dcrat | bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-11-2024 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
Size

4.9MB
MD5

25182c721a9a0f64e4ed7c31e1c8c6bc
SHA1

50c80cd3ed583b2fb9d6c47d4e2318d8e1d5c584
SHA256

bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82
SHA512

57f16d2455ea10205deb379ee0f8892037cd7239f05e504794b22a105f9a6bd997a1618626ea2965c8405548d28f8173a5f4ed606b2760708a6bcd0348d88565
SSDEEP

49152:Ll5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8/:n

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	484	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	348	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	1292	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	1292	schtasks.exe	31

UAC bypass 3 TTPs 27 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2944-3-0x000000001B4D0000-0x000000001B5FE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2876	powershell.exe
660	powershell.exe
2752	powershell.exe
796	powershell.exe
484	powershell.exe
1668	powershell.exe
1272	powershell.exe
2868	powershell.exe
2396	powershell.exe
448	powershell.exe
2388	powershell.exe
2112	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
2996	lsass.exe
1328	lsass.exe
2052	lsass.exe
1576	lsass.exe
1808	lsass.exe
2488	lsass.exe
1236	lsass.exe
2092	lsass.exe

Checks whether UAC is enabled 1 TTPs 18 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\Visualizations\75a57c1bdf437c	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Visualizations\RCXFDB6.tmp	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\lsm.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\csrss.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File created	C:\Program Files (x86)\Microsoft.NET\lsm.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File created	C:\Program Files (x86)\Microsoft.NET\101b941d020240	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\6203df4a6bafc7	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\it-IT\RCX1DD.tmp	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsass.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WmiPrvSE.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File created	C:\Program Files (x86)\Reference Assemblies\System.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\RCXF8D4.tmp	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\it-IT\dwm.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\RCXF644.tmp	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\WmiPrvSE.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\taskhost.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\RCXEED.tmp	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\System.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\24dbde2999530e	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File created	C:\Program Files (x86)\Microsoft Office\taskhost.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File created	C:\Program Files (x86)\Microsoft Office\b75386f1303e64	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsass.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RCX865.tmp	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\RCXC7C.tmp	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File created	C:\Program Files (x86)\Windows Media Player\Visualizations\WMIADAP.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File created	C:\Program Files (x86)\Windows Mail\it-IT\dwm.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File created	C:\Program Files (x86)\Reference Assemblies\27d1bcfc3c54e0	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\886983d96e3d3e	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Visualizations\WMIADAP.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\csrss.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RCX1101.tmp	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File created	C:\Program Files (x86)\Windows Mail\it-IT\6cb0b6c459d5d3	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system\lsass.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File created	C:\Windows\system\6203df4a6bafc7	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Windows\system\RCX661.tmp	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
File opened for modification	C:\Windows\system\lsass.exe	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2484	schtasks.exe
1472	schtasks.exe
1740	schtasks.exe
1128	schtasks.exe
1992	schtasks.exe
1328	schtasks.exe
372	schtasks.exe
2776	schtasks.exe
1756	schtasks.exe
2908	schtasks.exe
2836	schtasks.exe
484	schtasks.exe
2748	schtasks.exe
2488	schtasks.exe
2220	schtasks.exe
2792	schtasks.exe
868	schtasks.exe
2716	schtasks.exe
2864	schtasks.exe
2596	schtasks.exe
2600	schtasks.exe
2068	schtasks.exe
1596	schtasks.exe
1672	schtasks.exe
1916	schtasks.exe
396	schtasks.exe
2424	schtasks.exe
2828	schtasks.exe
2672	schtasks.exe
2844	schtasks.exe
1704	schtasks.exe
316	schtasks.exe
2168	schtasks.exe
1492	schtasks.exe
2060	schtasks.exe
2016	schtasks.exe
2720	schtasks.exe
2080	schtasks.exe
2144	schtasks.exe
2300	schtasks.exe
2064	schtasks.exe
1964	schtasks.exe
2684	schtasks.exe
2152	schtasks.exe
1600	schtasks.exe
852	schtasks.exe
904	schtasks.exe
2848	schtasks.exe
2364	schtasks.exe
1560	schtasks.exe
348	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
1272	powershell.exe
2876	powershell.exe
2868	powershell.exe
448	powershell.exe
2388	powershell.exe
796	powershell.exe
660	powershell.exe
2112	powershell.exe
2752	powershell.exe
2396	powershell.exe
484	powershell.exe
1668	powershell.exe
2996	lsass.exe
1328	lsass.exe
2052	lsass.exe
1576	lsass.exe
1808	lsass.exe
2488	lsass.exe
1236	lsass.exe
2092	lsass.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	796	powershell.exe
Token: SeDebugPrivilege	660	powershell.exe
Token: SeDebugPrivilege	2112	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	484	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	2996	lsass.exe
Token: SeDebugPrivilege	1328	lsass.exe
Token: SeDebugPrivilege	2052	lsass.exe
Token: SeDebugPrivilege	1576	lsass.exe
Token: SeDebugPrivilege	1808	lsass.exe
Token: SeDebugPrivilege	2488	lsass.exe
Token: SeDebugPrivilege	1236	lsass.exe
Token: SeDebugPrivilege	2092	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1272	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	83
PID 2944 wrote to memory of 1272	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	83
PID 2944 wrote to memory of 1272	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	83
PID 2944 wrote to memory of 2876	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	84
PID 2944 wrote to memory of 2876	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	84
PID 2944 wrote to memory of 2876	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	84
PID 2944 wrote to memory of 660	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	85
PID 2944 wrote to memory of 660	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	85
PID 2944 wrote to memory of 660	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	85
PID 2944 wrote to memory of 2868	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	87
PID 2944 wrote to memory of 2868	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	87
PID 2944 wrote to memory of 2868	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	87
PID 2944 wrote to memory of 2752	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	88
PID 2944 wrote to memory of 2752	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	88
PID 2944 wrote to memory of 2752	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	88
PID 2944 wrote to memory of 796	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	92
PID 2944 wrote to memory of 796	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	92
PID 2944 wrote to memory of 796	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	92
PID 2944 wrote to memory of 2112	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	93
PID 2944 wrote to memory of 2112	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	93
PID 2944 wrote to memory of 2112	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	93
PID 2944 wrote to memory of 2388	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	94
PID 2944 wrote to memory of 2388	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	94
PID 2944 wrote to memory of 2388	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	94
PID 2944 wrote to memory of 1668	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	95
PID 2944 wrote to memory of 1668	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	95
PID 2944 wrote to memory of 1668	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	95
PID 2944 wrote to memory of 484	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	96
PID 2944 wrote to memory of 484	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	96
PID 2944 wrote to memory of 484	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	96
PID 2944 wrote to memory of 2396	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	97
PID 2944 wrote to memory of 2396	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	97
PID 2944 wrote to memory of 2396	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	97
PID 2944 wrote to memory of 448	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	99
PID 2944 wrote to memory of 448	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	99
PID 2944 wrote to memory of 448	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	99
PID 2944 wrote to memory of 1572	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	107
PID 2944 wrote to memory of 1572	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	107
PID 2944 wrote to memory of 1572	2944	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe	107
PID 1572 wrote to memory of 2324	1572	cmd.exe	109
PID 1572 wrote to memory of 2324	1572	cmd.exe	109
PID 1572 wrote to memory of 2324	1572	cmd.exe	109
PID 1572 wrote to memory of 2996	1572	cmd.exe	110
PID 1572 wrote to memory of 2996	1572	cmd.exe	110
PID 1572 wrote to memory of 2996	1572	cmd.exe	110
PID 2996 wrote to memory of 1944	2996	lsass.exe	111
PID 2996 wrote to memory of 1944	2996	lsass.exe	111
PID 2996 wrote to memory of 1944	2996	lsass.exe	111
PID 2996 wrote to memory of 2672	2996	lsass.exe	112
PID 2996 wrote to memory of 2672	2996	lsass.exe	112
PID 2996 wrote to memory of 2672	2996	lsass.exe	112
PID 1944 wrote to memory of 1328	1944	WScript.exe	113
PID 1944 wrote to memory of 1328	1944	WScript.exe	113
PID 1944 wrote to memory of 1328	1944	WScript.exe	113
PID 1328 wrote to memory of 2180	1328	lsass.exe	114
PID 1328 wrote to memory of 2180	1328	lsass.exe	114
PID 1328 wrote to memory of 2180	1328	lsass.exe	114
PID 1328 wrote to memory of 1000	1328	lsass.exe	115
PID 1328 wrote to memory of 1000	1328	lsass.exe	115
PID 1328 wrote to memory of 1000	1328	lsass.exe	115
PID 2180 wrote to memory of 2052	2180	WScript.exe	116
PID 2180 wrote to memory of 2052	2180	WScript.exe	116
PID 2180 wrote to memory of 2052	2180	WScript.exe	116
PID 2052 wrote to memory of 1908	2052	lsass.exe	117

System policy modification 1 TTPs 27 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe
"C:\Users\Admin\AppData\Local\Temp\bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xqMEPA9M3G.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2324
- - C:\MSOCache\All Users\lsass.exe
    "C:\MSOCache\All Users\lsass.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2996
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cd3e6035-c7f4-4f59-a820-acca5c908eeb.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1944
    - - C:\MSOCache\All Users\lsass.exe
        
        "C:\MSOCache\All Users\lsass.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1328
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a76ae95b-2197-489e-8716-df5363c5fe11.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\MSOCache\All Users\lsass.exe
        
        "C:\MSOCache\All Users\lsass.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2052
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f545d829-c248-45ff-83b5-bd671ab32630.vbs"
        8⤵
        
        PID:1908
        
        C:\MSOCache\All Users\lsass.exe
        
        "C:\MSOCache\All Users\lsass.exe"
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1576
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be8da5aa-fd98-49b0-9445-c30e42a9a61f.vbs"
        10⤵
        
        PID:2864
        
        C:\MSOCache\All Users\lsass.exe
        
        "C:\MSOCache\All Users\lsass.exe"
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d7677331-8ac0-4872-9fc4-0693152d99f8.vbs"
        12⤵
        
        PID:2244
        
        C:\MSOCache\All Users\lsass.exe
        
        "C:\MSOCache\All Users\lsass.exe"
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5d03c97-d435-4866-bc61-a954320bbb61.vbs"
        14⤵
        
        PID:2704
        
        C:\MSOCache\All Users\lsass.exe
        
        "C:\MSOCache\All Users\lsass.exe"
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1236
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6ce57b25-e70e-4c74-9e1e-bcc8cffa6d79.vbs"
        16⤵
        
        PID:448
        
        C:\MSOCache\All Users\lsass.exe
        
        "C:\MSOCache\All Users\lsass.exe"
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2092
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2cbad7e5-1ec4-4f81-96db-a41fb9d2b273.vbs"
        18⤵
        
        PID:2984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4cd4d62-17d2-4966-bcb3-333d36fda0b2.vbs"
        18⤵
        
        PID:2836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb10ba51-69df-45ec-8d4c-90e159207c1f.vbs"
        16⤵
        
        PID:2936
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6eb3ccb9-2588-49db-aacf-c32a7bea5a81.vbs"
        14⤵
        
        PID:2268
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae990510-8199-42f6-a6dd-e68ddd532de9.vbs"
        12⤵
        
        PID:2940
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4a6f01e-8177-4f05-8e26-69d619a421c1.vbs"
        10⤵
        
        PID:904
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9b5abf5c-e004-42ce-b9d2-1846e2e6b02e.vbs"
        8⤵
        
        PID:2884
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\110555f7-c259-4e75-b7c0-c24d5c863548.vbs"
        6⤵
        
        PID:1000
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7f97dce2-6545-4c1c-b802-26a65d5bc7df.vbs"
      4⤵
      PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files\DVD Maker\Shared\DvdStyles\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\Shared\DvdStyles\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files\DVD Maker\Shared\DvdStyles\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Office\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Office\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\it-IT\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\it-IT\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\it-IT\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Windows\system\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\system\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Windows\system\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Admin\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\Accessories\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Media Player\Visualizations\WMIADAP.exe

Filesize
4.9MB

MD5
25182c721a9a0f64e4ed7c31e1c8c6bc

SHA1
50c80cd3ed583b2fb9d6c47d4e2318d8e1d5c584

SHA256
bf937d79c4f60f8c681296528af7bc7b04e4507d33f0802eed126a9f4df95e82

SHA512
57f16d2455ea10205deb379ee0f8892037cd7239f05e504794b22a105f9a6bd997a1618626ea2965c8405548d28f8173a5f4ed606b2760708a6bcd0348d88565

Download Submit
C:\Users\Admin\AppData\Local\Temp\2cbad7e5-1ec4-4f81-96db-a41fb9d2b273.vbs

Filesize
707B

MD5
8518f0a6cb7b6f6ab2e2c73c51aa460d

SHA1
7420f3b36b6f7106c4f2371b54b23f1592c1cba5

SHA256
ee0c72a002c5fc4cd3e302305bec071f8fe07e897fa8103e7f5dba154481a210

SHA512
c890eeeff58db77ad6b61ecd9a1294473360c27cfa653c5178f2699316cb676e63970862c194a10c2b946b50d5bf315bde67e9d80909ddffc2325b43b23b5b8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\6ce57b25-e70e-4c74-9e1e-bcc8cffa6d79.vbs

Filesize
707B

MD5
36582b5490e4b26fb26746d6940b65e5

SHA1
423e83dbef5b9ce8a98f1756bd6e027f471461f6

SHA256
a1014257448afd0d2531dde793fb8bef73b4205cf5813f0e7e98a550218f1372

SHA512
b47c6d4ad0f1f85d3f22f14e404a591d163a9b6de5633ef828ce59ae3644b4ac187b94be2f88d91d7da7ca58f8cb90e2b5c64bcef1e6fc15236e0452d35695ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\7f97dce2-6545-4c1c-b802-26a65d5bc7df.vbs

Filesize
483B

MD5
5e2c11082068967a9f483b33cdfc8d97

SHA1
f1bdd04245e6ad63b28b2cb7267c0c56825e2769

SHA256
43836bd614a2e8ac712dea3dd82fdd579bc1a17c6e0c86fad0569f29fa2b6659

SHA512
b0439928c327d891f90314cbf7ac2c78d0abd2d0ce23ebfe7207c5ac7d3cf9ac347ec9db9084847726c8c1a7fb5be2151f46138df9aad1c5411dbfd4803d053e

Download Submit
C:\Users\Admin\AppData\Local\Temp\a76ae95b-2197-489e-8716-df5363c5fe11.vbs

Filesize
707B

MD5
cb4482e5d0613366e3855e8fee298b63

SHA1
3696b5a43e7a7feab30444ad136442da3442592c

SHA256
5e14e8fc1fe7bc7d7d85f23c0f2500c5be88864efed88a84aad2b3e749b1c9e6

SHA512
d0700e0b9c55d5695e59bdc2ffc0bed989dc6ebb3589815970104b0bba267ac435cabd2e34e780f29d57ad02da3de2ff99b42fc5b14f5bb3f08c48bbb1407b72

Download Submit
C:\Users\Admin\AppData\Local\Temp\be8da5aa-fd98-49b0-9445-c30e42a9a61f.vbs

Filesize
707B

MD5
e990b3b09fdc99e182472ddef3edfa95

SHA1
cc044aa57d061792bc561c00b3faf432723d007b

SHA256
dc6a731b550b62f52b502017e5168258c9dd8c6b568ed25127f55a35551a7acd

SHA512
47ec1a92d2b2140a00d088527bb6fc301c7ffb708a32e760c577e3e2c8c6794a368429342f494c4cef4007b1e2447eb9cb6fa774abccd3bc41b264bd7a17718b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cd3e6035-c7f4-4f59-a820-acca5c908eeb.vbs

Filesize
707B

MD5
de79603ad49698d49aa9bc8bbb54eab0

SHA1
e77593f5faf49375cc7c2863a833254a4b3cfd6f

SHA256
d690de1b889a63022934ef36a8e6ed98d925cb76cdcb377e2da29e788646a5ea

SHA512
1f0fb3807199d577e4db58d9087d584e461e42f720b66ec11f9d65e7e073a3fe0644b7ec66e9c1b65bfbafc73743c05a087f4b664e78389b3ed3b24006f2d7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\d7677331-8ac0-4872-9fc4-0693152d99f8.vbs

Filesize
707B

MD5
b3f18bc7c888b10f5261a82ce261bc38

SHA1
2241c527e07e6e1797ec8f37557b6683fc2935c3

SHA256
8a8ebcbefe75adf39141a5739405f3220ed95804cf3a0e255b94e11696b26bef

SHA512
dd1e356dd82a9ee7d6bafc75893698690eecc758907c564fc5c494ed51a2f748cdf2bd70aa1a3757e8d3f1ca525aec08a6d435e2cda409550dc6624949d5711c

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5d03c97-d435-4866-bc61-a954320bbb61.vbs

Filesize
707B

MD5
2e4d99a2fc33260eb0b1956a82f009c8

SHA1
ef430b852158d49dd98fa50d7409ca484e5fbffd

SHA256
5ecf27622ffab15e8c88f9d48cb73a215b4192324608252cb8c371fd3dda0cf0

SHA512
107db3408c57c8bdbadeb9ebced09b5ce51be60d964e2fbda540e906a5b7ff5e5e8a6e3c7b4a70103c4c5065d5a3b0baf28d35a5ea549d04c2825bb2b7fedb95

Download Submit
C:\Users\Admin\AppData\Local\Temp\f545d829-c248-45ff-83b5-bd671ab32630.vbs

Filesize
707B

MD5
93d519dbb8a1f6406c7ce53596fe30b6

SHA1
b5881c7b1752c280a71a64a172e228f9e7d2ad8e

SHA256
0b74e1cb75bd3d6ecc2cc7d838054a309bbde10de5d0c41eb8b8d166771f8b27

SHA512
95447c79cd16d0b4b91e993211d2a0b256341f8971ff8d9562f8f301d2fbc01c4457face24d4e2468d59d1b5de1f0776dcc988fd93a2a744faa7f682a0dfabb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3EF4.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Local\Temp\xqMEPA9M3G.bat

Filesize
196B

MD5
7a3464f75e4fbbc63b095e9138904195

SHA1
65f30a86ffbacf6a0f9de7f80c1fc0862d676bf7

SHA256
958b71555ecd0e09cabe0e1d9353adea6c51862d5b5ca10144801490dc4d5e3c

SHA512
e47ec38b21079dfbd2bd6254dec125f545d47b5baa4797c21f4489971fb7b468dba450bf559a65cd20117b883849f31fb36d03db85556325d78c33a56a85c718

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1ddeae754e983b9be9b68c4100d2b67f

SHA1
af99b60cab9fbdaf17653e6cd159ead12b6c4d0d

SHA256
3c062b33d9ab96c291cfe35a1f8164d6167b9cca5c4f2ff164379a9f812db08d

SHA512
f94b27b69a4486230d5073c763c4de38e2399d63c094abec1beae2baff61167dbd9e5a24b8350d9e3b1951071003d72e1b8d38b9197bb69eb9e51f9d27ecd669

Download Submit
C:\Windows\system\RCX661.tmp

Filesize
4.9MB

MD5
4c1c5985c78bbff56d20e552af8f597e

SHA1
9c0518b09e8935fa50e09d7719a5700ffd31f48e

SHA256
2a0f2ec7a705eca7b55b2cd25bb43571e5357883af990391e6e400d9df10eec6

SHA512
b9f69076eb0a56d65597bb0e4d7dc7e6b48ecc94016f0a8905c4ae6fb2ec7f74c31b85311c97cea29e18da5216b7cf8e3b9e4b11aa8398d9dd49c0a265e8c43d

Download Submit
memory/1272-217-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/1328-258-0x00000000007B0000-0x00000000007C2000-memory.dmp

Filesize
72KB

Download
memory/1328-257-0x0000000001090000-0x0000000001584000-memory.dmp

Filesize
5.0MB

Download
memory/1576-287-0x0000000000180000-0x0000000000674000-memory.dmp

Filesize
5.0MB

Download
memory/1808-302-0x0000000000310000-0x0000000000804000-memory.dmp

Filesize
5.0MB

Download
memory/2092-346-0x0000000000E70000-0x0000000001364000-memory.dmp

Filesize
5.0MB

Download
memory/2488-317-0x0000000000BD0000-0x00000000010C4000-memory.dmp

Filesize
5.0MB

Download
memory/2876-182-0x000000001B530000-0x000000001B812000-memory.dmp

Filesize
2.9MB

Download
memory/2944-10-0x0000000000990000-0x00000000009A2000-memory.dmp

Filesize
72KB

Download
memory/2944-0-0x000007FEF5E33000-0x000007FEF5E34000-memory.dmp

Filesize
4KB

Download
memory/2944-238-0x000007FEF5E30000-0x000007FEF681C000-memory.dmp

Filesize
9.9MB

Download
memory/2944-130-0x000007FEF5E33000-0x000007FEF5E34000-memory.dmp

Filesize
4KB

Download
memory/2944-1-0x0000000000060000-0x0000000000554000-memory.dmp

Filesize
5.0MB

Download
memory/2944-14-0x0000000000A50000-0x0000000000A58000-memory.dmp

Filesize
32KB

Download
memory/2944-16-0x0000000000A70000-0x0000000000A7C000-memory.dmp

Filesize
48KB

Download
memory/2944-15-0x0000000000A60000-0x0000000000A68000-memory.dmp

Filesize
32KB

Download
memory/2944-13-0x0000000000A40000-0x0000000000A4E000-memory.dmp

Filesize
56KB

Download
memory/2944-12-0x00000000009B0000-0x00000000009BE000-memory.dmp

Filesize
56KB

Download
memory/2944-11-0x00000000009A0000-0x00000000009AA000-memory.dmp

Filesize
40KB

Download
memory/2944-144-0x000007FEF5E30000-0x000007FEF681C000-memory.dmp

Filesize
9.9MB

Download
memory/2944-9-0x0000000000980000-0x000000000098A000-memory.dmp

Filesize
40KB

Download
memory/2944-8-0x0000000000970000-0x0000000000980000-memory.dmp

Filesize
64KB

Download
memory/2944-7-0x00000000006E0000-0x00000000006F6000-memory.dmp

Filesize
88KB

Download
memory/2944-6-0x00000000006D0000-0x00000000006E0000-memory.dmp

Filesize
64KB

Download
memory/2944-5-0x00000000006C0000-0x00000000006C8000-memory.dmp

Filesize
32KB

Download
memory/2944-4-0x00000000006A0000-0x00000000006BC000-memory.dmp

Filesize
112KB

Download
memory/2944-3-0x000000001B4D0000-0x000000001B5FE000-memory.dmp

Filesize
1.2MB

Download
memory/2944-2-0x000007FEF5E30000-0x000007FEF681C000-memory.dmp

Filesize
9.9MB

Download
memory/2996-243-0x0000000000120000-0x0000000000614000-memory.dmp

Filesize
5.0MB

Download