp\0ef9cda0-5905-4948-a8a0-22cf2a9615d4.vbs

Filesize
705B

MD5
edabf6d68db799ff96769766f438da6f

SHA1
e163def3cbb8646b58c2b40ca23d0d3b267aef75

SHA256
3ff219ee72f4700152f3bfa8ed503e62ab748fd2291e8ad5bd9c55315e831748

SHA512
94273f1d7639dcdf24e221af210709bc52c52ee709d23d2b9df791a09f3da858cb71b4b156e3615ba4ec7d7a120dd944424b2062792cd57496ed8872f1975d18

Download Submit
C:\Users\Admin\AppData\Local\Temp\780aaead-354b-4847-a6ef-d75fe857503b.vbs

Filesize
705B

MD5
1443fa4981fbfb80e12510053e5ed224

SHA1
aaf78ffb283ca9415d791322d6d491d99273eeb1

SHA256
42d5e391ebce495d049cb2cdcb4e232dde19d15cf5fd866bb87c1c127cf6fe71

SHA512
19cd7178a5ab1130aa7e229ee27571db8a13a408b36172a6ee2031c1bf202e23ae97f87a0a547884a08378411d5b726f70d1f7f3888a96a33ef24d63e163425f

Download Submit
C:\Users\Admin\AppData\Local\Temp\a8418fe1-ff6d-491c-bb3c-414edce14406.vbs

Filesize
705B

MD5
023581ff153f5d5991c1c32fa15e1223

SHA1
9eab52a3ddbc9e6ae4866e24db264d558795d58e

SHA256
0e800ac7a0c1e2c9b63009677e7c54f78a8fd138e6cb2ed83a6142421c4ecb68

SHA512
00b0e3dbbd7ed198a4203b93995a307840f653bbba40fef87e52d4cce2132716ef253d782e11b25b3ce14d5268d0648a64a86d54d5efcd5877d1078066ed60e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9c80d69-27f7-411c-9afd-37fa4f03675a.vbs

Filesize
705B

MD5
65e5d2cede433690cdba1b160e6e59bc

SHA1
7dafc26e2e25adbb6ce83bc1b3ca9a30693c5ab4

SHA256
ba57762f902e8c31abc8be95285b4a91ad5c5db21a3f7fa82028390d535a881e

SHA512
cfb02ab47990b23f2083d0e4bcd9d0d6626e5f5df2cd196aa3c4f895d34b7f08325a73e28c7ad12e56e77fcaed2a19a64c043e82060b4fb921b9d3c320bad4f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\df621851-0ee6-40aa-a559-eed929479ae1.vbs

Filesize
481B

MD5
9cdac72997b7229aac6711f7369a5d23

SHA1
90217897d7dbd23d5781581737810bfd8e44565c

SHA256
4c944bdf6942f6b618fdbb3c5755a480ac436caefaeeb4800df1f180008433a1

SHA512
36c618c97d2527f5a8b6e83651e27ad8c2bb251cc6d6895ad2d55bd2891fcb59bae862347809caed739a3c79666fc11db0bd1a8a29f1813edfe456cbc30073b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\e30788f0-b2cc-4472-a4e4-4537c9407837.vbs

Filesize
705B

MD5
93aed571667f8821cfee49311fdc77f3

SHA1
9b1c66d259c42120e4bf01343ac8b4865a5b709a

SHA256
876682138d4438ed10b8089ffa69b4b5e51aa821f9dc706c8f58466cb577178d

SHA512
f73457405b73a619187100553ec3f582593825d9f94681f2a0876e1ff8aca2318d178547b80b00a696877ef20b651ab7d02c262047fe867ec6bb8fc4f06aaa99

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f40dfb4fc295c8b6c8ab39bd2d68a397

SHA1
d1492d9e588050032d9721e50b6ff6abc3ef71a3

SHA256
f9da4fc77a4215929ab44b68169655ff96a828b561a98fe3eaf2efc531a27b10

SHA512
c4a658d61c16be2cb897f6ce6df8d57e0c7a01c2b969c42596d7e1053b27ac217e44d9eac67f8278a802983bdd3c4da2fbef65d49adb039493e20b10b07d87ef

Download Submit
memory/1252-59-0x0000000000130000-0x00000000002FE000-memory.dmp

Filesize
1.8MB

Download
memory/1252-60-0x0000000000740000-0x0000000000752000-memory.dmp

Filesize
72KB

Download
memory/1468-126-0x00000000007A0000-0x00000000007B2000-memory.dmp

Filesize
72KB

Download
memory/1468-125-0x0000000000520000-0x0000000000532000-memory.dmp

Filesize
72KB

Download
memory/1468-124-0x0000000000080000-0x000000000024E000-memory.dmp

Filesize
1.8MB

Download
memory/1548-112-0x0000000000C10000-0x0000000000C22000-memory.dmp

Filesize
72KB

Download
memory/1548-111-0x00000000011E0000-0x00000000013AE000-memory.dmp

Filesize
1.8MB

Download
memory/1908-86-0x0000000000280000-0x0000000000292000-memory.dmp

Filesize
72KB

Download
memory/1908-85-0x0000000000290000-0x000000000045E000-memory.dmp

Filesize
1.8MB

Download
memory/1968-72-0x0000000000B50000-0x0000000000D1E000-memory.dmp

Filesize
1.8MB

Download
memory/1968-73-0x0000000000190000-0x00000000001A2000-memory.dmp

Filesize
72KB

Download
memory/2096-99-0x0000000000460000-0x0000000000472000-memory.dmp

Filesize
72KB

Download
memory/2096-98-0x0000000000940000-0x0000000000B0E000-memory.dmp

Filesize
1.8MB

Download
memory/2248-6-0x00000000001A0000-0x00000000001B6000-memory.dmp

Filesize
88KB

Download
memory/2248-14-0x0000000000C70000-0x0000000000C7C000-memory.dmp

Filesize
48KB

Download
memory/2248-10-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/2248-61-0x000007FEF6450000-0x000007FEF6E3C000-memory.dmp

Filesize
9.9MB

Download
memory/2248-0-0x000007FEF6453000-0x000007FEF6454000-memory.dmp

Filesize
4KB

Download
memory/2248-4-0x0000000000150000-0x0000000000158000-memory.dmp

Filesize
32KB

Download
memory/2248-8-0x0000000000570000-0x0000000000580000-memory.dmp

Filesize
64KB

Download
memory/2248-1-0x0000000000CC0000-0x0000000000E8E000-memory.dmp

Filesize
1.8MB

Download
memory/2248-5-0x0000000000190000-0x00000000001A0000-memory.dmp

Filesize
64KB

Download
memory/2248-11-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download
memory/2248-9-0x0000000000580000-0x000000000058A000-memory.dmp

Filesize
40KB

Download
memory/2248-3-0x0000000000170000-0x000000000018C000-memory.dmp

Filesize
112KB

Download
memory/2248-15-0x0000000000C80000-0x0000000000C8C000-memory.dmp

Filesize
48KB

Download
memory/2248-7-0x00000000001C0000-0x00000000001D2000-memory.dmp

Filesize
72KB

Download
memory/2248-2-0x000007FEF6450000-0x000007FEF6E3C000-memory.dmp

Filesize
9.9MB

Download
memory/2248-13-0x0000000000C60000-0x0000000000C6E000-memory.dmp

Filesize
56KB

Download
memory/2248-12-0x0000000000AC0000-0x0000000000ACE000-memory.dmp

Filesize
56KB

Download
memory/2892-47-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/2892-46-0x000000001B800000-0x000000001BAE2000-memory.dmp

Filesize
2.9MB

Download