dcrat | df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c

Analysis

max time kernel
119s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-11-2024 08:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Size

4.9MB
MD5

90439e356e90dd66d5f3267f8459e4c3
SHA1

0f499014dd8f2374db0c12773bce0348e780179e
SHA256

df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c
SHA512

d7cd59b6e2e3419dd8fef6462c669c011404de19e9be70b82ed1f98cfc6b4fa3a228659dcaf439b06b4961cb3abb98f6aa33b847aa0f425ae4a80fa43135b9f1
SSDEEP

49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8g:A

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\a4f9a0415b575d		df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
		2332	schtasks.exe
		1356	schtasks.exe
		1812	schtasks.exe
		2684	schtasks.exe
		2284	schtasks.exe
		2256	schtasks.exe
File created	C:\Windows\Offline Web Pages\56085415360792		df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
		2880	schtasks.exe
		1648	schtasks.exe
		2032	schtasks.exe
		2892	schtasks.exe
		3052	schtasks.exe
		2320	schtasks.exe
		2080	schtasks.exe
		1532	schtasks.exe
		2320	schtasks.exe
		2580	schtasks.exe
		2724	schtasks.exe
		2752	schtasks.exe
		3008	schtasks.exe
		2632	schtasks.exe
		2356	schtasks.exe
		2612	schtasks.exe
		2212	schtasks.exe
		2636	schtasks.exe
		2336	schtasks.exe
		2556	schtasks.exe
		2460	schtasks.exe
		2904	schtasks.exe
		2324	schtasks.exe
		1088	schtasks.exe
		2724	schtasks.exe
		2756	schtasks.exe
		2896	schtasks.exe
		1012	schtasks.exe
		1956	schtasks.exe
		3004	schtasks.exe
		2972	schtasks.exe
File created	C:\Windows\TAPI\0a1fd5f707cd16		df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
		1320	schtasks.exe
		2996	schtasks.exe
		1656	schtasks.exe
		880	schtasks.exe
		1752	schtasks.exe
		304	schtasks.exe
		1476	schtasks.exe
		1864	schtasks.exe
		2364	schtasks.exe
		2812	schtasks.exe
		316	schtasks.exe
		2844	schtasks.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\b75386f1303e64		df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
		2776	schtasks.exe
		1768	schtasks.exe
		2712	schtasks.exe
		548	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
		2164	schtasks.exe
		584	schtasks.exe
File created	C:\Program Files (x86)\Windows Mail\5940a34987c991		df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
		1968	schtasks.exe
		2640	schtasks.exe
		876	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	304	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	896	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	564	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	616	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	616	schtasks.exe	30

UAC bypass 3 TTPs 30 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1724-3-0x000000001B550000-0x000000001B67E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
884	powershell.exe
3032	powershell.exe
1780	powershell.exe
2696	powershell.exe
1608	powershell.exe
1336	powershell.exe
1868	powershell.exe
772	powershell.exe
2144	powershell.exe
1760	powershell.exe
1000	powershell.exe
1664	powershell.exe
2208	powershell.exe
328	powershell.exe
1812	powershell.exe
2408	powershell.exe
2304	powershell.exe
2568	powershell.exe
2256	powershell.exe
2952	powershell.exe
2932	powershell.exe
548	powershell.exe
988	powershell.exe
1696	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
2008	csrss.exe
1540	csrss.exe
1236	csrss.exe
2840	csrss.exe
848	csrss.exe
1816	csrss.exe
2340	csrss.exe
2460	csrss.exe

Checks whether UAC is enabled 1 TTPs 20 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\5940a34987c991	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\a4f9a0415b575d	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Network Sharing\explorer.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\dllhost.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\taskhost.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\dllhost.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files\Windows NT\7a0fd90576e088	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files (x86)\Windows Media Player\Network Sharing\explorer.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files\Windows Mail\en-US\RCXC43B.tmp	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXCC4B.tmp	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\dllhost.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files\Windows Mail\en-US\0a1fd5f707cd16	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files (x86)\Windows Media Player\Network Sharing\7a0fd90576e088	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\sppsvc.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files\Windows NT\explorer.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files\Windows NT\explorer.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files\Windows Mail\en-US\sppsvc.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\RCXD2C4.tmp	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\b75386f1303e64	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\5940a34987c991	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\RCXD053.tmp	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\sppsvc.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\b75386f1303e64	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\0a1fd5f707cd16	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files (x86)\Windows Mail\dllhost.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files\Windows Mail\en-US\sppsvc.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Network Sharing\RCXC844.tmp	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\taskhost.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Offline Web Pages\wininit.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Windows\Cursors\smss.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Windows\Cursors\69ddcba757bf72	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Windows\DigitalLocker\es-ES\69ddcba757bf72	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Windows\Cursors\smss.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Windows\RemotePackages\RemoteDesktops\lsass.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Windows\Offline Web Pages\RCXD4C8.tmp	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Windows\Offline Web Pages\56085415360792	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Windows\TAPI\RCXCA47.tmp	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Windows\TAPI\sppsvc.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Windows\TAPI\sppsvc.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Windows\rescache\rc0006\Idle.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Windows\RemotePackages\RemoteDesktops\lsass.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Windows\RemotePackages\RemoteDesktops\6203df4a6bafc7	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Windows\TAPI\0a1fd5f707cd16	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Windows\DigitalLocker\es-ES\smss.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Windows\DigitalLocker\es-ES\smss.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Windows\Offline Web Pages\wininit.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2880	schtasks.exe
2164	schtasks.exe
2356	schtasks.exe
2460	schtasks.exe
2812	schtasks.exe
2688	schtasks.exe
2844	schtasks.exe
1812	schtasks.exe
2968	schtasks.exe
1864	schtasks.exe
1600	schtasks.exe
2352	schtasks.exe
1584	schtasks.exe
316	schtasks.exe
1088	schtasks.exe
2752	schtasks.exe
2872	schtasks.exe
1864	schtasks.exe
1648	schtasks.exe
2408	schtasks.exe
2892	schtasks.exe
2500	schtasks.exe
3004	schtasks.exe
2320	schtasks.exe
1356	schtasks.exe
2212	schtasks.exe
548	schtasks.exe
2580	schtasks.exe
1532	schtasks.exe
2776	schtasks.exe
1792	schtasks.exe
1744	schtasks.exe
1940	schtasks.exe
564	schtasks.exe
2712	schtasks.exe
2684	schtasks.exe
2320	schtasks.exe
2904	schtasks.exe
2972	schtasks.exe
2996	schtasks.exe
1768	schtasks.exe
2032	schtasks.exe
3052	schtasks.exe
2672	schtasks.exe
2976	schtasks.exe
2604	schtasks.exe
2904	schtasks.exe
2284	schtasks.exe
2556	schtasks.exe
2896	schtasks.exe
2632	schtasks.exe
2332	schtasks.exe
2324	schtasks.exe
2168	schtasks.exe
2336	schtasks.exe
2364	schtasks.exe
2816	schtasks.exe
1476	schtasks.exe
1268	schtasks.exe
1656	schtasks.exe
1752	schtasks.exe
1320	schtasks.exe
2068	schtasks.exe
876	schtasks.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
548	powershell.exe
988	powershell.exe
772	powershell.exe
2256	powershell.exe
328	powershell.exe
1760	powershell.exe
884	powershell.exe
2208	powershell.exe
1336	powershell.exe
1696	powershell.exe
1664	powershell.exe
1868	powershell.exe
1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
2304	powershell.exe
2932	powershell.exe
1780	powershell.exe
2568	powershell.exe
2696	powershell.exe
1000	powershell.exe
1608	powershell.exe
2952	powershell.exe
2144	powershell.exe
3032	powershell.exe
1812	powershell.exe
2408	powershell.exe
2008	csrss.exe
1540	csrss.exe
1236	csrss.exe
2840	csrss.exe
848	csrss.exe
1816	csrss.exe
2340	csrss.exe
2460	csrss.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeDebugPrivilege	988	powershell.exe
Token: SeDebugPrivilege	772	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	328	powershell.exe
Token: SeDebugPrivilege	1760	powershell.exe
Token: SeDebugPrivilege	884	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeDebugPrivilege	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeDebugPrivilege	2008	csrss.exe
Token: SeDebugPrivilege	1540	csrss.exe
Token: SeDebugPrivilege	1236	csrss.exe
Token: SeDebugPrivilege	2840	csrss.exe
Token: SeDebugPrivilege	848	csrss.exe
Token: SeDebugPrivilege	1816	csrss.exe
Token: SeDebugPrivilege	2340	csrss.exe
Token: SeDebugPrivilege	2460	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1664	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	65
PID 1724 wrote to memory of 1664	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	65
PID 1724 wrote to memory of 1664	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	65
PID 1724 wrote to memory of 548	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	66
PID 1724 wrote to memory of 548	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	66
PID 1724 wrote to memory of 548	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	66
PID 1724 wrote to memory of 2208	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	67
PID 1724 wrote to memory of 2208	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	67
PID 1724 wrote to memory of 2208	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	67
PID 1724 wrote to memory of 988	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	68
PID 1724 wrote to memory of 988	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	68
PID 1724 wrote to memory of 988	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	68
PID 1724 wrote to memory of 1336	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	69
PID 1724 wrote to memory of 1336	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	69
PID 1724 wrote to memory of 1336	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	69
PID 1724 wrote to memory of 1868	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	70
PID 1724 wrote to memory of 1868	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	70
PID 1724 wrote to memory of 1868	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	70
PID 1724 wrote to memory of 1696	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	71
PID 1724 wrote to memory of 1696	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	71
PID 1724 wrote to memory of 1696	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	71
PID 1724 wrote to memory of 2256	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	72
PID 1724 wrote to memory of 2256	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	72
PID 1724 wrote to memory of 2256	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	72
PID 1724 wrote to memory of 328	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	73
PID 1724 wrote to memory of 328	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	73
PID 1724 wrote to memory of 328	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	73
PID 1724 wrote to memory of 772	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	74
PID 1724 wrote to memory of 772	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	74
PID 1724 wrote to memory of 772	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	74
PID 1724 wrote to memory of 1760	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	75
PID 1724 wrote to memory of 1760	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	75
PID 1724 wrote to memory of 1760	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	75
PID 1724 wrote to memory of 884	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	76
PID 1724 wrote to memory of 884	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	76
PID 1724 wrote to memory of 884	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	76
PID 1724 wrote to memory of 2748	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	89
PID 1724 wrote to memory of 2748	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	89
PID 1724 wrote to memory of 2748	1724	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	89
PID 2748 wrote to memory of 3020	2748	cmd.exe	91
PID 2748 wrote to memory of 3020	2748	cmd.exe	91
PID 2748 wrote to memory of 3020	2748	cmd.exe	91
PID 2748 wrote to memory of 1872	2748	cmd.exe	92
PID 2748 wrote to memory of 1872	2748	cmd.exe	92
PID 2748 wrote to memory of 1872	2748	cmd.exe	92
PID 1872 wrote to memory of 3032	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	148
PID 1872 wrote to memory of 3032	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	148
PID 1872 wrote to memory of 3032	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	148
PID 1872 wrote to memory of 1780	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	149
PID 1872 wrote to memory of 1780	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	149
PID 1872 wrote to memory of 1780	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	149
PID 1872 wrote to memory of 2696	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	151
PID 1872 wrote to memory of 2696	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	151
PID 1872 wrote to memory of 2696	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	151
PID 1872 wrote to memory of 2568	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	152
PID 1872 wrote to memory of 2568	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	152
PID 1872 wrote to memory of 2568	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	152
PID 1872 wrote to memory of 2408	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	154
PID 1872 wrote to memory of 2408	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	154
PID 1872 wrote to memory of 2408	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	154
PID 1872 wrote to memory of 2304	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	155
PID 1872 wrote to memory of 2304	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	155
PID 1872 wrote to memory of 2304	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	155
PID 1872 wrote to memory of 1608	1872	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	157

System policy modification 1 TTPs 30 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
"C:\Users\Admin\AppData\Local\Temp\df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe"
1⤵
- DcRat
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5RtZ0msxcr.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3020
- - C:\Users\Admin\AppData\Local\Temp\df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
    "C:\Users\Admin\AppData\Local\Temp\df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1000
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2144
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2932
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6qhBZ49x50.bat"
      4⤵
      PID:2960
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:1084
    - - C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe
        
        "C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2008
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af1438ca-17d2-4bce-9ee6-1b93c8f395cf.vbs"
        6⤵
        
        PID:1092
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1540
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5100131-665e-4b66-8ec0-2618e927a498.vbs"
        8⤵
        
        PID:780
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1236
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d0a0ac3f-c893-4d3c-adfe-92b482d416df.vbs"
        10⤵
        
        PID:2812
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2840
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e23b8519-8b9c-4d0d-8549-7969d8641a8b.vbs"
        12⤵
        
        PID:2076
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f88e22f8-9a9e-4aaf-982f-648dd5e82cf7.vbs"
        14⤵
        
        PID:532
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed1a2564-e7d9-4aff-9932-ab56b1a944e9.vbs"
        16⤵
        
        PID:2868
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5640fc7-3945-4136-b1e2-cbe3e9fbef05.vbs"
        18⤵
        
        PID:1752
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe
        
        C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2460
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fbf38ad7-550a-44fa-bb33-bffb8f29ea46.vbs"
        18⤵
        
        PID:2780
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ab76bc94-916b-4b6a-84e6-5211af17443c.vbs"
        16⤵
        
        PID:1728
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5298425-aba6-435e-b542-ac0b44fea75d.vbs"
        14⤵
        
        PID:2512
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6cae74ba-6b21-4d9a-8ed3-5a1148eba6dc.vbs"
        12⤵
        
        PID:2144
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2aed88ec-3ecf-47e8-9afb-701bd2460c09.vbs"
        10⤵
        
        PID:2940
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1fef2130-51ff-4243-b570-91ec8ff868de.vbs"
        8⤵
        
        PID:1556
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d796ffa0-b861-4d1c-aef4-535ab379d884.vbs"
        6⤵
        
        PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Mail\en-US\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Cookies\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default\Cookies\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Cookies\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\Network Sharing\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Network Sharing\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\Network Sharing\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\TAPI\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\TAPI\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Windows\TAPI\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Pictures\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Pictures\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Pictures\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6cd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Games\SpiderSolitaire\df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\SpiderSolitaire\df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6cd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Games\SpiderSolitaire\df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\Offline Web Pages\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\Offline Web Pages\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Desktop\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Desktop\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Desktop\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Recorded TV\Sample Media\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Users\Public\Recorded TV\Sample Media\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Recorded TV\Sample Media\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\Cursors\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Cursors\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\Cursors\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\DigitalLocker\es-ES\smss.exe'" /f
1⤵
- Process spawned unexpected child process
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\DigitalLocker\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\RemotePackages\RemoteDesktops\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteDesktops\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\RemotePackages\RemoteDesktops\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6cd" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Videos\Sample Videos\df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c" /sc ONLOGON /tr "'C:\Users\Public\Videos\Sample Videos\df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6cd" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Videos\Sample Videos\df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\sppsvc.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\winlogon.exe'" /f
1⤵
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\explorer.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows NT\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows NT\explorer.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Start Menu\lsm.exe'" /f
1⤵
- DcRat
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Start Menu\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5RtZ0msxcr.bat

Filesize
267B

MD5
4c6a92c108f033cc2711ae9295c0b0d1

SHA1
57758df33e482ceadd707108d1246ae3703b2124

SHA256
bb0cdfc48f46a7738eb8d94eb7ab3ce5f5f9d41982e1ca1142688db37f42a3cf

SHA512
f7732d966c2611a7c07ea0fa1e45cbeeab5ea0c89d4a51b1b9f0524ed2fedd993b2cbce4be40ac546b668e55fa81949fd24a2d0ba88e24d6d81aa4ed5cced40a

Download Submit
C:\Users\Admin\AppData\Local\Temp\6qhBZ49x50.bat

Filesize
223B

MD5
a39bcc4caebd12a4e581670a7adde102

SHA1
5b03d74282d78012c6b490e4154a2f0402132453

SHA256
19c906b8d396d113358dcb4d62bd5965ae883475e882fe55908c432bc859d218

SHA512
996c90e9de24f2890d05bd50128b8222d7ed61ffd3e3886575b13752b54a9d63f582acfe00322d4192a815ce4a9d20a20bfbd1e374949de0ed7c849bcdbf20a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\af1438ca-17d2-4bce-9ee6-1b93c8f395cf.vbs

Filesize
734B

MD5
6614183c35bd1a3ea46cfa2a8b6d43a2

SHA1
fcb3edb04c92cba1a96c5d81f5534a9ac9c1546f

SHA256
dcd04f7527dd10e2e7747923fa9a984b6e907cf40ded7279018d0ba7c5a35fe5

SHA512
68fa139e36817e26d1163a45a15829f08768f42eb940d34ae2d802953489b8d3fe1cc86a313b60b914c2e882fce2f558b1cd0de58a85227ed3f21a78a89b901b

Download Submit
C:\Users\Admin\AppData\Local\Temp\b5640fc7-3945-4136-b1e2-cbe3e9fbef05.vbs

Filesize
734B

MD5
fae279197ff92de9eaf0f75486b5bb27

SHA1
2f5fcd85eb9931962b3f1c93b478f1dffa458d95

SHA256
76ee4426da744ba184bcb9fa6d9f09569f0d8930a4a46f8e7ce49af932c1cc86

SHA512
27d4b0188bf434e1def1a143136cc638abd4cb6c65b9e098574d1378d89f5311e967976b1b9bdb6b0485f5f73f7b6fb6146faafa8f652a8094c9cd7fb4364daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\d0a0ac3f-c893-4d3c-adfe-92b482d416df.vbs

Filesize
734B

MD5
f44a0103a62de0c578b77764f5f6dc4f

SHA1
485dfdec8c7f373740b4948e477f7f32f1a89b63

SHA256
26a2448552058759976c66c35db4b7ed9c954914ca22bf4988b88a73ac22909b

SHA512
4694b7f547b46c19efd53f0a7659ad95375a0e2e4cd4d23528603c46728a66957ab9287febff09e8e6450b53644effe031694041b042580bcce57aa88248268c

Download Submit
C:\Users\Admin\AppData\Local\Temp\d796ffa0-b861-4d1c-aef4-535ab379d884.vbs

Filesize
510B

MD5
b1bcae6e8467619775e14202c64a8865

SHA1
c9006b0e50fec0566e1047b238a296467dc48fe6

SHA256
f1b2717f98b4536b9eac8f474b898258c2a81133adb85230fa7100df70645df4

SHA512
fc6dbf378342442d7914ed17a015a312a5f2851550f8fe02baa7eb9a8cfaa2f5656fa02b3ba392aa49cf4fa3e03eed2736c211b7991bc225663e029414456a6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\e23b8519-8b9c-4d0d-8549-7969d8641a8b.vbs

Filesize
734B

MD5
5c94a863bc89c369f58008d1156f1208

SHA1
b00ae1ce029be4eb783b6b7688691b6265f58326

SHA256
552891ecbde277895793b5ddf09d4f67283fcd1d47db7a75c824bb5ba5be4f39

SHA512
cdec9b66baaafb241490cc2ca8b801d95b5d27fcde2bc0099fdc50929d103c4b20ab083ce4c6570564ccde57a98eddbf30a1c27954e55c24b56b4fda30d7d40e

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5100131-665e-4b66-8ec0-2618e927a498.vbs

Filesize
734B

MD5
e9ba4cefcc9447e89e77fd37df738a20

SHA1
c6d56c5eeb0c8d0fd50640451c0afd66ef6c595a

SHA256
32d51c9108db910eef12b7c0635213802ff335aead3c145b320eaafa72463e51

SHA512
9ea0d8bb812f05d642d352c5cd7d9c3982c02b348a2f92ba1aa664e8f5c76ef1e95ade83c118e3318f1c31f48ec5edf1843e657d13c205065f3d8eb3cda6769c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ed1a2564-e7d9-4aff-9932-ab56b1a944e9.vbs

Filesize
734B

MD5
177e9bf308f1dc7d66226e4bff6da518

SHA1
8c8d8c3339a86b6cfdf51d6c7699ea2429b6d21e

SHA256
bb776ecd24178828f6ae91f54b230350177a676198df1abdb813b18a1acd40a0

SHA512
507cb01cd7d5a7bfed7e6b0f37606baf713f5eedb793b9083eeeee9a151ab0a08eaa73a906c03698adb1d5bcd19e8c2413b70632b5fcb0db140430d39d84cfcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\f88e22f8-9a9e-4aaf-982f-648dd5e82cf7.vbs

Filesize
733B

MD5
206fef37c2b1fc1eb938e34234476454

SHA1
5ec8e8230fa3551322e3693943976a6260146f36

SHA256
b29a31897ac784d9bbb82ce59f2421fbd39eca184197a02f0d96b1d02da04154

SHA512
b1c3c57ee018d42a20b4253f4da062e34ac0f2b4afa9ee94e4ac6fbc2ac3e1cf6a9c2392e2d047eccddd9ceeb0463e80308ab63b1cb5d33e39e04ae967009548

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFD14.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
8000e58042e3651bd3294ef06fb3f281

SHA1
ec154fb838a1502c60bff053982425f0383cb9e4

SHA256
6816f000ac5d732ad177edc63580c0e81c1147a1b001333b445610ac10470085

SHA512
a5fc0ec3b0d5dc1ffdf92ba6e877d82ca731be70053a557761fbc893967a8321b6949877c656a54acc31601f6a2168125b6b22bc32b963468fb5318698b3382c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
57d8ab799b1bbb462f065ffc430ee0bf

SHA1
64f5f5c10a580356afa5bf1e54c760bf7515db8d

SHA256
0b98a0f585b0162e416561bee3dfce2d4e461711f7b44f800ef4eac3e795b33e

SHA512
d3b46131db64305ebc753eb9a96b5819a414999305f706652dedd0fdb1755a8ccfe8e8cdde64762c6c7c84193788d39eadeff183cd704386e8a8b716a79a6e50

Download Submit
C:\Windows\Offline Web Pages\wininit.exe

Filesize
4.9MB

MD5
a3a89cf02203273dc86d4783c394656f

SHA1
e79f7c25d5294c57526ec582ae5e0fd60fb75890

SHA256
30b4693eab0ab4f84863dcf15086afcddce1efd3288565d404e03b7518863a6e

SHA512
0b4c5de05ea50eb8e0d2f9762e48022de81e5def5a46286b1a034673e6ef791468eb0a6ed1f1a45d2c6f895fe6fae5d93112829bdf31e80f73770b41d70199e6

Download Submit
C:\Windows\TAPI\sppsvc.exe

Filesize
4.9MB

MD5
90439e356e90dd66d5f3267f8459e4c3

SHA1
0f499014dd8f2374db0c12773bce0348e780179e

SHA256
df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c

SHA512
d7cd59b6e2e3419dd8fef6462c669c011404de19e9be70b82ed1f98cfc6b4fa3a228659dcaf439b06b4961cb3abb98f6aa33b847aa0f425ae4a80fa43135b9f1

Download Submit
memory/548-138-0x00000000028A0000-0x00000000028A8000-memory.dmp

Filesize
32KB

Download
memory/548-136-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/848-395-0x0000000000510000-0x0000000000522000-memory.dmp

Filesize
72KB

Download
memory/1236-365-0x00000000002D0000-0x00000000007C4000-memory.dmp

Filesize
5.0MB

Download
memory/1540-350-0x0000000000A90000-0x0000000000F84000-memory.dmp

Filesize
5.0MB

Download
memory/1724-12-0x0000000002420000-0x000000000242E000-memory.dmp

Filesize
56KB

Download
memory/1724-6-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download
memory/1724-0-0x000007FEF57C3000-0x000007FEF57C4000-memory.dmp

Filesize
4KB

Download
memory/1724-16-0x00000000024E0000-0x00000000024EC000-memory.dmp

Filesize
48KB

Download
memory/1724-3-0x000000001B550000-0x000000001B67E000-memory.dmp

Filesize
1.2MB

Download
memory/1724-15-0x0000000002450000-0x0000000002458000-memory.dmp

Filesize
32KB

Download
memory/1724-11-0x0000000002410000-0x000000000241A000-memory.dmp

Filesize
40KB

Download
memory/1724-13-0x0000000002430000-0x000000000243E000-memory.dmp

Filesize
56KB

Download
memory/1724-10-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/1724-1-0x0000000000970000-0x0000000000E64000-memory.dmp

Filesize
5.0MB

Download
memory/1724-9-0x0000000000600000-0x000000000060A000-memory.dmp

Filesize
40KB

Download
memory/1724-4-0x0000000000310000-0x000000000032C000-memory.dmp

Filesize
112KB

Download
memory/1724-2-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/1724-8-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/1724-7-0x00000000005E0000-0x00000000005F6000-memory.dmp

Filesize
88KB

Download
memory/1724-124-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/1724-5-0x0000000000330000-0x0000000000338000-memory.dmp

Filesize
32KB

Download
memory/1724-14-0x0000000002440000-0x0000000002448000-memory.dmp

Filesize
32KB

Download
memory/1816-410-0x0000000000140000-0x0000000000634000-memory.dmp

Filesize
5.0MB

Download
memory/1872-189-0x0000000000BD0000-0x0000000000BE2000-memory.dmp

Filesize
72KB

Download
memory/1872-188-0x00000000010F0000-0x00000000015E4000-memory.dmp

Filesize
5.0MB

Download
memory/2008-336-0x0000000002540000-0x0000000002552000-memory.dmp

Filesize
72KB

Download
memory/2008-335-0x00000000001E0000-0x00000000006D4000-memory.dmp

Filesize
5.0MB

Download
memory/2304-276-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/2304-275-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/2340-425-0x0000000000E30000-0x0000000001324000-memory.dmp

Filesize
5.0MB

Download
memory/2840-380-0x0000000001180000-0x0000000001674000-memory.dmp

Filesize
5.0MB

Download