colibri | 3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2024 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Size

4.9MB
MD5

2382f8fb2178cff1276f7416428efe5f
SHA1

91516f859638ee108e4c6edb9a2b9a4772e353fc
SHA256

3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168
SHA512

253d4ba57120fbcf9aa908c0aedcca230b4e092b144c008e92372fa61c4cb5f327a73d4d740dce8fb041205c4cef31a0758dba5f08fad0dfcd3f1b287a2e0f1c
SSDEEP

49152:Ll5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2096	schtasks.exe
		732	schtasks.exe
		3176	schtasks.exe
		5068	schtasks.exe
		2064	schtasks.exe
		2608	schtasks.exe
		3196	schtasks.exe
		3468	schtasks.exe
File created	C:\Program Files (x86)\Internet Explorer\es-ES\121e5b5079f7c0		3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\48d9c7ba3e34e1		3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
		3236	schtasks.exe
		4788	schtasks.exe
		2964	schtasks.exe
		2424	schtasks.exe
		2496	schtasks.exe
		1456	schtasks.exe
		1124	schtasks.exe
		2532	schtasks.exe
File created	C:\Windows\Registration\6cb0b6c459d5d3		3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
		920	schtasks.exe
		4780	schtasks.exe
File created	C:\Windows\Offline Web Pages\9e8d7a4ca61bd9		3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
		3288	schtasks.exe
		1432	schtasks.exe
		2168	schtasks.exe
		916	schtasks.exe
		452	schtasks.exe
		3704	schtasks.exe
		5072	schtasks.exe
File created	C:\Program Files\Windows Mail\66fc9ff0ee96c2		3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
		4332	schtasks.exe
		2952	schtasks.exe
		916	schtasks.exe
		4800	schtasks.exe
		3032	schtasks.exe
		2972	schtasks.exe
		3348	schtasks.exe
		4220	schtasks.exe
		1144	schtasks.exe
		952	schtasks.exe
		224	schtasks.exe
		2708	schtasks.exe
		1884	schtasks.exe
		2968	schtasks.exe
		1512	schtasks.exe
		2380	schtasks.exe
		3584	schtasks.exe
		4892	schtasks.exe
File created	C:\Program Files (x86)\Windows Portable Devices\6203df4a6bafc7		3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
		4708	schtasks.exe
		344	schtasks.exe
		3216	schtasks.exe
		1576	schtasks.exe
File created	C:\Program Files\Windows Photo Viewer\ea9f0e6c9e2dcd		3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
		644	schtasks.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\6ccacd8608530f		3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\38384e6a620884		3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
		4724	schtasks.exe
File created	C:\Windows\IME\IMEKR\HELP\5940a34987c991		3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
		3052	schtasks.exe
		828	schtasks.exe
		4828	schtasks.exe
		2536	schtasks.exe
		2836	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3216	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3176	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4828	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3196	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	644	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	732	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3288	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	344	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3236	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1124	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	3496	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	3496	schtasks.exe	86

UAC bypass 3 TTPs 45 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3668-2-0x000000001B4F0000-0x000000001B61E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3892	powershell.exe
4828	powershell.exe
3228	powershell.exe
4292	powershell.exe
4312	powershell.exe
3348	powershell.exe
2644	powershell.exe
3932	powershell.exe
624	powershell.exe
4672	powershell.exe
1768	powershell.exe
2536	powershell.exe
2020	powershell.exe
2004	powershell.exe
1484	powershell.exe
3876	powershell.exe
3172	powershell.exe
1012	powershell.exe
4656	powershell.exe
1012	powershell.exe
4088	powershell.exe
4220	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe

Executes dropped EXE 43 IoCs

pid	Process
3152	tmp9B18.tmp.exe
2660	tmp9B18.tmp.exe
3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
4532	tmpCBBC.tmp.exe
1148	tmpCBBC.tmp.exe
2032	tmpCBBC.tmp.exe
116	Idle.exe
400	tmpE2BF.tmp.exe
5068	tmpE2BF.tmp.exe
2560	Idle.exe
4980	tmp16FE.tmp.exe
4348	tmp16FE.tmp.exe
2884	Idle.exe
3572	tmp34C7.tmp.exe
2668	tmp34C7.tmp.exe
2456	Idle.exe
764	tmp5109.tmp.exe
5112	tmp5109.tmp.exe
3236	Idle.exe
3760	tmp8400.tmp.exe
3740	tmp8400.tmp.exe
3572	Idle.exe
4916	tmpA0B0.tmp.exe
2588	tmpA0B0.tmp.exe
3712	Idle.exe
4964	tmpD126.tmp.exe
2288	tmpD126.tmp.exe
2844	Idle.exe
1860	tmpEC01.tmp.exe
4156	tmpEC01.tmp.exe
2236	Idle.exe
1920	tmp1CA6.tmp.exe
2108	tmp1CA6.tmp.exe
4528	Idle.exe
400	Idle.exe
1644	tmp696E.tmp.exe
1368	tmp696E.tmp.exe
4532	Idle.exe
4332	tmp99E5.tmp.exe
4960	tmp99E5.tmp.exe
4808	Idle.exe
1688	tmpB694.tmp.exe
2836	tmpB694.tmp.exe

Checks whether UAC is enabled 1 TTPs 30 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe

Suspicious use of SetThreadContext 14 IoCs

description	pid	Process	procid_target
PID 3152 set thread context of 2660	3152	tmp9B18.tmp.exe	131
PID 1148 set thread context of 2032	1148	tmpCBBC.tmp.exe	181
PID 400 set thread context of 5068	400	tmpE2BF.tmp.exe	212
PID 4980 set thread context of 4348	4980	tmp16FE.tmp.exe	224
PID 3572 set thread context of 2668	3572	tmp34C7.tmp.exe	235
PID 764 set thread context of 5112	764	tmp5109.tmp.exe	243
PID 3760 set thread context of 3740	3760	tmp8400.tmp.exe	252
PID 4916 set thread context of 2588	4916	tmpA0B0.tmp.exe	261
PID 4964 set thread context of 2288	4964	tmpD126.tmp.exe	271
PID 1860 set thread context of 4156	1860	tmpEC01.tmp.exe	279
PID 1920 set thread context of 2108	1920	tmp1CA6.tmp.exe	288
PID 1644 set thread context of 1368	1644	tmp696E.tmp.exe	302
PID 4332 set thread context of 4960	4332	tmp99E5.tmp.exe	311
PID 1688 set thread context of 2836	1688	tmpB694.tmp.exe	320

Drops file in Program Files directory 34 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\48d9c7ba3e34e1	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCXB10C.tmp	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\sysmon.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\6ccacd8608530f	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files\dotnet\swidtag\088424020bedd6	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\Idle.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCXB535.tmp	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files\Windows Mail\sihost.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files\Windows Mail\66fc9ff0ee96c2	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Program Files\Windows Mail\sihost.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXA688.tmp	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files (x86)\Internet Explorer\es-ES\sysmon.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\es-ES\RCXB321.tmp	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files (x86)\Windows Portable Devices\lsass.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\38384e6a620884	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\es-ES\sysmon.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files\dotnet\swidtag\conhost.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files (x86)\Windows Portable Devices\6203df4a6bafc7	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\taskhostw.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files\Windows Photo Viewer\sysmon.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files\Windows Photo Viewer\121e5b5079f7c0	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\RCXB7B6.tmp	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Program Files\dotnet\swidtag\conhost.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\Idle.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files (x86)\Internet Explorer\es-ES\121e5b5079f7c0	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files\Windows Photo Viewer\ea9f0e6c9e2dcd	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Program Files\Windows Photo Viewer\taskhostw.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Program Files\Windows Mail\RCX9F51.tmp	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\lsass.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\RCXAEF8.tmp	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\IME\IMEKR\HELP\5940a34987c991	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Windows\Registration\dwm.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Windows\es-ES\cc11b995f2a76d	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Windows\System\Speech\wininit.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Windows\Offline Web Pages\9e8d7a4ca61bd9	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Windows\Registration\6cb0b6c459d5d3	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Windows\WaaS\services\Idle.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Windows\Offline Web Pages\RuntimeBroker.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Windows\Registration\dwm.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Windows\Offline Web Pages\RCX9D2D.tmp	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Windows\es-ES\winlogon.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Windows\es-ES\winlogon.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Windows\IME\IMEKR\HELP\dllhost.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Windows\IME\IMEKR\HELP\dllhost.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Windows\Offline Web Pages\RuntimeBroker.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File created	C:\Windows\OCR\it-it\csrss.exe	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Windows\IME\IMEKR\HELP\RCX9B19.tmp	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
File opened for modification	C:\Windows\Registration\RCXA185.tmp	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE2BF.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8400.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpD126.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpCBBC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp16FE.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpEC01.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB694.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp34C7.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5109.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA0B0.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9B18.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpCBBC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1CA6.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp696E.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp99E5.tmp.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4800	schtasks.exe
224	schtasks.exe
3236	schtasks.exe
2968	schtasks.exe
2608	schtasks.exe
3196	schtasks.exe
732	schtasks.exe
4788	schtasks.exe
3348	schtasks.exe
2496	schtasks.exe
1576	schtasks.exe
2836	schtasks.exe
2532	schtasks.exe
4708	schtasks.exe
916	schtasks.exe
4892	schtasks.exe
2096	schtasks.exe
2952	schtasks.exe
2064	schtasks.exe
1512	schtasks.exe
3584	schtasks.exe
344	schtasks.exe
3704	schtasks.exe
2708	schtasks.exe
2424	schtasks.exe
1144	schtasks.exe
3176	schtasks.exe
2964	schtasks.exe
2380	schtasks.exe
952	schtasks.exe
2972	schtasks.exe
5072	schtasks.exe
2168	schtasks.exe
828	schtasks.exe
4724	schtasks.exe
916	schtasks.exe
2536	schtasks.exe
1432	schtasks.exe
1456	schtasks.exe
3216	schtasks.exe
5068	schtasks.exe
4220	schtasks.exe
644	schtasks.exe
3288	schtasks.exe
4780	schtasks.exe
452	schtasks.exe
920	schtasks.exe
3032	schtasks.exe
1124	schtasks.exe
4332	schtasks.exe
3468	schtasks.exe
3052	schtasks.exe
1884	schtasks.exe
4828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3228	powershell.exe
3228	powershell.exe
4828	powershell.exe
4828	powershell.exe
3932	powershell.exe
4656	powershell.exe
3932	powershell.exe
4656	powershell.exe
1012	powershell.exe
1012	powershell.exe
624	powershell.exe
3876	powershell.exe
3876	powershell.exe
624	powershell.exe
2004	powershell.exe
2004	powershell.exe
2020	powershell.exe
2020	powershell.exe
1484	powershell.exe
1484	powershell.exe
2644	powershell.exe
2644	powershell.exe
3228	powershell.exe
1012	powershell.exe
3932	powershell.exe
4828	powershell.exe
4656	powershell.exe
3876	powershell.exe
2020	powershell.exe
2004	powershell.exe
1484	powershell.exe
624	powershell.exe
2644	powershell.exe
3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
4672	powershell.exe
4672	powershell.exe
3348	powershell.exe
3348	powershell.exe
4292	powershell.exe
4292	powershell.exe
2536	powershell.exe
2536	powershell.exe
4088	powershell.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	3228	powershell.exe
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	1012	powershell.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	4292	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	1012	powershell.exe
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeDebugPrivilege	116	Idle.exe
Token: SeDebugPrivilege	2560	Idle.exe
Token: SeDebugPrivilege	2884	Idle.exe
Token: SeDebugPrivilege	2456	Idle.exe
Token: SeDebugPrivilege	3236	Idle.exe
Token: SeDebugPrivilege	3572	Idle.exe
Token: SeDebugPrivilege	3712	Idle.exe
Token: SeDebugPrivilege	2844	Idle.exe
Token: SeDebugPrivilege	2236	Idle.exe
Token: SeDebugPrivilege	4528	Idle.exe
Token: SeDebugPrivilege	400	Idle.exe
Token: SeDebugPrivilege	4532	Idle.exe
Token: SeDebugPrivilege	4808	Idle.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 3152	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	129
PID 3668 wrote to memory of 3152	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	129
PID 3668 wrote to memory of 3152	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	129
PID 3152 wrote to memory of 2660	3152	tmp9B18.tmp.exe	131
PID 3152 wrote to memory of 2660	3152	tmp9B18.tmp.exe	131
PID 3152 wrote to memory of 2660	3152	tmp9B18.tmp.exe	131
PID 3152 wrote to memory of 2660	3152	tmp9B18.tmp.exe	131
PID 3152 wrote to memory of 2660	3152	tmp9B18.tmp.exe	131
PID 3152 wrote to memory of 2660	3152	tmp9B18.tmp.exe	131
PID 3152 wrote to memory of 2660	3152	tmp9B18.tmp.exe	131
PID 3668 wrote to memory of 624	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	140
PID 3668 wrote to memory of 624	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	140
PID 3668 wrote to memory of 3228	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	141
PID 3668 wrote to memory of 3228	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	141
PID 3668 wrote to memory of 4828	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	142
PID 3668 wrote to memory of 4828	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	142
PID 3668 wrote to memory of 3876	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	143
PID 3668 wrote to memory of 3876	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	143
PID 3668 wrote to memory of 1484	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	144
PID 3668 wrote to memory of 1484	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	144
PID 3668 wrote to memory of 2004	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	145
PID 3668 wrote to memory of 2004	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	145
PID 3668 wrote to memory of 2020	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	146
PID 3668 wrote to memory of 2020	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	146
PID 3668 wrote to memory of 3932	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	147
PID 3668 wrote to memory of 3932	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	147
PID 3668 wrote to memory of 1012	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	148
PID 3668 wrote to memory of 1012	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	148
PID 3668 wrote to memory of 2644	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	149
PID 3668 wrote to memory of 2644	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	149
PID 3668 wrote to memory of 4656	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	150
PID 3668 wrote to memory of 4656	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	150
PID 3668 wrote to memory of 3044	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	163
PID 3668 wrote to memory of 3044	3668	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	163
PID 3044 wrote to memory of 4532	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	178
PID 3044 wrote to memory of 4532	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	178
PID 3044 wrote to memory of 4532	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	178
PID 4532 wrote to memory of 1148	4532	tmpCBBC.tmp.exe	180
PID 4532 wrote to memory of 1148	4532	tmpCBBC.tmp.exe	180
PID 4532 wrote to memory of 1148	4532	tmpCBBC.tmp.exe	180
PID 1148 wrote to memory of 2032	1148	tmpCBBC.tmp.exe	181
PID 1148 wrote to memory of 2032	1148	tmpCBBC.tmp.exe	181
PID 1148 wrote to memory of 2032	1148	tmpCBBC.tmp.exe	181
PID 1148 wrote to memory of 2032	1148	tmpCBBC.tmp.exe	181
PID 1148 wrote to memory of 2032	1148	tmpCBBC.tmp.exe	181
PID 1148 wrote to memory of 2032	1148	tmpCBBC.tmp.exe	181
PID 1148 wrote to memory of 2032	1148	tmpCBBC.tmp.exe	181
PID 3044 wrote to memory of 4292	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	182
PID 3044 wrote to memory of 4292	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	182
PID 3044 wrote to memory of 4088	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	183
PID 3044 wrote to memory of 4088	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	183
PID 3044 wrote to memory of 1012	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	184
PID 3044 wrote to memory of 1012	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	184
PID 3044 wrote to memory of 3348	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	185
PID 3044 wrote to memory of 3348	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	185
PID 3044 wrote to memory of 4672	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	186
PID 3044 wrote to memory of 4672	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	186
PID 3044 wrote to memory of 3172	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	187
PID 3044 wrote to memory of 3172	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	187
PID 3044 wrote to memory of 2536	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	189
PID 3044 wrote to memory of 2536	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	189
PID 3044 wrote to memory of 3892	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	190
PID 3044 wrote to memory of 3892	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	190
PID 3044 wrote to memory of 4220	3044	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe	194

System policy modification 1 TTPs 45 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
"C:\Users\Admin\AppData\Local\Temp\3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe"
1⤵
- DcRat
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3668
- C:\Users\Admin\AppData\Local\Temp\tmp9B18.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp9B18.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Users\Admin\AppData\Local\Temp\tmp9B18.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp9B18.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:2660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4656
- C:\Users\Admin\AppData\Local\Temp\3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe
  "C:\Users\Admin\AppData\Local\Temp\3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3044
- - C:\Users\Admin\AppData\Local\Temp\tmpCBBC.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpCBBC.tmp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\tmpCBBC.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpCBBC.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\tmpCBBC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCBBC.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:2032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4312
- - C:\Users\All Users\Idle.exe
    "C:\Users\All Users\Idle.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:116
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26d73225-f90f-442f-9468-0d4630e60b5e.vbs"
      4⤵
      PID:2564
    - - C:\Users\All Users\Idle.exe
        
        "C:\Users\All Users\Idle.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2560
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e378230-1cb3-49d8-8ae0-afa7271f9cfe.vbs"
        6⤵
        
        PID:2380
        
        C:\Users\All Users\Idle.exe
        
        "C:\Users\All Users\Idle.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bbccd969-b7f7-45ae-8b7f-d004b33f8afa.vbs"
        8⤵
        
        PID:4292
        
        C:\Users\All Users\Idle.exe
        
        "C:\Users\All Users\Idle.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2456
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7eb87086-3506-4786-831c-211ea9db7757.vbs"
        10⤵
        
        PID:2388
        
        C:\Users\All Users\Idle.exe
        
        "C:\Users\All Users\Idle.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3236
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f6ca9398-df74-4d0a-af4c-cd8f4904f84c.vbs"
        12⤵
        
        PID:2524
        
        C:\Users\All Users\Idle.exe
        
        "C:\Users\All Users\Idle.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3572
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\58f62781-8546-4500-a184-f194f0fa1610.vbs"
        14⤵
        
        PID:1940
        
        C:\Users\All Users\Idle.exe
        
        "C:\Users\All Users\Idle.exe"
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3712
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9362690-918a-45f5-8fff-ce86c51e177f.vbs"
        16⤵
        
        PID:4196
        
        C:\Users\All Users\Idle.exe
        
        "C:\Users\All Users\Idle.exe"
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44348a46-4460-4e12-b7a1-589c1d03244c.vbs"
        18⤵
        
        PID:3552
        
        C:\Users\All Users\Idle.exe
        
        "C:\Users\All Users\Idle.exe"
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2236
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\63c4eac5-e182-45f6-b188-a18c413466b4.vbs"
        20⤵
        
        PID:3560
        
        C:\Users\All Users\Idle.exe
        
        "C:\Users\All Users\Idle.exe"
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4528
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e263f4e-aed9-4ee0-a1b8-e631d3136573.vbs"
        22⤵
        
        PID:4952
        
        C:\Users\All Users\Idle.exe
        
        "C:\Users\All Users\Idle.exe"
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:400
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5cabbad5-a2fa-443a-a288-be4d3d62b856.vbs"
        24⤵
        
        PID:4728
        
        C:\Users\All Users\Idle.exe
        
        "C:\Users\All Users\Idle.exe"
        25⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4532
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a79dd4dd-5abc-4b5b-a15c-2198ec5223f4.vbs"
        26⤵
        
        PID:4856
        
        C:\Users\All Users\Idle.exe
        
        "C:\Users\All Users\Idle.exe"
        27⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4c492d51-24d5-4808-8ef5-4cf89133d06f.vbs"
        28⤵
        
        PID:344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7e6ec47-8012-48aa-b7bf-86164b295f87.vbs"
        28⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\tmpB694.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpB694.tmp.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\tmpB694.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpB694.tmp.exe"
        29⤵
        Executes dropped EXE
        
        PID:2836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\25edca65-2c5d-479a-885c-12a276c77fb4.vbs"
        26⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\tmp99E5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp99E5.tmp.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\tmp99E5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp99E5.tmp.exe"
        27⤵
        Executes dropped EXE
        
        PID:4960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\250c7bb3-70ab-426d-984a-a49fb9583686.vbs"
        24⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\tmp696E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp696E.tmp.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\tmp696E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp696E.tmp.exe"
        25⤵
        Executes dropped EXE
        
        PID:1368
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9523f4df-c46f-4e97-a284-6d7b4a3be482.vbs"
        22⤵
        
        PID:4996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e9b3f9ce-7a23-4965-85e7-f20d5cf98494.vbs"
        20⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\tmp1CA6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1CA6.tmp.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\tmp1CA6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1CA6.tmp.exe"
        21⤵
        Executes dropped EXE
        
        PID:2108
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76b69431-79f7-4397-966d-a145143c50eb.vbs"
        18⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\tmpEC01.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpEC01.tmp.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\tmpEC01.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpEC01.tmp.exe"
        19⤵
        Executes dropped EXE
        
        PID:4156
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a30f534e-4744-4f90-a309-f72904519eac.vbs"
        16⤵
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\tmpD126.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD126.tmp.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\tmpD126.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD126.tmp.exe"
        17⤵
        Executes dropped EXE
        
        PID:2288
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\01ea3d1d-ef61-4f86-8122-724885ddf2af.vbs"
        14⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\tmpA0B0.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA0B0.tmp.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\tmpA0B0.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA0B0.tmp.exe"
        15⤵
        Executes dropped EXE
        
        PID:2588
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc1145af-49f9-4926-bde7-edb1fce065d1.vbs"
        12⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\tmp8400.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8400.tmp.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\tmp8400.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8400.tmp.exe"
        13⤵
        Executes dropped EXE
        
        PID:3740
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91e2d1d7-374d-4f35-bfad-4965b0d57a27.vbs"
        10⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\tmp5109.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5109.tmp.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\tmp5109.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5109.tmp.exe"
        11⤵
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8fe2602-767a-4b47-857d-f0de833535cf.vbs"
        8⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\tmp34C7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp34C7.tmp.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\tmp34C7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp34C7.tmp.exe"
        9⤵
        Executes dropped EXE
        
        PID:2668
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\86b70446-976e-4f64-b3b8-6409cab954f9.vbs"
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\tmp16FE.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp16FE.tmp.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\tmp16FE.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp16FE.tmp.exe"
        7⤵
        Executes dropped EXE
        
        PID:4348
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\46b5f1b7-e386-401e-84ff-4f52d8b1ba0a.vbs"
      4⤵
      PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\tmpE2BF.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpE2BF.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:400
    - - C:\Users\Admin\AppData\Local\Temp\tmpE2BF.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE2BF.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\IME\IMEKR\HELP\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\IME\IMEKR\HELP\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\IME\IMEKR\HELP\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\Offline Web Pages\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\Offline Web Pages\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Mail\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Windows\Registration\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Registration\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\Registration\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Default\SendTo\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\SendTo\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Default\SendTo\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f1683" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f1683" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Photo Viewer\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files\dotnet\swidtag\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files\dotnet\swidtag\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Photo Viewer\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Windows\es-ES\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Windows\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Photo Viewer\taskhostw.exe

Filesize
4.9MB

MD5
9058e68ce038eb947438a1f6e29de40f

SHA1
884b626acab0cb2b7cc5d84644a6c7046821820d

SHA256
85722d6ae54124b990ee1fa8f6e6ca2dfa1fab4b82d5261b7939a305b72356f9

SHA512
e95ef28d5939460f8dcf65501eafd0c04e7542f1d82211e250174adfb3a62e675638b3bcf9c0a85394d19f2b180af194d2d1703d895ca864487e93f6d50d2cb9

Download Submit
C:\Recovery\WindowsRE\Registry.exe

Filesize
4.9MB

MD5
2382f8fb2178cff1276f7416428efe5f

SHA1
91516f859638ee108e4c6edb9a2b9a4772e353fc

SHA256
3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168

SHA512
253d4ba57120fbcf9aa908c0aedcca230b4e092b144c008e92372fa61c4cb5f327a73d4d740dce8fb041205c4cef31a0758dba5f08fad0dfcd3f1b287a2e0f1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\3b0bfc76e77381bd51ad9646795ba7c7dc46d0f98d9e1f9f56ade8936539f168.exe.log

Filesize
1KB

MD5
bbb951a34b516b66451218a3ec3b0ae1

SHA1
7393835a2476ae655916e0a9687eeaba3ee876e9

SHA256
eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a

SHA512
63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Idle.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e448fe0d240184c6597a31d3be2ced58

SHA1
372b8d8c19246d3e38cd3ba123cc0f56070f03cd

SHA256
c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

SHA512
0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
21bfc799247c23be8c83723a21d31bb5

SHA1
53b308a69a2e57ce004951c978ea8e008e29ca56

SHA256
eab1228d3d5af575fdf617768fdd5371ca706e4f48a8f9f4583b58663fbc5be3

SHA512
19e9ed32a3c302ea7d4ff23df4f6dfc7ba72775e18ce47f284db22f9059309448d77fd123984adcef11e647403a01f3cf45bd463857af77ae882be885001e746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b7b47377bcaba7a045dc11be31f711b3

SHA1
c915578f1139e3d0ca94d8ea73a17698771400e8

SHA256
23d457e05f8b8fc47e6617fee28d04a7e6fab993751b94514c9308e387c95a1a

SHA512
be381612f831f820e7fb04fa94c7a61954f4bba3d1b2d1112e455b41a6e9322b35e75311fbf24d5ff541a73d56bf79976e1462fee06d337341ad0953325636a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8d9b95fdab142bb52f794b152e9b8230

SHA1
badb1d4568eb62dca12181d0c7fb093779c9a4de

SHA256
b2b0ff5c6f0f0bbe286910bc2424d7b747fce3b7d7609cc6434aea99372aaa39

SHA512
3f05056bdec2e72f1342f45639c5a89aa175a3a4fdb8494dda31b346faf970b10cc0ab322533514d8f5b591e051a2a35595b0448918e25dbbc6cf02854276b1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
87cb564705472f8a13c922cf687ea4f9

SHA1
f99d3c7696fa8efbdb8ed01aaab4083c5c03f890

SHA256
2708941e880982f7ff2513c1bd93f8f08a560c8771e4cdcd8d32fa9e3ce5a00d

SHA512
5429619aadaf56558f40b47a7c131343ae70fb254c67f0a52eb0c7a319480fc3a33cb5460bdc41ccf964086b9d78b97345c6b759f57cc9224a095f041e645241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b740f7616c3c3d006afd7e1586758eeb

SHA1
c465af4c07ecb9e3de239c410d3b2ed5de93cdde

SHA256
c11b84252afa74e4f323fcbae853cb45217a65d70ac44dea182f9ec872bd9872

SHA512
d4dd7531d48a9f6d6432fe0d55cefc76139566c54514ba722d76e5bd4371bfca0e491939795883de21901eac98b1af7236ea83281a7dde8befe16719993f185e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2262839c93970e05099a4a7d8d6bf51b

SHA1
5bdc2124f4d84180ab974594fc5d0acce89e02bc

SHA256
df5987de92b53918f66a554e5599a52da01e174b13cd27ac4ba9b12e5b402a65

SHA512
b2c74af14d5f73122c881a2e3e8e94df5c38bc116c837052e21384a3b20167d7746a86680ce88b22e477117924b2fba5d4748135dbd96448e85b77c8bdaf9e1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4345955c1b5cc2f2c8a6923e677f6a61

SHA1
572a46a5fa74524df83da70b00f40ddb81b5b432

SHA256
14178c711c1c432e590041f1c4e426b664b07b1c3aad6c84b352677330ce3fef

SHA512
6bc29254e9aa6e12b353979f4e3b7689fe586bdcc6a6605f540b9202ab70c7b6c1cf28b25d7d69e8569917b183f62f0f40c8689e9e5d0134b2b6f1c306cbd2b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\26d73225-f90f-442f-9468-0d4630e60b5e.vbs

Filesize
702B

MD5
78ee09a4e6ace239968d56351e09f2d2

SHA1
afb9561c576a496d336120a0b4ac34db238027b3

SHA256
61708d17da081ca03cbc6bef018cffceb4293904289c4cbd2c09d45313b79c54

SHA512
815de7e3b258cb2fe33d79d5daaa41542b81059814c48a643fc6522fcfca0aaf55b9c649935414c80b48900f0925c46a9bc395b53115fdda9e61deea93d44854

Download Submit
C:\Users\Admin\AppData\Local\Temp\3e378230-1cb3-49d8-8ae0-afa7271f9cfe.vbs

Filesize
703B

MD5
5479602b5c419e4315b901a7d1d4ba62

SHA1
5dc1e0ed06098a1d85f6649172d0389dc4b8ea16

SHA256
908079db9ab8610fc25d5adef0d6c32b3b60891236f7a719fd7c4689fa481051

SHA512
109d05bcfaa1ea13ff14af39edba97ea9a1af38131f9cb7abe548dcf3ce69afd3852763bb052d048b2d3a77eeb7149ff478ab57ff65779572fc7c71b92f498dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\46b5f1b7-e386-401e-84ff-4f52d8b1ba0a.vbs

Filesize
479B

MD5
5a1215868e76ac4abc136400689681e6

SHA1
f6f5baaf5a016cb3de15dae91e6023b6676cfb79

SHA256
35dc5f297f7311f72edf0dacd58e91727e67c49c5034a09b311c28b66b903c45

SHA512
ea53ce7df704488449aea30175dd5e519f4757221970a74ade9f1d10cca5fc1d6714e9160ca9dc8fc06fac9cf7db9e79272033a12a7bc4e2b277aa9a2b1f950b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7eb87086-3506-4786-831c-211ea9db7757.vbs

Filesize
703B

MD5
74bff4d31c4352739d124f2baaf72fc1

SHA1
fb514b642145ece0dce68d656be3eea2872e3fc1

SHA256
f097dc8a8cecde89c86ddb4b898c37b0bbaca6c8106b71dd99361a9a420611a8

SHA512
b351659202f510cc166c5b2189221ef8643b2955a698aa524c934b01881f3a3901b1d3f5f225b43215304b93090c2037172ccdbcf28cdddcd0ce108e8a72924a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vvzyp4up.elf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bbccd969-b7f7-45ae-8b7f-d004b33f8afa.vbs

Filesize
703B

MD5
86c95f90d64e0a48da536acce3b68549

SHA1
b016b96c2fcdc56634294e035a524baa337a1c86

SHA256
dcddd158de6d0f344d58f82188585d456682c1f5c2e15018d6d1cea6a20922bf

SHA512
6937e80deea2a8865ac8f263ad9e6acb73627fbfbff9879068be8ee8d3efac711c280961119d04a0b5d753dc7c448194e5827f5eb9a9940de593704f9cbe82dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\f6ca9398-df74-4d0a-af4c-cd8f4904f84c.vbs

Filesize
703B

MD5
1517e34725e2ad3dcbc88d89836783d0

SHA1
17bc18ed856c7a814e75936a43234a446d0ca20b

SHA256
9cf03321e8ff000819c3eb6c62c8fe834f63839d02a0e4df1f94a1b8cc90f371

SHA512
f2d3f1fb07f7396e60e13c475f8069d943b53a60bc117e8bf6a160e3783d3c818f6bbf96c5289413bc2b4d0e62b421c1396aaf86ded0aa87d94c0de080fa508e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9B18.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
memory/2456-568-0x000000001BF50000-0x000000001BF62000-memory.dmp

Filesize
72KB

Download
memory/2660-66-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3044-264-0x000000001BF20000-0x000000001BF32000-memory.dmp

Filesize
72KB

Download
memory/3228-171-0x00000181A3D40000-0x00000181A3D62000-memory.dmp

Filesize
136KB

Download
memory/3572-611-0x0000000002BC0000-0x0000000002BD2000-memory.dmp

Filesize
72KB

Download
memory/3668-14-0x000000001B4C0000-0x000000001B4CE000-memory.dmp

Filesize
56KB

Download
memory/3668-6-0x00000000012B0000-0x00000000012B8000-memory.dmp

Filesize
32KB

Download
memory/3668-16-0x000000001B620000-0x000000001B628000-memory.dmp

Filesize
32KB

Download
memory/3668-12-0x000000001C190000-0x000000001C6B8000-memory.dmp

Filesize
5.2MB

Download
memory/3668-13-0x000000001B4B0000-0x000000001B4BA000-memory.dmp

Filesize
40KB

Download
memory/3668-15-0x000000001B4D0000-0x000000001B4DE000-memory.dmp

Filesize
56KB

Download
memory/3668-152-0x00007FFA5DF40000-0x00007FFA5EA01000-memory.dmp

Filesize
10.8MB

Download
memory/3668-11-0x000000001B450000-0x000000001B462000-memory.dmp

Filesize
72KB

Download
memory/3668-10-0x000000001B440000-0x000000001B44A000-memory.dmp

Filesize
40KB

Download
memory/3668-8-0x000000001B410000-0x000000001B426000-memory.dmp

Filesize
88KB

Download
memory/3668-9-0x000000001B430000-0x000000001B440000-memory.dmp

Filesize
64KB

Download
memory/3668-17-0x000000001B630000-0x000000001B638000-memory.dmp

Filesize
32KB

Download
memory/3668-7-0x0000000001320000-0x0000000001330000-memory.dmp

Filesize
64KB

Download
memory/3668-5-0x000000001B460000-0x000000001B4B0000-memory.dmp

Filesize
320KB

Download
memory/3668-4-0x0000000001290000-0x00000000012AC000-memory.dmp

Filesize
112KB

Download
memory/3668-2-0x000000001B4F0000-0x000000001B61E000-memory.dmp

Filesize
1.2MB

Download
memory/3668-3-0x00007FFA5DF40000-0x00007FFA5EA01000-memory.dmp

Filesize
10.8MB

Download
memory/3668-18-0x000000001B640000-0x000000001B64C000-memory.dmp

Filesize
48KB

Download
memory/3668-263-0x00007FFA5DF40000-0x00007FFA5EA01000-memory.dmp

Filesize
10.8MB

Download
memory/3668-1-0x00000000001B0000-0x00000000006A4000-memory.dmp

Filesize
5.0MB

Download
memory/3668-0-0x00007FFA5DF43000-0x00007FFA5DF45000-memory.dmp

Filesize
8KB

Download
memory/3668-138-0x00007FFA5DF43000-0x00007FFA5DF45000-memory.dmp

Filesize
8KB

Download