dcrat | af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 18:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
Size

1.7MB
MD5

6d41ecedcce80f8c3fa81d06041101e8
SHA1

a0c354fc73043792e994309472a61ddb35144a0d
SHA256

af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd
SHA512

874a83462cbc5ac0f71b0b18ab07a284106cdbfb19f170c83bc954cf1b017634e57374971df1f1a4ac33b24d91ebb234fcff80de5bd94a74a144f84c205557d5
SSDEEP

24576:N3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJz:NgwuuEpdDLNwVMeXDL0fdSzAGM

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3416	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3092	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3124	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	744	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3208	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	32	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	100	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1212	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5084	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	360	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	928	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3860	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	576	4148	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	4148	schtasks.exe	86

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2752-1-0x0000000000D50000-0x0000000000F06000-memory.dmp	dcrat
behavioral2/files/0x0007000000023ccc-29.dat	dcrat
behavioral2/files/0x0008000000022af2-156.dat	dcrat
behavioral2/files/0x0010000000023b8e-180.dat	dcrat
behavioral2/files/0x000d000000023b91-215.dat	dcrat
behavioral2/files/0x000a000000023cec-277.dat	dcrat
behavioral2/memory/1368-440-0x0000000000A80000-0x0000000000C36000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3156	powershell.exe
3120	powershell.exe
2120	powershell.exe
4904	powershell.exe
4504	powershell.exe
4344	powershell.exe
2916	powershell.exe
2252	powershell.exe
1932	powershell.exe
640	powershell.exe
2688	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	lsass.exe

Executes dropped EXE 2 IoCs

pid	Process
1368	lsass.exe
3280	lsass.exe

Drops file in Program Files directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\uk-UA\Idle.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCXF5B7.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\backgroundTaskHost.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File created	C:\Program Files (x86)\Windows Media Player\uk-UA\Idle.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File created	C:\Program Files\VideoLAN\VLC\skins\smss.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\27d1bcfc3c54e0	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\RCXED42.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\uk-UA\RCXF18C.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\RCX5E1.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File created	C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\uk-UA\RCXF18D.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File created	C:\Program Files\Windows Multimedia Platform\ee2ad38f3d4382	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\backgroundTaskHost.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\eddb19405b7ce1	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\System.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCXFC92.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File created	C:\Program Files (x86)\Windows Media Player\uk-UA\6ccacd8608530f	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\RCXF3A1.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6cb0b6c459d5d3	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\System.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File created	C:\Program Files\Windows Multimedia Platform\Registry.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCXF5B6.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCXFC93.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File created	C:\Program Files (x86)\Windows Sidebar\9e8d7a4ca61bd9	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File created	C:\Program Files\VideoLAN\VLC\skins\69ddcba757bf72	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\RCXED62.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\smss.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\RCX65F.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\Registry.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCXEB1D.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCXEB2E.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\RCXF3A2.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\f3b6ecef712a24	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Windows\Microsoft.NET\RCXF7CD.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Windows\Microsoft.NET\spoolsv.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\Documents\RCX15A.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\Documents\unsecapp.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File created	C:\Windows\Microsoft.NET\spoolsv.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Documents\unsecapp.exe	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Documents\29c1c3cc0f7685	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Windows\Microsoft.NET\RCXF7CC.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\Documents\RCX12A.tmp	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	lsass.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2404	schtasks.exe
1068	schtasks.exe
2904	schtasks.exe
1924	schtasks.exe
3128	schtasks.exe
4440	schtasks.exe
2456	schtasks.exe
2328	schtasks.exe
4324	schtasks.exe
3948	schtasks.exe
5020	schtasks.exe
2644	schtasks.exe
3008	schtasks.exe
756	schtasks.exe
2084	schtasks.exe
100	schtasks.exe
2308	schtasks.exe
1664	schtasks.exe
576	schtasks.exe
3092	schtasks.exe
1368	schtasks.exe
4756	schtasks.exe
5036	schtasks.exe
32	schtasks.exe
3124	schtasks.exe
3208	schtasks.exe
1212	schtasks.exe
4436	schtasks.exe
1916	schtasks.exe
2068	schtasks.exe
3368	schtasks.exe
3376	schtasks.exe
5080	schtasks.exe
1816	schtasks.exe
892	schtasks.exe
4936	schtasks.exe
2864	schtasks.exe
1504	schtasks.exe
5112	schtasks.exe
3860	schtasks.exe
3068	schtasks.exe
1640	schtasks.exe
4040	schtasks.exe
4964	schtasks.exe
5084	schtasks.exe
928	schtasks.exe
3416	schtasks.exe
4308	schtasks.exe
1864	schtasks.exe
744	schtasks.exe
1628	schtasks.exe
360	schtasks.exe
4676	schtasks.exe
2892	schtasks.exe
1016	schtasks.exe
1648	schtasks.exe
1812	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	640	powershell.exe
Token: SeDebugPrivilege	2120	powershell.exe
Token: SeDebugPrivilege	3120	powershell.exe
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	1368	lsass.exe
Token: SeDebugPrivilege	3280	lsass.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2916	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	151
PID 2752 wrote to memory of 2916	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	151
PID 2752 wrote to memory of 2252	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	152
PID 2752 wrote to memory of 2252	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	152
PID 2752 wrote to memory of 4904	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	153
PID 2752 wrote to memory of 4904	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	153
PID 2752 wrote to memory of 2120	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	154
PID 2752 wrote to memory of 2120	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	154
PID 2752 wrote to memory of 640	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	155
PID 2752 wrote to memory of 640	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	155
PID 2752 wrote to memory of 3120	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	156
PID 2752 wrote to memory of 3120	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	156
PID 2752 wrote to memory of 1932	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	157
PID 2752 wrote to memory of 1932	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	157
PID 2752 wrote to memory of 3156	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	159
PID 2752 wrote to memory of 3156	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	159
PID 2752 wrote to memory of 4504	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	160
PID 2752 wrote to memory of 4504	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	160
PID 2752 wrote to memory of 2688	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	161
PID 2752 wrote to memory of 2688	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	161
PID 2752 wrote to memory of 4344	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	162
PID 2752 wrote to memory of 4344	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	162
PID 2752 wrote to memory of 1368	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	173
PID 2752 wrote to memory of 1368	2752	af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe	173
PID 1368 wrote to memory of 1860	1368	lsass.exe	174
PID 1368 wrote to memory of 1860	1368	lsass.exe	174
PID 1368 wrote to memory of 852	1368	lsass.exe	175
PID 1368 wrote to memory of 852	1368	lsass.exe	175
PID 1860 wrote to memory of 3280	1860	WScript.exe	176
PID 1860 wrote to memory of 3280	1860	WScript.exe	176

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe
"C:\Users\Admin\AppData\Local\Temp\af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Recovery\WindowsRE\lsass.exe
  "C:\Recovery\WindowsRE\lsass.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\06707a24-ef81-45c9-9fa7-21fc69d07901.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - C:\Recovery\WindowsRE\lsass.exe
      C:\Recovery\WindowsRE\lsass.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3280
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b30c769-8e9d-4a54-b76f-a45ab77217fd.vbs"
    3⤵
    PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Multimedia Platform\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\VLC\skins\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\skins\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\skins\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\Microsoft.NET\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\Microsoft.NET\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Windows\ServiceProfiles\NetworkService\Documents\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\Documents\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Windows\ServiceProfiles\NetworkService\Documents\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:32

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Start Menu\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Start Menu\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows NT\TableTextService\en-US\System.exe

Filesize
1.7MB

MD5
a00ad84b0b0107038276d3406b21894c

SHA1
1f6ff0b06614604305d7ab1f503bce4b75dbc1f3

SHA256
8fa2e2113ade07a54dd197858066cad1f5a670e0fc065815c6bbcf3db5c6eac5

SHA512
323de3474e0fda2247593ef19e4ea0de6aa07d5b8e2b318649bacafae2e2074f0647642032b1bde1811c852ad1cb14aa8221355b8be06fb1604182e7f19d0202

Download Submit
C:\Program Files\VideoLAN\VLC\skins\smss.exe

Filesize
1.7MB

MD5
6d41ecedcce80f8c3fa81d06041101e8

SHA1
a0c354fc73043792e994309472a61ddb35144a0d

SHA256
af806de6c621a99efd037e09772f4821a2b385f72f854abd105e3597799806dd

SHA512
874a83462cbc5ac0f71b0b18ab07a284106cdbfb19f170c83bc954cf1b017634e57374971df1f1a4ac33b24d91ebb234fcff80de5bd94a74a144f84c205557d5

Download Submit
C:\Recovery\WindowsRE\lsass.exe

Filesize
1.7MB

MD5
8a3dc5bc9db9f298be1bef5d143cbd64

SHA1
e93230d1ace9f6b26e4235439797c3f8aeac32d7

SHA256
a7cf435d1c3c32e8941f0721d6bb25c11fd324ccf6bb413311590dff47491edd

SHA512
27885d23927a7cf8d26c9f3c314699aa58f11a2dec805a1e5ce747b8cd9891d0b0c0864554f975a02cbb28c912124fe19eae5b2682d019807d6de46235ea4de5

Download Submit
C:\Recovery\WindowsRE\winlogon.exe

Filesize
1.7MB

MD5
f414bfde1d316603bc1a2e02f8366335

SHA1
a88cedd5f5630b305667e95cf0845bd64a9b4f2f

SHA256
2bf36d978532efc8bb22a55cefbdb930f553c43768fc6fa42544e8055f52d257

SHA512
721f9b38ae5aa1c0aa41cf82e7f10492b36fa61ee5a943cb44d107125cbf64c4a990b05a052527576032e168a05858d9d162c79821e1085f6f7cc6be63ac6d18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\lsass.exe.log

Filesize
1KB

MD5
3ad9a5252966a3ab5b1b3222424717be

SHA1
5397522c86c74ddbfb2585b9613c794f4b4c3410

SHA256
27525f5fc7871c6828ab5173315e95b5c7e918d2ee532781c562c378584b5249

SHA512
b1a745f7a0f33b777ffc34f74f42752144d9f2d06b8bc613e703570494762b3af87e153212c3274b18af14f17b8619e2f350b7c3cc11228f7d4208d4251e90e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Temp\06707a24-ef81-45c9-9fa7-21fc69d07901.vbs

Filesize
707B

MD5
4627626fd166eee5f7fb24591ab521d4

SHA1
ecad50a7ff479e030c11b2056b360d6a38a9219d

SHA256
3124e8847ae1d60b451fdd70c415b5564155ee68b0e0bad2cca1001d7b34a074

SHA512
adcf21a60d7349605b00902a268a8aca1bc6f40f4ab74c6b1f680a2c2743ac12a265782a1c5c2bf45b70f714ff0ccce576c7417a6b8e7c3eb8fbd035a200d35c

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b30c769-8e9d-4a54-b76f-a45ab77217fd.vbs

Filesize
483B

MD5
49d24acfb55e0de29aa2758980749a8b

SHA1
85ed5a01f77f3982c31b9b04df62a98b32f118ea

SHA256
31a839c11592398dd14f74b95fc31570f581ac4d456be49a20b440da70576110

SHA512
93e8acaa959392d1ab256a3e89a92da4449e0ebcb1854053deb2405c89994738a06ffa5311937e8002b4460ae08809e90d58ec2e2dc7cc63bf30fd5eaa00c699

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pbewr5k1.srt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Default\wininit.exe

Filesize
1.7MB

MD5
024206d7c5a343dc7ef52f29545d6895

SHA1
667cba04b50574a4f05dbe46853f5b146703f134

SHA256
92dd560fed5b3f19e8278141410da6bfef5309617e6f960653b046df7ffda43c

SHA512
00a9e83a720916058062cce37744fd7a3c143848f2b1ff5a8c05e18cd76aa76b9060904d1fe2180fd39a6c3f8dee0c9228b074d6a6d2397346e4ac805f5e87c0

Download Submit
memory/1368-440-0x0000000000A80000-0x0000000000C36000-memory.dmp

Filesize
1.7MB

Download
memory/1368-442-0x000000001D360000-0x000000001D372000-memory.dmp

Filesize
72KB

Download
memory/2252-338-0x000001D8A5F80000-0x000001D8A5FA2000-memory.dmp

Filesize
136KB

Download
memory/2752-17-0x000000001BC40000-0x000000001BC4C000-memory.dmp

Filesize
48KB

Download
memory/2752-3-0x0000000003040000-0x000000000305C000-memory.dmp

Filesize
112KB

Download
memory/2752-14-0x000000001BC10000-0x000000001BC1C000-memory.dmp

Filesize
48KB

Download
memory/2752-22-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

Filesize
10.8MB

Download
memory/2752-18-0x000000001BC50000-0x000000001BC5C000-memory.dmp

Filesize
48KB

Download
memory/2752-11-0x0000000003100000-0x0000000003108000-memory.dmp

Filesize
32KB

Download
memory/2752-159-0x00007FFA5E943000-0x00007FFA5E945000-memory.dmp

Filesize
8KB

Download
memory/2752-13-0x000000001BC00000-0x000000001BC0C000-memory.dmp

Filesize
48KB

Download
memory/2752-183-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

Filesize
10.8MB

Download
memory/2752-10-0x00000000030A0000-0x00000000030AC000-memory.dmp

Filesize
48KB

Download
memory/2752-1-0x0000000000D50000-0x0000000000F06000-memory.dmp

Filesize
1.7MB

Download
memory/2752-15-0x000000001BC20000-0x000000001BC2A000-memory.dmp

Filesize
40KB

Download
memory/2752-0-0x00007FFA5E943000-0x00007FFA5E945000-memory.dmp

Filesize
8KB

Download
memory/2752-21-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

Filesize
10.8MB

Download
memory/2752-7-0x0000000003070000-0x0000000003086000-memory.dmp

Filesize
88KB

Download
memory/2752-441-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

Filesize
10.8MB

Download
memory/2752-16-0x000000001BC30000-0x000000001BC38000-memory.dmp

Filesize
32KB

Download
memory/2752-8-0x0000000003090000-0x00000000030A2000-memory.dmp

Filesize
72KB

Download
memory/2752-4-0x00000000030B0000-0x0000000003100000-memory.dmp

Filesize
320KB

Download
memory/2752-5-0x0000000001870000-0x0000000001878000-memory.dmp

Filesize
32KB

Download
memory/2752-6-0x0000000003060000-0x0000000003070000-memory.dmp

Filesize
64KB

Download
memory/2752-9-0x000000001BBF0000-0x000000001BC00000-memory.dmp

Filesize
64KB

Download
memory/2752-2-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

Filesize
10.8MB

Download
memory/2752-218-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

Filesize
10.8MB

Download