dcrat | df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c

Analysis

max time kernel
148s
max time network
136s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
14-11-2024 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Size

4.9MB
MD5

90439e356e90dd66d5f3267f8459e4c3
SHA1

0f499014dd8f2374db0c12773bce0348e780179e
SHA256

df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c
SHA512

d7cd59b6e2e3419dd8fef6462c669c011404de19e9be70b82ed1f98cfc6b4fa3a228659dcaf439b06b4961cb3abb98f6aa33b847aa0f425ae4a80fa43135b9f1
SSDEEP

49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8g:A

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	496	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	2536	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2536	schtasks.exe

UAC bypass 3 TTPs 24 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exetaskhost.exetaskhost.exetaskhost.exetaskhost.exetaskhost.exetaskhost.exetaskhost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/596-2-0x000000001B870000-0x000000001B99E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
2956	powershell.exe
2880	powershell.exe
2844	powershell.exe
1960	powershell.exe
2180	powershell.exe
2392	powershell.exe
2124	powershell.exe
2024	powershell.exe
2372	powershell.exe
1288	powershell.exe
2044	powershell.exe
2420	powershell.exe

Executes dropped EXE 7 IoCs

Processes:

taskhost.exetaskhost.exetaskhost.exetaskhost.exetaskhost.exetaskhost.exetaskhost.exe

pid process

2092 taskhost.exe
1536 taskhost.exe
1900 taskhost.exe
2124 taskhost.exe
2520 taskhost.exe
1588 taskhost.exe
1748 taskhost.exe

pid	process
2092	taskhost.exe
1536	taskhost.exe
1900	taskhost.exe
2124	taskhost.exe
2520	taskhost.exe
1588	taskhost.exe
1748	taskhost.exe

Checks whether UAC is enabled 1 TTPs 16 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exetaskhost.exetaskhost.exetaskhost.exetaskhost.exetaskhost.exetaskhost.exetaskhost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe

Drops file in Program Files directory 21 IoCs

Processes:

df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe

description	ioc	process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\taskhost.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\taskhost.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\cc11b995f2a76d	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\RCXC2C5.tmp	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\RCXC0C1.tmp	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\RCXC6CD.tmp	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\27d1bcfc3c54e0	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\winlogon.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files\Java\jre7\bin\OSPPSVC.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files\Java\jre7\bin\1610b97d3ab4a7	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files\Windows Media Player\Icons\Idle.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files\Common Files\Services\6203df4a6bafc7	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files\Java\jre7\bin\RCXD15D.tmp	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files\Common Files\Services\lsass.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\b75386f1303e64	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\System.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\winlogon.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files\Java\jre7\bin\OSPPSVC.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Program Files\Common Files\Services\lsass.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\System.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Program Files\Common Files\Services\RCXDF96.tmp	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe

Drops file in Windows directory 4 IoCs

Processes:

df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe

description	ioc	process
File created	C:\Windows\inf\ja-JP\smss.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File created	C:\Windows\inf\ja-JP\69ddcba757bf72	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Windows\inf\ja-JP\RCXCF59.tmp	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
File opened for modification	C:\Windows\inf\ja-JP\smss.exe	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	process
1156	schtasks.exe
1664	schtasks.exe
1236	schtasks.exe
2128	schtasks.exe
1776	schtasks.exe
2956	schtasks.exe
2720	schtasks.exe
2088	schtasks.exe
1244	schtasks.exe
496	schtasks.exe
3012	schtasks.exe
2064	schtasks.exe
784	schtasks.exe
2768	schtasks.exe
2432	schtasks.exe
848	schtasks.exe
2256	schtasks.exe
1352	schtasks.exe
1480	schtasks.exe
2472	schtasks.exe
2296	schtasks.exe
2656	schtasks.exe
832	schtasks.exe
3016	schtasks.exe
904	schtasks.exe
2352	schtasks.exe
1624	schtasks.exe
900	schtasks.exe
2152	schtasks.exe
292	schtasks.exe
2860	schtasks.exe
2936	schtasks.exe
2596	schtasks.exe
1744	schtasks.exe
1784	schtasks.exe
1544	schtasks.exe
2828	schtasks.exe
2972	schtasks.exe
2292	schtasks.exe
872	schtasks.exe
2508	schtasks.exe
1032	schtasks.exe
1036	schtasks.exe
2988	schtasks.exe
2944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exetaskhost.exetaskhost.exetaskhost.exetaskhost.exetaskhost.exetaskhost.exetaskhost.exe

pid	process
596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
2180	powershell.exe
2392	powershell.exe
2372	powershell.exe
2124	powershell.exe
1960	powershell.exe
2844	powershell.exe
2024	powershell.exe
2880	powershell.exe
2956	powershell.exe
1288	powershell.exe
2044	powershell.exe
2420	powershell.exe
2092	taskhost.exe
1536	taskhost.exe
1900	taskhost.exe
2124	taskhost.exe
2520	taskhost.exe
1588	taskhost.exe
1748	taskhost.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	1288	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	2092	taskhost.exe
Token: SeDebugPrivilege	1536	taskhost.exe
Token: SeDebugPrivilege	1900	taskhost.exe
Token: SeDebugPrivilege	2124	taskhost.exe
Token: SeDebugPrivilege	2520	taskhost.exe
Token: SeDebugPrivilege	1588	taskhost.exe
Token: SeDebugPrivilege	1748	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.execmd.exetaskhost.exeWScript.exetaskhost.exeWScript.exetaskhost.exe

description	pid	process	target process
PID 596 wrote to memory of 2180	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2180	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2180	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2044	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2044	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2044	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 1288	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 1288	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 1288	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 1960	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 1960	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 1960	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2844	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2844	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2844	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2372	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2372	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2372	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2024	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2024	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2024	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2124	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2124	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2124	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2880	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2880	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2880	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2392	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2392	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2392	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2420	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2420	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2420	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2956	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2956	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2956	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	powershell.exe
PID 596 wrote to memory of 2656	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	cmd.exe
PID 596 wrote to memory of 2656	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	cmd.exe
PID 596 wrote to memory of 2656	596	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe	cmd.exe
PID 2656 wrote to memory of 1940	2656	cmd.exe	w32tm.exe
PID 2656 wrote to memory of 1940	2656	cmd.exe	w32tm.exe
PID 2656 wrote to memory of 1940	2656	cmd.exe	w32tm.exe
PID 2656 wrote to memory of 2092	2656	cmd.exe	taskhost.exe
PID 2656 wrote to memory of 2092	2656	cmd.exe	taskhost.exe
PID 2656 wrote to memory of 2092	2656	cmd.exe	taskhost.exe
PID 2092 wrote to memory of 2764	2092	taskhost.exe	WScript.exe
PID 2092 wrote to memory of 2764	2092	taskhost.exe	WScript.exe
PID 2092 wrote to memory of 2764	2092	taskhost.exe	WScript.exe
PID 2092 wrote to memory of 812	2092	taskhost.exe	WScript.exe
PID 2092 wrote to memory of 812	2092	taskhost.exe	WScript.exe
PID 2092 wrote to memory of 812	2092	taskhost.exe	WScript.exe
PID 2764 wrote to memory of 1536	2764	WScript.exe	taskhost.exe
PID 2764 wrote to memory of 1536	2764	WScript.exe	taskhost.exe
PID 2764 wrote to memory of 1536	2764	WScript.exe	taskhost.exe
PID 1536 wrote to memory of 284	1536	taskhost.exe	WScript.exe
PID 1536 wrote to memory of 284	1536	taskhost.exe	WScript.exe
PID 1536 wrote to memory of 284	1536	taskhost.exe	WScript.exe
PID 1536 wrote to memory of 1352	1536	taskhost.exe	WScript.exe
PID 1536 wrote to memory of 1352	1536	taskhost.exe	WScript.exe
PID 1536 wrote to memory of 1352	1536	taskhost.exe	WScript.exe
PID 284 wrote to memory of 1900	284	WScript.exe	taskhost.exe
PID 284 wrote to memory of 1900	284	WScript.exe	taskhost.exe
PID 284 wrote to memory of 1900	284	WScript.exe	taskhost.exe
PID 1900 wrote to memory of 2664	1900	taskhost.exe	WScript.exe

System policy modification 1 TTPs 24 IoCs

evasion

Modify Registry

T1112

Processes:

taskhost.exetaskhost.exedf179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exetaskhost.exetaskhost.exetaskhost.exetaskhost.exetaskhost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe
"C:\Users\Admin\AppData\Local\Temp\df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\paPDmIwOcv.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1940
- - C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe
    "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2092
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b2b070c2-672a-43dd-a79f-c97e082b84a6.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2764
    - - C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1536
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d4c06ab6-a19f-4c44-b61e-c0df028b5bc4.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:284
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1900
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\24d6927c-2079-43b9-a063-f3d0b2371a9c.vbs"
        8⤵
        
        PID:2664
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2124
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\367ed8f9-0587-498f-bb52-5087ae961d6b.vbs"
        10⤵
        
        PID:2596
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2520
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b77a72c9-bf13-46fb-8734-0701840bafa6.vbs"
        12⤵
        
        PID:2196
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1588
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\197c4742-39c0-41b1-9902-1ce62088665b.vbs"
        14⤵
        
        PID:2888
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1748
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\610346fd-2d25-4211-80d7-c1fb067f478e.vbs"
        16⤵
        
        PID:1620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cbf10763-f0d5-4a05-a03e-a7079ba47ba1.vbs"
        16⤵
        
        PID:1484
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c7c3e6b-768b-4512-a788-9bebe8cc9fa1.vbs"
        14⤵
        
        PID:2688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e2cf66fa-d131-417d-8042-2848a3cce4b6.vbs"
        12⤵
        
        PID:2168
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0491d983-4050-499f-bc1b-6d5e1c9564f5.vbs"
        10⤵
        
        PID:912
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0ecbdb4-7b22-4614-9364-fe65046a58b1.vbs"
        8⤵
        
        PID:776
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9056cadc-21c3-4083-b3dc-175932825bd1.vbs"
        6⤵
        
        PID:1352
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c686323b-600b-41d9-9f29-56b37a8c2832.vbs"
      4⤵
      PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Games\SpiderSolitaire\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\SpiderSolitaire\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Games\SpiderSolitaire\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\inf\ja-JP\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\inf\ja-JP\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\inf\ja-JP\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jre7\bin\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\bin\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jre7\bin\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\Services\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Common Files\Services\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\Services\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\OSPPSVC.exe

Filesize
4.9MB

MD5
90439e356e90dd66d5f3267f8459e4c3

SHA1
0f499014dd8f2374db0c12773bce0348e780179e

SHA256
df179bfb8c1842ab29d2463ac3fb446ec977a80e420e7e6a543397d2a56a5d6c

SHA512
d7cd59b6e2e3419dd8fef6462c669c011404de19e9be70b82ed1f98cfc6b4fa3a228659dcaf439b06b4961cb3abb98f6aa33b847aa0f425ae4a80fa43135b9f1

Download Submit
C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\taskhost.exe

Filesize
4.9MB

MD5
f26f540844840fe8b07ed971478c7e62

SHA1
489187b76a9d91d96ac4c492aeb0ba1ef92001b6

SHA256
d6a2b3b00552058377b209539c967b67cd975c1b0dad0d230374d71b5ef0bb7d

SHA512
0280bbbfd15b765051a8579aafa670192affdb376b12858162c9b82cd4a4f67af6b45c77ce8ecb11861020eb98e4257288428ff11466e5ab81ec70bb248623d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\197c4742-39c0-41b1-9902-1ce62088665b.vbs

Filesize
737B

MD5
8ef8b651ff965d1dc9dfd21d9a7a4ab2

SHA1
78c005384cde9133bc481399aebd4421d77a104f

SHA256
efef7b4aa02abcb93cf676823375357d22959c6ee6cfc4b7d877a2d83758600b

SHA512
1d96fda867296861db59ff64937be029ca53211d0cb6743487c50a9582d2cff528a8775c16fbd9c5c351291317dfcab5374476dc70e6ad91559ac846966fd844

Download Submit
C:\Users\Admin\AppData\Local\Temp\24d6927c-2079-43b9-a063-f3d0b2371a9c.vbs

Filesize
737B

MD5
63c68c79d712733ac23e9633206b425b

SHA1
06086633b41d6070d027eb6fbf78599d3abb8ad1

SHA256
bd984ad628d7663474222f9a82b170df5fc2a43ec09b94284e1c1389a8f61a8d

SHA512
8186acff8ab112bd939c0acc2643e5a691c4262b22204d0e82c9793dd59b298363c1b03c9be834daecd9bbbc09d2302492b9e08f84295dac6df526a50e9f357d

Download Submit
C:\Users\Admin\AppData\Local\Temp\367ed8f9-0587-498f-bb52-5087ae961d6b.vbs

Filesize
737B

MD5
bd8948efdb2309d22994c87c9312656e

SHA1
de9f9f685ea7caa01f22db45f17e5cb237f21f5f

SHA256
d5517c98846422e09ed4639925d5a0126cd93e62d680c2a7dbbe36a5bd9e9e91

SHA512
5ce39f73e6dbb709e539f6bfd55280a5d7be0d70998fa6037674798ed2f539893d463b1a698d84edde9788bcd9fc0b34a87e0319b40e08148b2a4bc3fb2e4adc

Download Submit
C:\Users\Admin\AppData\Local\Temp\610346fd-2d25-4211-80d7-c1fb067f478e.vbs

Filesize
737B

MD5
5ea0e9bdf4e20bac9b92f089efe3596f

SHA1
39d5c2eae4eeb24b31cd928fdf6f4c567d46fab1

SHA256
38f5e5310c076fa6ac5df2882698bcd32ff934052fc722d8db8dcc11d8616873

SHA512
f798da00e15a6f5a3c61d1a21627a4652d348976369d518447c494ae7d9fe13273b910b32aad4353e1da94cb228a765499adf3d310159cd6483595c35d276b3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\b2b070c2-672a-43dd-a79f-c97e082b84a6.vbs

Filesize
737B

MD5
e5738f1834b5e7d2a03785aed2e34b9d

SHA1
89d4d1522270a7653572d0f0e04f49e4448249af

SHA256
3df3dded6c34661c1045ebc0108f47a6914313904ff3f64e0449c706a508cb1f

SHA512
a8ece4a3040ff55c7fe96a56df6beb13bf7cbcf4003382dce32f2179286ac6e524ea4c80c04ced990753c00e2523d82f2a2f11dbf13e85cf13e6820604276dce

Download Submit
C:\Users\Admin\AppData\Local\Temp\b77a72c9-bf13-46fb-8734-0701840bafa6.vbs

Filesize
737B

MD5
f0028e9ff367613499fe5592f1570816

SHA1
afdb86020beba71f72003e69564884c1715dadd2

SHA256
6756a49b228f6af84ff77a2b3a844f1ade1c368fb045ee8a1fae3367266b9dc7

SHA512
96a8ed025239ee9de381b27a599f15f3d9d6ef1284693f6bf4ed1dd401b85d03ad00ab4860adaa624678e8635c44e106608fb43dcaae363ca52b9213aa2653ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\c686323b-600b-41d9-9f29-56b37a8c2832.vbs

Filesize
513B

MD5
914914d545c83cd1ffab1391da4dd4ae

SHA1
44c7f43e05079cf5aece6d58493765a7af4b0552

SHA256
b36f6b7a606bb6c50878ee7fbbcf1eaf2bcc302d9482427b9d68d6762fe28883

SHA512
f226657ac72957e4f47d7447291c85fd8a80f7ebd4eb26fd25326b8cce58a9cbe09572b0d67fd3c7c741438b7649f441f4d72a32334b92708b3ad34370b5bc57

Download Submit
C:\Users\Admin\AppData\Local\Temp\d4c06ab6-a19f-4c44-b61e-c0df028b5bc4.vbs

Filesize
737B

MD5
0595a12e17adff5537caf9bfa73bd28a

SHA1
48226c5123ec1898c0c17dd2b4aa2f23a8d5a1f7

SHA256
50ab8c62cf5f023795992ebcac8c155f50d68aa132529d320ff72b14934bf979

SHA512
6da84026a7ac5c03e2dd8238708b347c3ab929b82423cdeba845d7ea104cd29bdcff7005d4c73911843d7c746d999dcf12066ba63bbe78f99ce829c318cecc62

Download Submit
C:\Users\Admin\AppData\Local\Temp\paPDmIwOcv.bat

Filesize
226B

MD5
1245043f6737a23686edb486843af862

SHA1
13da1d4b82b976de65e33c39fc4151ff16ad659a

SHA256
e8cb5f00cd309c8a3a2494362ac2b27ecc7a61b34391e0bb5faf0773745ea177

SHA512
56172372dcb12c6c59d543584e2560ac6742a6278157554f092edcea0a9f884a643dd52cdc3f25c5a26ce702f395c25bc24161dac9354c66ba7b01d7dabc71d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp732.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a053e341a14036419fdc2d3f7fce8f37

SHA1
0565362e75568f06016b8eba58de3282850b2386

SHA256
94bf90afbd15a2f33644ebc2cf5f620204ecaeade7afb07dd2c87850b1c44ca2

SHA512
4431564141d186a44c1408367d94332166294fda8905005a17ea9b2e3d5663f4101af57d17ee53c12c1df1ee6ae7f28cd1e7ef4b4788f8876bcb29daf2c559e0

Download Submit
memory/596-157-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/596-7-0x0000000000420000-0x0000000000436000-memory.dmp

Filesize
88KB

Download
memory/596-16-0x0000000002670000-0x000000000267C000-memory.dmp

Filesize
48KB

Download
memory/596-14-0x00000000025D0000-0x00000000025D8000-memory.dmp

Filesize
32KB

Download
memory/596-13-0x0000000002540000-0x000000000254E000-memory.dmp

Filesize
56KB

Download
memory/596-138-0x000007FEF55E3000-0x000007FEF55E4000-memory.dmp

Filesize
4KB

Download
memory/596-145-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/596-0-0x000007FEF55E3000-0x000007FEF55E4000-memory.dmp

Filesize
4KB

Download
memory/596-12-0x0000000002530000-0x000000000253E000-memory.dmp

Filesize
56KB

Download
memory/596-1-0x0000000000B00000-0x0000000000FF4000-memory.dmp

Filesize
5.0MB

Download
memory/596-2-0x000000001B870000-0x000000001B99E000-memory.dmp

Filesize
1.2MB

Download
memory/596-11-0x0000000002520000-0x000000000252A000-memory.dmp

Filesize
40KB

Download
memory/596-10-0x0000000002510000-0x0000000002522000-memory.dmp

Filesize
72KB

Download
memory/596-3-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/596-9-0x0000000000AF0000-0x0000000000AFA000-memory.dmp

Filesize
40KB

Download
memory/596-15-0x00000000025E0000-0x00000000025E8000-memory.dmp

Filesize
32KB

Download
memory/596-8-0x0000000000440000-0x0000000000450000-memory.dmp

Filesize
64KB

Download
memory/596-4-0x0000000000390000-0x00000000003AC000-memory.dmp

Filesize
112KB

Download
memory/596-6-0x0000000000410000-0x0000000000420000-memory.dmp

Filesize
64KB

Download
memory/596-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1536-237-0x00000000005A0000-0x00000000005B2000-memory.dmp

Filesize
72KB

Download
memory/1588-297-0x0000000000090000-0x0000000000584000-memory.dmp

Filesize
5.0MB

Download
memory/1748-312-0x00000000008A0000-0x0000000000D94000-memory.dmp

Filesize
5.0MB

Download
memory/1900-252-0x0000000000200000-0x00000000006F4000-memory.dmp

Filesize
5.0MB

Download
memory/2092-223-0x0000000000C40000-0x0000000001134000-memory.dmp

Filesize
5.0MB

Download
memory/2124-267-0x0000000000BC0000-0x00000000010B4000-memory.dmp

Filesize
5.0MB

Download
memory/2180-174-0x0000000002330000-0x0000000002338000-memory.dmp

Filesize
32KB

Download
memory/2180-173-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2520-282-0x0000000001170000-0x0000000001664000-memory.dmp

Filesize
5.0MB

Download