Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2024 00:41
Static task
static1
Behavioral task
behavioral1
Sample
287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe
Resource
win7-20240903-en
General
-
Target
287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe
-
Size
4.9MB
-
MD5
397875ccdde144b8118a6c31e9f2ddf5
-
SHA1
2dd084fb6fcf3f88ec0e377e3d588e72db36a7e7
-
SHA256
287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924
-
SHA512
d596ef357651886280750397c6d46c2cd67c452dd66181ba6cee487c6b8f2780f6e9d7e313809860ff258507d3c05b6c0a13ecdb5527c8be54fb3e4ff84684d7
-
SSDEEP
49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8I:Q
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Colibri family
-
DcRat 57 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process 2908 schtasks.exe 1224 schtasks.exe 1968 schtasks.exe 4748 schtasks.exe 3184 schtasks.exe File created C:\Program Files (x86)\Windows Defender\6203df4a6bafc7 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 3000 schtasks.exe 3972 schtasks.exe 652 schtasks.exe 2036 schtasks.exe 4088 schtasks.exe 4448 schtasks.exe 4628 schtasks.exe 4844 schtasks.exe 2220 schtasks.exe 780 schtasks.exe 400 schtasks.exe 1772 schtasks.exe 808 schtasks.exe 4520 schtasks.exe 4496 schtasks.exe 2044 schtasks.exe 4808 schtasks.exe 2628 schtasks.exe 2480 schtasks.exe 3456 schtasks.exe 3756 schtasks.exe 1460 schtasks.exe File created C:\Program Files\Google\cc11b995f2a76d 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 5060 schtasks.exe 2968 schtasks.exe 3884 schtasks.exe 3368 schtasks.exe 1108 schtasks.exe 4352 schtasks.exe 4180 schtasks.exe 916 schtasks.exe 2288 schtasks.exe 1528 schtasks.exe 1056 schtasks.exe File created C:\Windows\SKB\LanguageModels\9e8d7a4ca61bd9 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 2528 schtasks.exe 3900 schtasks.exe 4992 schtasks.exe 948 schtasks.exe 3756 schtasks.exe 220 schtasks.exe 4224 schtasks.exe 4848 schtasks.exe 2776 schtasks.exe 4184 schtasks.exe 5016 schtasks.exe 1132 schtasks.exe 404 schtasks.exe 1964 schtasks.exe 4688 schtasks.exe 4440 schtasks.exe -
Dcrat family
-
Process spawned unexpected child process 54 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2220 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 400 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 780 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3756 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4844 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2288 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4496 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3972 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3000 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4184 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 652 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4688 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1108 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3184 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3884 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4352 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5016 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2908 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2036 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1132 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 220 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4224 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4848 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1528 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2480 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3368 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5060 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4088 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4180 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 404 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 948 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3456 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3756 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2044 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2528 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4448 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1224 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3900 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1968 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1772 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4808 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1460 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4992 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2968 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2776 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 808 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4520 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 916 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2628 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4628 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4440 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1056 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1964 2772 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4748 2772 schtasks.exe 86 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe -
resource yara_rule behavioral2/memory/1832-2-0x000000001B790000-0x000000001B8BE000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4848 powershell.exe 1756 powershell.exe 1528 powershell.exe 5052 powershell.exe 640 powershell.exe 2380 powershell.exe 2308 powershell.exe 1300 powershell.exe 3316 powershell.exe 1844 powershell.exe 3676 powershell.exe 2628 powershell.exe 1488 powershell.exe 712 powershell.exe 2840 powershell.exe 4472 powershell.exe 4412 powershell.exe 2744 powershell.exe 5092 powershell.exe 3124 powershell.exe 1460 powershell.exe 3952 powershell.exe -
Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation conhost.exe -
Executes dropped EXE 34 IoCs
pid Process 3036 tmp9D4A.tmp.exe 3016 tmp9D4A.tmp.exe 2380 tmp9D4A.tmp.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 836 tmpBB8F.tmp.exe 2704 tmpBB8F.tmp.exe 4196 conhost.exe 4844 tmpFA9C.tmp.exe 4532 tmpFA9C.tmp.exe 4676 conhost.exe 3888 tmp2E5E.tmp.exe 2480 tmp2E5E.tmp.exe 808 conhost.exe 5008 tmp6165.tmp.exe 4532 tmp6165.tmp.exe 2284 tmp6165.tmp.exe 3968 conhost.exe 836 tmp80E3.tmp.exe 3440 tmp80E3.tmp.exe 4240 conhost.exe 4880 tmpB486.tmp.exe 4592 tmpB486.tmp.exe 5008 conhost.exe 3428 tmpE819.tmp.exe 2764 tmpE819.tmp.exe 756 tmpE819.tmp.exe 2052 conhost.exe 1836 conhost.exe 3824 tmp2476.tmp.exe 4832 tmp2476.tmp.exe 3040 conhost.exe 4584 tmp4099.tmp.exe 2564 tmp4099.tmp.exe 1468 tmp4099.tmp.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA conhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA conhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA conhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA conhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe -
Suspicious use of SetThreadContext 10 IoCs
description pid Process procid_target PID 3016 set thread context of 2380 3016 tmp9D4A.tmp.exe 105 PID 836 set thread context of 2704 836 tmpBB8F.tmp.exe 175 PID 4844 set thread context of 4532 4844 tmpFA9C.tmp.exe 213 PID 3888 set thread context of 2480 3888 tmp2E5E.tmp.exe 224 PID 4532 set thread context of 2284 4532 tmp6165.tmp.exe 235 PID 836 set thread context of 3440 836 tmp80E3.tmp.exe 246 PID 4880 set thread context of 4592 4880 tmpB486.tmp.exe 255 PID 2764 set thread context of 756 2764 tmpE819.tmp.exe 265 PID 3824 set thread context of 4832 3824 tmp2476.tmp.exe 281 PID 2564 set thread context of 1468 2564 tmp4099.tmp.exe 290 -
Drops file in Program Files directory 23 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Multimedia Platform\e6c9b481da804f 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\Idle.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File opened for modification C:\Program Files (x86)\Windows Multimedia Platform\OfficeClickToRun.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Program Files\Google\winlogon.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File opened for modification C:\Program Files\Google\winlogon.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Program Files (x86)\Windows Portable Devices\c82b8037eab33d 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Program Files (x86)\Windows Multimedia Platform\OfficeClickToRun.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\WaaSMedicAgent.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\Idle.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\6ccacd8608530f 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File opened for modification C:\Program Files (x86)\Windows Mail\lsass.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Program Files (x86)\Windows Defender\lsass.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Program Files (x86)\Windows Defender\6203df4a6bafc7 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File opened for modification C:\Program Files (x86)\Windows Defender\RCXA405.tmp 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Program Files (x86)\Windows Mail\lsass.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Program Files (x86)\Windows Mail\6203df4a6bafc7 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\088424020bedd6 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Program Files\Google\cc11b995f2a76d 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File opened for modification C:\Program Files\Google\RCXA1F1.tmp 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File opened for modification C:\Program Files (x86)\Windows Defender\lsass.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Program Files (x86)\Windows Portable Devices\WaaSMedicAgent.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\SKB\LanguageModels\RuntimeBroker.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Windows\Offline Web Pages\dllhost.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Windows\Offline Web Pages\5940a34987c991 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Windows\rescache\_merged\backgroundTaskHost.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File opened for modification C:\Windows\Offline Web Pages\dllhost.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Windows\SKB\LanguageModels\9e8d7a4ca61bd9 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File opened for modification C:\Windows\SKB\LanguageModels\RCX9FCD.tmp 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File opened for modification C:\Windows\SKB\LanguageModels\RuntimeBroker.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe File created C:\Windows\LanguageOverlayCache\powershell.exe 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE819.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE819.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp4099.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp9D4A.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp2E5E.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp6165.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp2476.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp9D4A.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpFA9C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpBB8F.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp80E3.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpB486.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp4099.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp6165.tmp.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings conhost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3184 schtasks.exe 3456 schtasks.exe 1056 schtasks.exe 4992 schtasks.exe 4496 schtasks.exe 2908 schtasks.exe 5060 schtasks.exe 4180 schtasks.exe 4520 schtasks.exe 2628 schtasks.exe 400 schtasks.exe 3972 schtasks.exe 1528 schtasks.exe 808 schtasks.exe 220 schtasks.exe 4848 schtasks.exe 4688 schtasks.exe 4448 schtasks.exe 916 schtasks.exe 1968 schtasks.exe 4808 schtasks.exe 2776 schtasks.exe 3000 schtasks.exe 652 schtasks.exe 1108 schtasks.exe 4352 schtasks.exe 4844 schtasks.exe 4224 schtasks.exe 4088 schtasks.exe 1772 schtasks.exe 1964 schtasks.exe 2036 schtasks.exe 1224 schtasks.exe 3900 schtasks.exe 4440 schtasks.exe 2044 schtasks.exe 1460 schtasks.exe 780 schtasks.exe 3884 schtasks.exe 4628 schtasks.exe 4748 schtasks.exe 1132 schtasks.exe 2480 schtasks.exe 3756 schtasks.exe 2288 schtasks.exe 5016 schtasks.exe 948 schtasks.exe 3756 schtasks.exe 2968 schtasks.exe 2220 schtasks.exe 404 schtasks.exe 4184 schtasks.exe 3368 schtasks.exe 2528 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1488 powershell.exe 1488 powershell.exe 1844 powershell.exe 1844 powershell.exe 2628 powershell.exe 2628 powershell.exe 1300 powershell.exe 1300 powershell.exe 3952 powershell.exe 3952 powershell.exe 1756 powershell.exe 1756 powershell.exe 1460 powershell.exe 1460 powershell.exe 712 powershell.exe 712 powershell.exe 2840 powershell.exe 2840 powershell.exe 3676 powershell.exe 3676 powershell.exe 3316 powershell.exe 3316 powershell.exe 1756 powershell.exe 3952 powershell.exe 2628 powershell.exe 1300 powershell.exe 1488 powershell.exe 1844 powershell.exe 712 powershell.exe 1460 powershell.exe 3676 powershell.exe 2840 powershell.exe 3316 powershell.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Token: SeDebugPrivilege 1488 powershell.exe Token: SeDebugPrivilege 1844 powershell.exe Token: SeDebugPrivilege 2628 powershell.exe Token: SeDebugPrivilege 1300 powershell.exe Token: SeDebugPrivilege 3952 powershell.exe Token: SeDebugPrivilege 1756 powershell.exe Token: SeDebugPrivilege 1460 powershell.exe Token: SeDebugPrivilege 712 powershell.exe Token: SeDebugPrivilege 2840 powershell.exe Token: SeDebugPrivilege 3676 powershell.exe Token: SeDebugPrivilege 3316 powershell.exe Token: SeDebugPrivilege 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Token: SeDebugPrivilege 640 powershell.exe Token: SeDebugPrivilege 1528 powershell.exe Token: SeDebugPrivilege 2308 powershell.exe Token: SeDebugPrivilege 4848 powershell.exe Token: SeDebugPrivilege 3124 powershell.exe Token: SeDebugPrivilege 4412 powershell.exe Token: SeDebugPrivilege 2380 powershell.exe Token: SeDebugPrivilege 5052 powershell.exe Token: SeDebugPrivilege 2744 powershell.exe Token: SeDebugPrivilege 4472 powershell.exe Token: SeDebugPrivilege 5092 powershell.exe Token: SeDebugPrivilege 4196 conhost.exe Token: SeDebugPrivilege 4676 conhost.exe Token: SeDebugPrivilege 808 conhost.exe Token: SeDebugPrivilege 3968 conhost.exe Token: SeDebugPrivilege 4240 conhost.exe Token: SeDebugPrivilege 5008 conhost.exe Token: SeDebugPrivilege 2052 conhost.exe Token: SeDebugPrivilege 1836 conhost.exe Token: SeDebugPrivilege 3040 conhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1832 wrote to memory of 3036 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 102 PID 1832 wrote to memory of 3036 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 102 PID 1832 wrote to memory of 3036 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 102 PID 3036 wrote to memory of 3016 3036 tmp9D4A.tmp.exe 104 PID 3036 wrote to memory of 3016 3036 tmp9D4A.tmp.exe 104 PID 3036 wrote to memory of 3016 3036 tmp9D4A.tmp.exe 104 PID 3016 wrote to memory of 2380 3016 tmp9D4A.tmp.exe 105 PID 3016 wrote to memory of 2380 3016 tmp9D4A.tmp.exe 105 PID 3016 wrote to memory of 2380 3016 tmp9D4A.tmp.exe 105 PID 3016 wrote to memory of 2380 3016 tmp9D4A.tmp.exe 105 PID 3016 wrote to memory of 2380 3016 tmp9D4A.tmp.exe 105 PID 3016 wrote to memory of 2380 3016 tmp9D4A.tmp.exe 105 PID 3016 wrote to memory of 2380 3016 tmp9D4A.tmp.exe 105 PID 1832 wrote to memory of 3316 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 109 PID 1832 wrote to memory of 3316 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 109 PID 1832 wrote to memory of 3952 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 110 PID 1832 wrote to memory of 3952 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 110 PID 1832 wrote to memory of 1488 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 111 PID 1832 wrote to memory of 1488 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 111 PID 1832 wrote to memory of 712 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 112 PID 1832 wrote to memory of 712 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 112 PID 1832 wrote to memory of 2628 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 113 PID 1832 wrote to memory of 2628 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 113 PID 1832 wrote to memory of 3676 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 114 PID 1832 wrote to memory of 3676 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 114 PID 1832 wrote to memory of 1844 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 115 PID 1832 wrote to memory of 1844 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 115 PID 1832 wrote to memory of 1300 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 117 PID 1832 wrote to memory of 1300 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 117 PID 1832 wrote to memory of 2840 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 118 PID 1832 wrote to memory of 2840 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 118 PID 1832 wrote to memory of 1756 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 120 PID 1832 wrote to memory of 1756 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 120 PID 1832 wrote to memory of 1460 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 121 PID 1832 wrote to memory of 1460 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 121 PID 1832 wrote to memory of 1436 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 131 PID 1832 wrote to memory of 1436 1832 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 131 PID 1436 wrote to memory of 836 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 173 PID 1436 wrote to memory of 836 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 173 PID 1436 wrote to memory of 836 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 173 PID 836 wrote to memory of 2704 836 tmpBB8F.tmp.exe 175 PID 836 wrote to memory of 2704 836 tmpBB8F.tmp.exe 175 PID 836 wrote to memory of 2704 836 tmpBB8F.tmp.exe 175 PID 836 wrote to memory of 2704 836 tmpBB8F.tmp.exe 175 PID 836 wrote to memory of 2704 836 tmpBB8F.tmp.exe 175 PID 836 wrote to memory of 2704 836 tmpBB8F.tmp.exe 175 PID 836 wrote to memory of 2704 836 tmpBB8F.tmp.exe 175 PID 1436 wrote to memory of 5052 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 181 PID 1436 wrote to memory of 5052 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 181 PID 1436 wrote to memory of 2308 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 182 PID 1436 wrote to memory of 2308 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 182 PID 1436 wrote to memory of 3124 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 183 PID 1436 wrote to memory of 3124 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 183 PID 1436 wrote to memory of 2380 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 184 PID 1436 wrote to memory of 2380 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 184 PID 1436 wrote to memory of 640 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 185 PID 1436 wrote to memory of 640 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 185 PID 1436 wrote to memory of 4472 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 187 PID 1436 wrote to memory of 4472 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 187 PID 1436 wrote to memory of 5092 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 188 PID 1436 wrote to memory of 5092 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 188 PID 1436 wrote to memory of 4848 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 190 PID 1436 wrote to memory of 4848 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 190 PID 1436 wrote to memory of 2744 1436 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe 191 -
System policy modification 1 TTPs 33 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe"C:\Users\Admin\AppData\Local\Temp\287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe"1⤵
- DcRat
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\tmp9D4A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9D4A.tmp.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\tmp9D4A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9D4A.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\tmp9D4A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9D4A.tmp.exe"4⤵
- Executes dropped EXE
PID:2380
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3316
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3952
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1488
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:712
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1844
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460
-
-
C:\Users\Admin\AppData\Local\Temp\287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe"C:\Users\Admin\AppData\Local\Temp\287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\tmpBB8F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBB8F.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\tmpBB8F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBB8F.tmp.exe"4⤵
- Executes dropped EXE
PID:2704
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2380
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4472
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5092
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4848
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1528
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4412
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xTjmO3n2kD.bat"3⤵PID:3320
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:24⤵PID:2240
-
-
C:\Recovery\WindowsRE\conhost.exe"C:\Recovery\WindowsRE\conhost.exe"4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4196 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\157a6be7-d5f3-4c65-b285-fd08dc96cda9.vbs"5⤵PID:4540
-
C:\Recovery\WindowsRE\conhost.exeC:\Recovery\WindowsRE\conhost.exe6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4676 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f938364c-d04a-4406-9583-deb7f23ecc51.vbs"7⤵PID:2984
-
C:\Recovery\WindowsRE\conhost.exeC:\Recovery\WindowsRE\conhost.exe8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:808 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\037aed1a-691a-444c-b856-a29f2bca9b5a.vbs"9⤵PID:3416
-
C:\Recovery\WindowsRE\conhost.exeC:\Recovery\WindowsRE\conhost.exe10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3968 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5750d69d-cbd7-4920-91ad-471b14ce74af.vbs"11⤵PID:640
-
C:\Recovery\WindowsRE\conhost.exeC:\Recovery\WindowsRE\conhost.exe12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4240 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\40ba00df-90f7-4a67-9983-e21b1501edce.vbs"13⤵PID:332
-
C:\Recovery\WindowsRE\conhost.exeC:\Recovery\WindowsRE\conhost.exe14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:5008 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80b804b9-2287-4138-90b9-7b216b57ea4a.vbs"15⤵PID:1096
-
C:\Recovery\WindowsRE\conhost.exeC:\Recovery\WindowsRE\conhost.exe16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2052 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5cf6bacf-2d8e-4153-8bf6-102b92a81622.vbs"17⤵PID:388
-
C:\Recovery\WindowsRE\conhost.exeC:\Recovery\WindowsRE\conhost.exe18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1836 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\46254086-d9d7-4223-98e2-07491ce39ab5.vbs"19⤵PID:1808
-
C:\Recovery\WindowsRE\conhost.exeC:\Recovery\WindowsRE\conhost.exe20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3040 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\40d87f4b-37fe-4f58-b320-364382a9557a.vbs"21⤵PID:4972
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c4651250-57b2-4e30-b672-3f0b9a1dd072.vbs"21⤵PID:2820
-
-
C:\Users\Admin\AppData\Local\Temp\tmp4099.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4099.tmp.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\tmp4099.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4099.tmp.exe"22⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\tmp4099.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4099.tmp.exe"23⤵
- Executes dropped EXE
PID:1468
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2dcb370f-60bf-41e3-ae70-f4338b1ddba2.vbs"19⤵PID:2984
-
-
C:\Users\Admin\AppData\Local\Temp\tmp2476.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2476.tmp.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\tmp2476.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2476.tmp.exe"20⤵
- Executes dropped EXE
PID:4832
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db655fd0-c936-4536-9325-f9fc84b525af.vbs"17⤵PID:2024
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78c59cc3-87ee-48b0-b23d-e543d747c8cd.vbs"15⤵PID:2220
-
-
C:\Users\Admin\AppData\Local\Temp\tmpE819.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE819.tmp.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\tmpE819.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE819.tmp.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\tmpE819.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE819.tmp.exe"17⤵
- Executes dropped EXE
PID:756
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9b39fb21-d167-4946-8fa6-1d551ff1a984.vbs"13⤵PID:2728
-
-
C:\Users\Admin\AppData\Local\Temp\tmpB486.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB486.tmp.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\tmpB486.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB486.tmp.exe"14⤵
- Executes dropped EXE
PID:4592
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2b379774-da51-49fb-a7e7-cd9d72e3d871.vbs"11⤵PID:3308
-
-
C:\Users\Admin\AppData\Local\Temp\tmp80E3.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp80E3.tmp.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:836 -
C:\Users\Admin\AppData\Local\Temp\tmp80E3.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp80E3.tmp.exe"12⤵
- Executes dropped EXE
PID:3440
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38927d96-25fd-4f95-a397-9900faa59c76.vbs"9⤵PID:4412
-
-
C:\Users\Admin\AppData\Local\Temp\tmp6165.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6165.tmp.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\tmp6165.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6165.tmp.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\tmp6165.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6165.tmp.exe"11⤵
- Executes dropped EXE
PID:2284
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d5e973a3-db19-4e67-abea-4a7534d5e81e.vbs"7⤵PID:1304
-
-
C:\Users\Admin\AppData\Local\Temp\tmp2E5E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2E5E.tmp.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\tmp2E5E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2E5E.tmp.exe"8⤵
- Executes dropped EXE
PID:2480
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1461b49a-5792-4dc1-8b52-a1175cd0c201.vbs"5⤵PID:1220
-
-
C:\Users\Admin\AppData\Local\Temp\tmpFA9C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFA9C.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\tmpFA9C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFA9C.tmp.exe"6⤵
- Executes dropped EXE
PID:4532
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:400
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\SKB\LanguageModels\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4844
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\SKB\LanguageModels\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\winlogon.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Google\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3972
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\lsass.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Default\PrintHood\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Default\PrintHood\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\System.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4352
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Links\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Links\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1132
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Links\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4848
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\WaaSMedicAgent.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3368
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4180
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\OfficeClickToRun.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Admin\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\OfficeClickToRun.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3900
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\lsass.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\Offline Web Pages\dllhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\Offline Web Pages\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:916
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\Idle.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4628
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4440
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4748
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924.exe.log
Filesize1KB
MD5bbb951a34b516b66451218a3ec3b0ae1
SHA17393835a2476ae655916e0a9687eeaba3ee876e9
SHA256eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a
SHA51263bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f
-
Filesize
1KB
MD54a667f150a4d1d02f53a9f24d89d53d1
SHA1306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA5124edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD528d4235aa2e6d782751f980ceb6e5021
SHA1f5d82d56acd642b9fc4b963f684fd6b78f25a140
SHA2568c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638
SHA512dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
Filesize
944B
MD5a8e8360d573a4ff072dcc6f09d992c88
SHA13446774433ceaf0b400073914facab11b98b6807
SHA256bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
SHA5124ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe
-
Filesize
944B
MD54c557aa00dc4a6ff86db4be1735e9d30
SHA17c155ad08e280926832bdad0aa948843de2ce5a2
SHA256aad198f453bdcef5e479c7e622c005782f94d0b391798245284aad9506fa7e48
SHA5122c311b272941308197e3f2fe9d961dda9682dfd514cc48bc63b156afb0d18cace8635f0d080b9f77ed43e67b551232a6fb5b86e88c2414f8bd2f32cbe5521ae2
-
Filesize
944B
MD5ea33fe1222c0bc4647737868951b9fe0
SHA1575b4a53baedd0e0e880c1a8f03088c34990fd37
SHA2561863a52e9341cfe488dc4ee7f24a7bf9511607423b6e588581e41a9c144dbf46
SHA512a711fc2818346247df489106fe5fe80aa89eed8f92d0b5ea977c773f50e067de4fa38b130a03464b1d9cb21775dc01e2ff624329c6f97b2ab888854a6bf26e38
-
Filesize
944B
MD53e242d3c4b39d344f66c494424020c61
SHA1194e596f33d54482e7880e91dc05e0d247a46399
SHA256f688037cb0c9f9c97b3b906a6c0636c91ad1864564feb17bba4973cde361172e
SHA51227c1cd6d72554fdce3b960458a1a6bd3f740aa7c22a313a80b043db283a224bf390648b9e59e6bdbf48020d082d728fbde569bee4ee2a610f21d659a7b3dfa02
-
Filesize
944B
MD5120c6c9af4de2accfcff2ed8c3aab1af
SHA1504f64ae4ac9c4fe308a6a50be24fe464f3dad95
SHA256461315e4057c3fa4d0031df3f7e6511914f082698b6c41f5c2ada831ceffb222
SHA512041712168718dff702da8203b4089b2e57db98ce503b8ecf36809dec0cd7a595a0d427caa960bc1bd29cbedc85ad3262773f2077a476b85aca387d48f7b07ba2
-
Filesize
944B
MD5f0a41fc9c1123bb127e55ecc66c8f052
SHA157152411758fa3df2623cc8a4df6d9fea73652f8
SHA256a4fe2be2c449e841f6a12d32114672b097fc1058b6f2971a03521220a0228745
SHA512e3e967adac361ddcf8240cf641f3e77eacfefc61dec725b8ae12e6a94f7d2ebd937fb9eb3cd068a0b3d4306e163dc87773b322bc2dd8b7df93b8103d0e99a900
-
Filesize
944B
MD5a9a7f35c006bbf5da72f9cb250ffbddb
SHA1458a8cedc38dac109631d9fccb3bf6d2c5c0e89e
SHA256a1db56d56e35a6c95f98204e40f69f70422969681d408e5edc4afbf732eef86b
SHA512d341773d30e09214567c65f24cd1854f1e438b8528aa30d35b6baac16e671dde1245edda654f19343b7c160da45985ab53f08453e7f6286e272d544f8741c131
-
Filesize
708B
MD50242ca133076dad2c24c35b6de9d089e
SHA128e7113ed151dafd4f197d926d95069900b519f8
SHA256bebb50f01b58a20c0498a98448819b2e99ad93f2c6391a120ec50861ede98ac2
SHA512377e5a612ab53fd7460d652b224f795f7bbb9589700cc2025a6c7bffef02b9c7d29972ab531f5ef853282b87f6a003e6d6ade01d44d0d42c1a4ccf1398ae13f1
-
Filesize
485B
MD5edc0ceaff70f304f908868a6ac4bde8e
SHA176a601acce1218bfd0613041fd2f5daf461a577d
SHA2564a406a17f6b5a0cad8ce4aff64bbf9c3354c4c33d53813747fb218154a42388c
SHA512c7d7d1bf12539b65ffa784dd1df68dc1f59b9ae5303bc73054e29d952bda39fc465bcecbd69f2b444c53da747c243be3482e90d6753678d333396c06bee2703e
-
Filesize
709B
MD5a1948b71a0b336d366c94c1c96c41b8a
SHA11e1f957486c5619d380ad496249542e43956afa8
SHA256e755663778c46a8271f257c75825ac601d1ce441e9a4c14b5690307cf593e6ec
SHA5126c63bed5e37e060439778d313eb864052711255c87461ea958d23b338cacbb3dbf165c19a070520b0ea0ef934f9a3a2d622d3d485c7fdfb7a0189c16720ea1b9
-
Filesize
709B
MD5958ee5f6c7bdca76aa465ffc5ba8f551
SHA15d3fd18820a885956188686826bb1286f40de500
SHA256e720c13f724a2dd7b015d71b66d8e6c9f4d0f44b13b43d71f787c7017098967d
SHA512d6850051c7884cb31b419f226c911ce9a96f154a8a4fe1b0e2fc2e3d96682451ca84c77ec1611d22fbb3a21d3071f88f1e72c6770cb934d496bbe5ab6eccbc98
-
Filesize
709B
MD5cd4e1ccddbbcf8fb1b2915e1efae6765
SHA1f116f781b3628556eeebf2a5756fc733f677e26a
SHA256f514b0bab60e4f4bb07c0742c479d9cc7e9b6a7b676ffc14d495cca4d02bbe07
SHA512397644899d99150ed98c3e02c729789fe02da1021484db842f8f88a3e18c50b9768a354b83f39397a56e83554276f82ed2f88dfb9ad9c007f7b896a20d6f224f
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
709B
MD5fa3ceb772c8084825a177635ebbe63c0
SHA18093807c51ba9619c7d1276124f1bb03a0a75f72
SHA25642828286448e89dc5db7f1b9552a3444e09aa2830464cf73105dfd1279e1aabe
SHA5129992a52606a326fb6b9875bf66f76f9e83786b33496643530bdf28a5d69c5d3c1892e4850d89baec33f2ef62feb21f880ae9777a79cf5f6533187e8cb2608439
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
Filesize
4.9MB
MD5397875ccdde144b8118a6c31e9f2ddf5
SHA12dd084fb6fcf3f88ec0e377e3d588e72db36a7e7
SHA256287526315843ee93b7fa8dd61f37e9d9be0c6eda8115c17e1fb26af5a16a3924
SHA512d596ef357651886280750397c6d46c2cd67c452dd66181ba6cee487c6b8f2780f6e9d7e313809860ff258507d3c05b6c0a13ecdb5527c8be54fb3e4ff84684d7