dcrat | 9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-11-2024 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
Size

4.9MB
MD5

ad5458bcf729c47d91d818cc1465b7cf
SHA1

90ad45413b8da4ce7ecf79cb87f4aa82304f1c1c
SHA256

9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59
SHA512

8a4bcf74c8d05243fc653fba5f2638505cd175f4bcffe1cca6c99142cbb8db44b5c1a91c1e1e37cdc7597fa2bcd24dbf99ffc6103702460688a29bd906327ad2
SSDEEP

49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8r:L

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	264	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	464	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	928	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1264	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	2356	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2356	schtasks.exe

UAC bypass 3 TTPs 33 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

services.exeservices.exeservices.exeservices.exe9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/2668-3-0x000000001B5A0000-0x000000001B6CE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
2216	powershell.exe
2416	powershell.exe
1732	powershell.exe
480	powershell.exe
980	powershell.exe
2816	powershell.exe
2844	powershell.exe
2728	powershell.exe
692	powershell.exe
1804	powershell.exe
676	powershell.exe
984	powershell.exe

Executes dropped EXE 10 IoCs

Processes:

services.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exe

pid	process
2296	services.exe
1072	services.exe
2732	services.exe
1868	services.exe
2940	services.exe
2700	services.exe
2104	services.exe
480	services.exe
2316	services.exe
3028	services.exe

Checks whether UAC is enabled 1 TTPs 22 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

services.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exe9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exeservices.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe

Drops file in Program Files directory 12 IoCs

Processes:

9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe

description	ioc	process
File created	C:\Program Files (x86)\Reference Assemblies\Idle.exe	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\RCXB475.tmp	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\lsass.exe	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\RCXB8E9.tmp	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\smss.exe	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\lsass.exe	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\6203df4a6bafc7	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File created	C:\Program Files (x86)\Reference Assemblies\6ccacd8608530f	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\smss.exe	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\69ddcba757bf72	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Idle.exe	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\RCXC1D3.tmp	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe

Drops file in Windows directory 8 IoCs

Processes:

9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe

description	ioc	process
File opened for modification	C:\Windows\it-IT\RCXC926.tmp	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File opened for modification	C:\Windows\it-IT\dllhost.exe	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File created	C:\Windows\en-US\smss.exe	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File created	C:\Windows\en-US\69ddcba757bf72	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File created	C:\Windows\it-IT\dllhost.exe	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File created	C:\Windows\it-IT\5940a34987c991	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File opened for modification	C:\Windows\en-US\RCXB1F3.tmp	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
File opened for modification	C:\Windows\en-US\smss.exe	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	process
2720	schtasks.exe
2760	schtasks.exe
2640	schtasks.exe
1484	schtasks.exe
1632	schtasks.exe
1200	schtasks.exe
1084	schtasks.exe
2728	schtasks.exe
1264	schtasks.exe
2140	schtasks.exe
836	schtasks.exe
2820	schtasks.exe
2852	schtasks.exe
2940	schtasks.exe
2652	schtasks.exe
568	schtasks.exe
1068	schtasks.exe
2076	schtasks.exe
1652	schtasks.exe
464	schtasks.exe
2096	schtasks.exe
2104	schtasks.exe
1216	schtasks.exe
3044	schtasks.exe
2872	schtasks.exe
1760	schtasks.exe
2576	schtasks.exe
444	schtasks.exe
1924	schtasks.exe
264	schtasks.exe
2888	schtasks.exe
2584	schtasks.exe
2508	schtasks.exe
784	schtasks.exe
2472	schtasks.exe
912	schtasks.exe
928	schtasks.exe
2552	schtasks.exe
1568	schtasks.exe
2960	schtasks.exe
1552	schtasks.exe
1576	schtasks.exe
1408	schtasks.exe
1956	schtasks.exe
2900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exe

pid	process
2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
2844	powershell.exe
676	powershell.exe
1804	powershell.exe
2216	powershell.exe
2728	powershell.exe
692	powershell.exe
980	powershell.exe
2416	powershell.exe
2816	powershell.exe
984	powershell.exe
1732	powershell.exe
480	powershell.exe
2296	services.exe
1072	services.exe
2732	services.exe
1868	services.exe
2940	services.exe
2700	services.exe
2104	services.exe
480	services.exe
2316	services.exe
3028	services.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeDebugPrivilege	676	powershell.exe
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeDebugPrivilege	980	powershell.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	984	powershell.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeDebugPrivilege	480	powershell.exe
Token: SeDebugPrivilege	2296	services.exe
Token: SeDebugPrivilege	1072	services.exe
Token: SeDebugPrivilege	2732	services.exe
Token: SeDebugPrivilege	1868	services.exe
Token: SeDebugPrivilege	2940	services.exe
Token: SeDebugPrivilege	2700	services.exe
Token: SeDebugPrivilege	2104	services.exe
Token: SeDebugPrivilege	480	services.exe
Token: SeDebugPrivilege	2316	services.exe
Token: SeDebugPrivilege	3028	services.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exeservices.exeWScript.exeservices.exeWScript.exeservices.exeWScript.exe

description	pid	process	target process
PID 2668 wrote to memory of 2844	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 2844	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 2844	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 2728	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 2728	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 2728	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 2216	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 2216	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 2216	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 2416	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 2416	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 2416	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 692	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 692	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 692	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 1804	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 1804	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 1804	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 676	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 676	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 676	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 2816	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 2816	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 2816	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 980	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 980	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 980	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 480	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 480	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 480	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 1732	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 1732	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 1732	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 984	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 984	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 984	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	powershell.exe
PID 2668 wrote to memory of 2296	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	services.exe
PID 2668 wrote to memory of 2296	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	services.exe
PID 2668 wrote to memory of 2296	2668	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe	services.exe
PID 2296 wrote to memory of 2696	2296	services.exe	WScript.exe
PID 2296 wrote to memory of 2696	2296	services.exe	WScript.exe
PID 2296 wrote to memory of 2696	2296	services.exe	WScript.exe
PID 2296 wrote to memory of 2616	2296	services.exe	WScript.exe
PID 2296 wrote to memory of 2616	2296	services.exe	WScript.exe
PID 2296 wrote to memory of 2616	2296	services.exe	WScript.exe
PID 2696 wrote to memory of 1072	2696	WScript.exe	services.exe
PID 2696 wrote to memory of 1072	2696	WScript.exe	services.exe
PID 2696 wrote to memory of 1072	2696	WScript.exe	services.exe
PID 1072 wrote to memory of 2072	1072	services.exe	WScript.exe
PID 1072 wrote to memory of 2072	1072	services.exe	WScript.exe
PID 1072 wrote to memory of 2072	1072	services.exe	WScript.exe
PID 1072 wrote to memory of 1780	1072	services.exe	WScript.exe
PID 1072 wrote to memory of 1780	1072	services.exe	WScript.exe
PID 1072 wrote to memory of 1780	1072	services.exe	WScript.exe
PID 2072 wrote to memory of 2732	2072	WScript.exe	services.exe
PID 2072 wrote to memory of 2732	2072	WScript.exe	services.exe
PID 2072 wrote to memory of 2732	2072	WScript.exe	services.exe
PID 2732 wrote to memory of 760	2732	services.exe	WScript.exe
PID 2732 wrote to memory of 760	2732	services.exe	WScript.exe
PID 2732 wrote to memory of 760	2732	services.exe	WScript.exe
PID 2732 wrote to memory of 1200	2732	services.exe	WScript.exe
PID 2732 wrote to memory of 1200	2732	services.exe	WScript.exe
PID 2732 wrote to memory of 1200	2732	services.exe	WScript.exe
PID 760 wrote to memory of 1868	760	WScript.exe	services.exe

System policy modification 1 TTPs 33 IoCs

evasion

Modify Registry

T1112

Processes:

services.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exe9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exeservices.exeservices.exeservices.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe
"C:\Users\Admin\AppData\Local\Temp\9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:984
- C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
  "C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2296
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb3f1d50-d3cc-40cc-a90f-21d8a57a34e3.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
      C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1072
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\306b0a08-2dbe-4f5e-b9c5-c69d44305a30.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2072
      - C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f27de6ce-e390-4709-a02b-aabb570ce81e.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32a5bbc4-8e66-474d-ab33-10dd07035dfe.vbs"
        9⤵
        
        PID:2968
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2940
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4dc4f2cb-6d74-4dd6-9350-f8d1c935cbb4.vbs"
        11⤵
        
        PID:1556
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2700
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4f20617-69a8-4263-a3fc-1ef57e80f6a3.vbs"
        13⤵
        
        PID:1648
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2104
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c78b1c69-f5b6-4f68-877a-86127eb63f24.vbs"
        15⤵
        
        PID:1344
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:480
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c7fd156-3d4c-4313-beb3-40801f3539c7.vbs"
        17⤵
        
        PID:664
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2316
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a1b9e33-a045-45df-8537-234cc16d1d40.vbs"
        19⤵
        
        PID:2688
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3028
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac68b200-7c06-474b-a938-e152946bf7a9.vbs"
        19⤵
        
        PID:2428
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\55b5c1cb-56cf-4529-85ed-5ca2239787cb.vbs"
        17⤵
        
        PID:2960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\041134cb-23b2-488c-9ac7-bae366e8e2aa.vbs"
        15⤵
        
        PID:2988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6377f731-1cb1-4ab3-adae-d166d7282c83.vbs"
        13⤵
        
        PID:592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b2705cc-1788-4ec5-b50e-df3ef60d83e5.vbs"
        11⤵
        
        PID:1264
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4fdc5dac-2d26-4914-9238-00ee746b549e.vbs"
        9⤵
        
        PID:1920
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be59c496-4c02-4877-b603-b6c192b4668a.vbs"
        7⤵
        
        PID:1200
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6d90bd27-ae87-4a2a-8e24-178928ed29b6.vbs"
        5⤵
        
        PID:1780
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd706839-eedf-4b3f-9dc6-4d0e5cc4f961.vbs"
    3⤵
    PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Downloads\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Downloads\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Downloads\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\en-US\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca599" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Start Menu\9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca599" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Start Menu\9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Desktop\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\Desktop\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Desktop\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\it-IT\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\it-IT\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\it-IT\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Music\Sample Music\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Public\Music\Sample Music\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Music\Sample Music\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Reference Assemblies\Idle.exe

Filesize
4.9MB

MD5
ad5458bcf729c47d91d818cc1465b7cf

SHA1
90ad45413b8da4ce7ecf79cb87f4aa82304f1c1c

SHA256
9701ad13cbd42ba610864dead2fab0ff3588e959dc00180e38a41273fce4ca59

SHA512
8a4bcf74c8d05243fc653fba5f2638505cd175f4bcffe1cca6c99142cbb8db44b5c1a91c1e1e37cdc7597fa2bcd24dbf99ffc6103702460688a29bd906327ad2

Download Submit
C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe

Filesize
4.9MB

MD5
7b095e28e22c0c57aa38f166106c8de0

SHA1
d8b4d92abc54f0c1964d7a375aecaa11f4c08c10

SHA256
66b113b8fbcf7063cc5e6b0e95a20e9461c66076883725c96aa0d73bf08141c2

SHA512
d9968fbc7474d577e7d8eb849663a56677b7f724395eaaee2e37d842b76fd8d23f79b3ac2dffc5a02130bd21b14780fa04d3e90121df0bf6d5c89d5b45f7a2a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\306b0a08-2dbe-4f5e-b9c5-c69d44305a30.vbs

Filesize
737B

MD5
873ebd051601970f881cb818848b37bb

SHA1
e24a6b8d19e2dad9d1a3c52ac8ea8ca2bd302bcd

SHA256
9f2a80582e002d869e4c700468b04dccf9c2ca2861900d63baa9dd43124943f7

SHA512
198d2f1cf4f6b732f65bb171eff4dd029af8bf84d3d286dda2f9691bec4b665518eca46c1621f95d6be94888ec9c0f09057437abfd7816da9276594132e09221

Download Submit
C:\Users\Admin\AppData\Local\Temp\32a5bbc4-8e66-474d-ab33-10dd07035dfe.vbs

Filesize
737B

MD5
e602e9667dd69466c091ae125b8a3c0a

SHA1
8e9eecdcb1ab95e6170ddbd1b3b61e7ddd1b30ca

SHA256
b9a67183623b8858095ff9f8b2ac001262b3e3e6e6049525b290e7fc8d282aa6

SHA512
a7ac042df558bfbb4764566e6ad6c7fa44d7ecba5ec6db7dc0bb99e7a73bad39b11b0a9e73d06f295ed861d801849694417f852ed4dd529e6d50eac11aab135c

Download Submit
C:\Users\Admin\AppData\Local\Temp\3a1b9e33-a045-45df-8537-234cc16d1d40.vbs

Filesize
737B

MD5
3735b979f5c9a8387bb0b92539c0e1e7

SHA1
4ea61c0ab4617c21b62eaca7928462579b5f79f4

SHA256
1eae281a2a940b052867b9fdc1b779d04f323309ed6c0f33bc4c86b5efc99515

SHA512
4d257847527b5d1e7f35591134ce7d412c529e0514df3e7e316103ae33ff28213191f6d6b450e4a61f90dabda75f4bc16d6848cd4f22f993e79c0111b68d9a64

Download Submit
C:\Users\Admin\AppData\Local\Temp\4dc4f2cb-6d74-4dd6-9350-f8d1c935cbb4.vbs

Filesize
737B

MD5
0f4a77817fcb3470667b494f143bfb25

SHA1
89a4a39e6b890b3d31ac310582b33528e75bd76e

SHA256
f4fa9cf43581ddf6b5f97f9e2780b9b10ceacc047d4d2aee3fbbc81bab8e5461

SHA512
ce4b10c13d8363f5bfd2da8208695f4d62457c8697fa5edc40746397b0cf4a9ed688fadbe4dce7bf156393a6ba414d0bb5d33e2527567c753d0519e0f9a7dffc

Download Submit
C:\Users\Admin\AppData\Local\Temp\8c7fd156-3d4c-4313-beb3-40801f3539c7.vbs

Filesize
736B

MD5
6bd181132f95cc13b7b247429912c1ef

SHA1
786570fbd40de79d8174eeaa41ed651058b1661d

SHA256
d6adbdf30c7129b17b40492c17d27fd45cddd96956eadfac87acc69c0a5ce1fa

SHA512
c94da677fe9372f6f1713de60a5d3203a5ba375fa4a6cf7a3dbdede5d3a19211cb8d02208d58293c0d64215c74d83efcd33ac2dcf31c19e88987055ea16e1799

Download Submit
C:\Users\Admin\AppData\Local\Temp\c78b1c69-f5b6-4f68-877a-86127eb63f24.vbs

Filesize
737B

MD5
20e3c5d1298cd5dcf42e17177a5f83ba

SHA1
08252e33e8294c0a32e8008ca3bc401ba9f45ea6

SHA256
0abf286c66e02a44b9fd31e4e333e9c1c2adbd12339e519323a8f02028d46f11

SHA512
d8c97c8e152c0ed2c58816d3089a016fff24f92896b100cc8e474ed5660040a4343e92d69925ba698810bcc82cc9bf46e46ce6f21cf880601bdce1e8b4920769

Download Submit
C:\Users\Admin\AppData\Local\Temp\f27de6ce-e390-4709-a02b-aabb570ce81e.vbs

Filesize
737B

MD5
2c47fb2712781cc37c430f50d36231a1

SHA1
df1e918a7d099f380bc00fcff6ddb5f65e61938b

SHA256
63cd2b8e61d91b14e03819e0b241264093d0de57fb1514dba8c65e08b87ba2a4

SHA512
4abee8cbb1bcaf2841655e229b31c1a6d8aad8efc18bd60f47854b102792012701348eefb307f31479db2992f98a7330f6db3944a408a927985cfaa22393b6c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\f4f20617-69a8-4263-a3fc-1ef57e80f6a3.vbs

Filesize
737B

MD5
94d6fadaeb911d58cb29e5153456c130

SHA1
48fe67981603a0cda970c0473c4fca36d44e6c07

SHA256
936a1c09e70c1666acbddc0984d69f0619db4068308228bba24de159a94f4e5a

SHA512
e8ff13078d44864b6cc4de3463967ed5440a24b3b80fe8381815bc31d2ea333cefc9c7c11029558d1996e01126885401f190c1887011e190873272cdc124ffe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\fb3f1d50-d3cc-40cc-a90f-21d8a57a34e3.vbs

Filesize
737B

MD5
33e54a300496bf063b288eaffe7ea0b1

SHA1
3d754fa44bb821a65e4f70912a8c2d2b45e2de6e

SHA256
97bd0972a92f67cabbfe516a3758432be885447849cb3b5bc83b4b5a27f9a92a

SHA512
2daa31b486f4a21d294c679be8196f1ae3351a0324305e0c5962427069b200b774b0721469338d22db6cd0ee98380b3f4fc3e9a5568cde206196e18f3985802b

Download Submit
C:\Users\Admin\AppData\Local\Temp\fd706839-eedf-4b3f-9dc6-4d0e5cc4f961.vbs

Filesize
513B

MD5
6af3b022d3f7a9d35f6fbc29e80be4c5

SHA1
b83b590f431a6e079e4fd7f435f88908d507c515

SHA256
42440c1f93e7277601445d708b179f83fd77664cf41956465bfb103415f0c6c7

SHA512
f42be7bd3a8916e18dc5929883b574446eecef491a3748d70487a571415a1af827356a456b0cffb847ca889b8c69f275983828ecee055d592aae0bcc0bd121a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE254.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0beb52372642d6f85c8f2012e8b622ef

SHA1
a822251cfcb71ea845f21792193c5d57b016409b

SHA256
40b2fe0bf35e73272f350732e6e0bcdb7acd444018ca13da49487877773094fe

SHA512
eabe3b4c181273dc89a8b59eef990e100b43bb7ed4e2a1b32c1900287d89679e8f37ba257863e5b58592af1c653de5879a2b3c9b72e597aa2666157fd1df3bce

Download Submit
C:\Users\Public\Music\Sample Music\services.exe

Filesize
4.9MB

MD5
1c44ff08563e342c7137119ee896f817

SHA1
bc58eeaae4923597e92f3d6e11235c4665864236

SHA256
69b3dea31044074afad229a4e8297268062b8745f5ee267018f8c8cbf151a03c

SHA512
b4da86f59f84e809984416de27b6a934d4eb4535dba6fd7f40aae1f87e8b0a2da4b3c647ca36d56661100147a4aa679e8e1489b08f175c1df4e64e26427b4024

Download Submit
memory/480-322-0x00000000011D0000-0x00000000016C4000-memory.dmp

Filesize
5.0MB

Download
memory/1072-233-0x00000000006E0000-0x00000000006F2000-memory.dmp

Filesize
72KB

Download
memory/1868-263-0x00000000003D0000-0x00000000008C4000-memory.dmp

Filesize
5.0MB

Download
memory/2104-307-0x0000000000180000-0x0000000000674000-memory.dmp

Filesize
5.0MB

Download
memory/2296-217-0x0000000001110000-0x0000000001604000-memory.dmp

Filesize
5.0MB

Download
memory/2296-219-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Filesize
72KB

Download
memory/2316-338-0x0000000000B40000-0x0000000000B52000-memory.dmp

Filesize
72KB

Download
memory/2316-337-0x0000000001340000-0x0000000001834000-memory.dmp

Filesize
5.0MB

Download
memory/2668-16-0x0000000000CA0000-0x0000000000CAC000-memory.dmp

Filesize
48KB

Download
memory/2668-0-0x000007FEF6113000-0x000007FEF6114000-memory.dmp

Filesize
4KB

Download
memory/2668-6-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/2668-218-0x000007FEF6110000-0x000007FEF6AFC000-memory.dmp

Filesize
9.9MB

Download
memory/2668-150-0x000007FEF6110000-0x000007FEF6AFC000-memory.dmp

Filesize
9.9MB

Download
memory/2668-5-0x00000000003D0000-0x00000000003D8000-memory.dmp

Filesize
32KB

Download
memory/2668-136-0x000007FEF6113000-0x000007FEF6114000-memory.dmp

Filesize
4KB

Download
memory/2668-3-0x000000001B5A0000-0x000000001B6CE000-memory.dmp

Filesize
1.2MB

Download
memory/2668-14-0x0000000000C80000-0x0000000000C88000-memory.dmp

Filesize
32KB

Download
memory/2668-1-0x00000000012C0000-0x00000000017B4000-memory.dmp

Filesize
5.0MB

Download
memory/2668-7-0x0000000000500000-0x0000000000516000-memory.dmp

Filesize
88KB

Download
memory/2668-4-0x00000000001B0000-0x00000000001CC000-memory.dmp

Filesize
112KB

Download
memory/2668-15-0x0000000000C90000-0x0000000000C98000-memory.dmp

Filesize
32KB

Download
memory/2668-2-0x000007FEF6110000-0x000007FEF6AFC000-memory.dmp

Filesize
9.9MB

Download
memory/2668-8-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2668-13-0x0000000000C70000-0x0000000000C7E000-memory.dmp

Filesize
56KB

Download
memory/2668-12-0x0000000000BE0000-0x0000000000BEE000-memory.dmp

Filesize
56KB

Download
memory/2668-11-0x0000000000BD0000-0x0000000000BDA000-memory.dmp

Filesize
40KB

Download
memory/2668-10-0x0000000000B40000-0x0000000000B52000-memory.dmp

Filesize
72KB

Download
memory/2668-9-0x0000000000B30000-0x0000000000B3A000-memory.dmp

Filesize
40KB

Download
memory/2732-248-0x0000000001380000-0x0000000001874000-memory.dmp

Filesize
5.0MB

Download
memory/2844-163-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/2844-162-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2940-278-0x0000000000920000-0x0000000000E14000-memory.dmp

Filesize
5.0MB

Download
memory/3028-353-0x0000000000660000-0x0000000000672000-memory.dmp

Filesize
72KB

Download