dcrat | a7f4c48301ad6b01c8777427eaceb965a9e0c14d493f44d1dea4f8d498123469

Processes:

2d756772bc00e5778d794c107358ddf7.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\spoolsv.exe\""	2d756772bc00e5778d794c107358ddf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\spoolsv.exe\", \"C:\\Windows\\CSC\\lsass.exe\""	2d756772bc00e5778d794c107358ddf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\spoolsv.exe\", \"C:\\Windows\\CSC\\lsass.exe\", \"C:\\Program Files\\Common Files\\services.exe\""	2d756772bc00e5778d794c107358ddf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\spoolsv.exe\", \"C:\\Windows\\CSC\\lsass.exe\", \"C:\\Program Files\\Common Files\\services.exe\", \"C:\\Program Files (x86)\\Common Files\\Services\\dllhost.exe\""	2d756772bc00e5778d794c107358ddf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\spoolsv.exe\", \"C:\\Windows\\CSC\\lsass.exe\", \"C:\\Program Files\\Common Files\\services.exe\", \"C:\\Program Files (x86)\\Common Files\\Services\\dllhost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\locale\\lsm.exe\""	2d756772bc00e5778d794c107358ddf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\spoolsv.exe\", \"C:\\Windows\\CSC\\lsass.exe\", \"C:\\Program Files\\Common Files\\services.exe\", \"C:\\Program Files (x86)\\Common Files\\Services\\dllhost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\locale\\lsm.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\2d756772bc00e5778d794c107358ddf7.exe\""	2d756772bc00e5778d794c107358ddf7.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2744	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2744	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2744	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2744	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2744	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2744	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	2744	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	2744	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	2744	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	2744	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	736	2744	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	2744	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	2744	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	2744	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2744	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2744	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2744	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2744	schtasks.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

668 powershell.exe
1180 powershell.exe
1004 powershell.exe
448 powershell.exe
2840 powershell.exe
2912 powershell.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
668	powershell.exe
1180	powershell.exe
1004	powershell.exe
448	powershell.exe
2840	powershell.exe
2912	powershell.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

2d756772bc00e5778d794c107358ddf7.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files\\VideoLAN\\VLC\\locale\\lsm.exe\""	2d756772bc00e5778d794c107358ddf7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\2d756772bc00e5778d794c107358ddf7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2d756772bc00e5778d794c107358ddf7.exe\""	2d756772bc00e5778d794c107358ddf7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\spoolsv.exe\""	2d756772bc00e5778d794c107358ddf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\spoolsv.exe\""	2d756772bc00e5778d794c107358ddf7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\CSC\\lsass.exe\""	2d756772bc00e5778d794c107358ddf7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Common Files\\services.exe\""	2d756772bc00e5778d794c107358ddf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Common Files\\Services\\dllhost.exe\""	2d756772bc00e5778d794c107358ddf7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files\\VideoLAN\\VLC\\locale\\lsm.exe\""	2d756772bc00e5778d794c107358ddf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2d756772bc00e5778d794c107358ddf7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2d756772bc00e5778d794c107358ddf7.exe\""	2d756772bc00e5778d794c107358ddf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\CSC\\lsass.exe\""	2d756772bc00e5778d794c107358ddf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Common Files\\services.exe\""	2d756772bc00e5778d794c107358ddf7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Common Files\\Services\\dllhost.exe\""	2d756772bc00e5778d794c107358ddf7.exe

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 ipinfo.io
12 ipinfo.io
13 ipinfo.io
4 ipinfo.io

flow	ioc
5	ipinfo.io
12	ipinfo.io
13	ipinfo.io
4	ipinfo.io

Drops file in System32 directory 2 IoCs

Processes:

csc.exe

description	ioc	process
File created	\??\c:\Windows\System32\1woi1z.exe	csc.exe
File created	\??\c:\Windows\System32\CSC98926D0DB380478F9AFBB0671A84CA8.TMP	csc.exe

Drops file in Program Files directory 9 IoCs

Processes:

2d756772bc00e5778d794c107358ddf7.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Services\5940a34987c991	2d756772bc00e5778d794c107358ddf7.exe
File created	C:\Program Files\Common Files\services.exe	2d756772bc00e5778d794c107358ddf7.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\f3b6ecef712a24	2d756772bc00e5778d794c107358ddf7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lsm.exe	2d756772bc00e5778d794c107358ddf7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lsm.exe	2d756772bc00e5778d794c107358ddf7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\101b941d020240	2d756772bc00e5778d794c107358ddf7.exe
File created	C:\Program Files (x86)\Common Files\Services\dllhost.exe	2d756772bc00e5778d794c107358ddf7.exe
File created	C:\Program Files\Common Files\c5b4cb5e9653cc	2d756772bc00e5778d794c107358ddf7.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\spoolsv.exe	2d756772bc00e5778d794c107358ddf7.exe

Drops file in Windows directory 3 IoCs

Processes:

2d756772bc00e5778d794c107358ddf7.exe

description	ioc	process
File created	C:\Windows\CSC\6203df4a6bafc7	2d756772bc00e5778d794c107358ddf7.exe
File created	C:\Windows\servicing\ja-JP\dwm.exe	2d756772bc00e5778d794c107358ddf7.exe
File created	C:\Windows\CSC\lsass.exe	2d756772bc00e5778d794c107358ddf7.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

496 PING.EXE

pid	process
496	PING.EXE

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

2d756772bc00e5778d794c107358ddf7.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2d756772bc00e5778d794c107358ddf7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2d756772bc00e5778d794c107358ddf7.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

496 PING.EXE

pid	process
496	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2848	schtasks.exe
2884	schtasks.exe
1192	schtasks.exe
736	schtasks.exe
948	schtasks.exe
1564	schtasks.exe
2696	schtasks.exe
2828	schtasks.exe
1928	schtasks.exe
3064	schtasks.exe
2592	schtasks.exe
680	schtasks.exe
1636	schtasks.exe
388	schtasks.exe
2684	schtasks.exe
2624	schtasks.exe
1848	schtasks.exe
544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2d756772bc00e5778d794c107358ddf7.exe

pid	process
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe
2012	2d756772bc00e5778d794c107358ddf7.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

2d756772bc00e5778d794c107358ddf7.exe

pid process

2628 2d756772bc00e5778d794c107358ddf7.exe

pid	process
2628	2d756772bc00e5778d794c107358ddf7.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

2d756772bc00e5778d794c107358ddf7.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe2d756772bc00e5778d794c107358ddf7.exe

description	pid	process
Token: SeDebugPrivilege	2012	2d756772bc00e5778d794c107358ddf7.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeDebugPrivilege	2628	2d756772bc00e5778d794c107358ddf7.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

2d756772bc00e5778d794c107358ddf7.execsc.execmd.exe

description	pid	process	target process
PID 2012 wrote to memory of 2772	2012	2d756772bc00e5778d794c107358ddf7.exe	csc.exe
PID 2012 wrote to memory of 2772	2012	2d756772bc00e5778d794c107358ddf7.exe	csc.exe
PID 2012 wrote to memory of 2772	2012	2d756772bc00e5778d794c107358ddf7.exe	csc.exe
PID 2772 wrote to memory of 2664	2772	csc.exe	cvtres.exe
PID 2772 wrote to memory of 2664	2772	csc.exe	cvtres.exe
PID 2772 wrote to memory of 2664	2772	csc.exe	cvtres.exe
PID 2012 wrote to memory of 1004	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 1004	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 1004	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 448	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 448	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 448	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 1180	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 1180	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 1180	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 668	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 668	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 668	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 2912	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 2912	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 2912	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 2840	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 2840	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 2840	2012	2d756772bc00e5778d794c107358ddf7.exe	powershell.exe
PID 2012 wrote to memory of 1884	2012	2d756772bc00e5778d794c107358ddf7.exe	cmd.exe
PID 2012 wrote to memory of 1884	2012	2d756772bc00e5778d794c107358ddf7.exe	cmd.exe
PID 2012 wrote to memory of 1884	2012	2d756772bc00e5778d794c107358ddf7.exe	cmd.exe
PID 1884 wrote to memory of 3040	1884	cmd.exe	chcp.com
PID 1884 wrote to memory of 3040	1884	cmd.exe	chcp.com
PID 1884 wrote to memory of 3040	1884	cmd.exe	chcp.com
PID 1884 wrote to memory of 496	1884	cmd.exe	PING.EXE
PID 1884 wrote to memory of 496	1884	cmd.exe	PING.EXE
PID 1884 wrote to memory of 496	1884	cmd.exe	PING.EXE
PID 1884 wrote to memory of 2628	1884	cmd.exe	2d756772bc00e5778d794c107358ddf7.exe
PID 1884 wrote to memory of 2628	1884	cmd.exe	2d756772bc00e5778d794c107358ddf7.exe
PID 1884 wrote to memory of 2628	1884	cmd.exe	2d756772bc00e5778d794c107358ddf7.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2d756772bc00e5778d794c107358ddf7.exe
"C:\Users\Admin\AppData\Local\Temp\2d756772bc00e5778d794c107358ddf7.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yik5yx0m\yik5yx0m.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEA20.tmp" "c:\Windows\System32\CSC98926D0DB380478F9AFBB0671A84CA8.TMP"
    3⤵
    PID:2664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CSC\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Services\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\locale\lsm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2d756772bc00e5778d794c107358ddf7.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CKLuGQOPwA.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3040
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:496
- - C:\Users\Admin\AppData\Local\Temp\2d756772bc00e5778d794c107358ddf7.exe
    "C:\Users\Admin\AppData\Local\Temp\2d756772bc00e5778d794c107358ddf7.exe"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\CSC\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\CSC\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\CSC\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files\Common Files\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Common Files\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Services\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Services\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\VLC\locale\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\locale\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\locale\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2d756772bc00e5778d794c107358ddf72" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\2d756772bc00e5778d794c107358ddf7.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2d756772bc00e5778d794c107358ddf7" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\2d756772bc00e5778d794c107358ddf7.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2d756772bc00e5778d794c107358ddf72" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\2d756772bc00e5778d794c107358ddf7.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

3

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System