dcrat | 501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad

Analysis

max time kernel
148s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

181d043c0617914801548f09d5b776d4.exe
Size

1.4MB
MD5

181d043c0617914801548f09d5b776d4
SHA1

757f042065a3dc2c9f73e635b41f83591c8ad647
SHA256

501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad
SHA512

c56897c04b11db7c09ef21be8fe6a541c3c9ffb428b3e1340fce5b035f9f74bb133b57e7cc0852730efd20b4a49da0e8a79b6390f105d18f9fb39461559be574
SSDEEP

24576:6oIREGQw97lGTIYskQyxNtGSKERqWzAcqGv+3spCElJz009I+LU:gRdGcHkBxNYARdzAcqGv+cphlJzxV

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 41 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		448	schtasks.exe
		2740	schtasks.exe
		2736	schtasks.exe
		2440	schtasks.exe
		2804	schtasks.exe
		2268	schtasks.exe
		2356	schtasks.exe
		3036	schtasks.exe
		2752	schtasks.exe
		2132	schtasks.exe
		2676	schtasks.exe
		264	schtasks.exe
		2624	schtasks.exe
		1784	schtasks.exe
		2344	schtasks.exe
		1484	schtasks.exe
		1800	schtasks.exe
		1948	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		181d043c0617914801548f09d5b776d4.exe
		2712	schtasks.exe
		2324	schtasks.exe
		1892	schtasks.exe
		2732	schtasks.exe
		1444	schtasks.exe
		740	schtasks.exe
		2616	schtasks.exe
		2820	schtasks.exe
		536	schtasks.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\cc11b995f2a76d		181d043c0617914801548f09d5b776d4.exe
		2376	schtasks.exe
		2092	schtasks.exe
		2180	schtasks.exe
		2748	schtasks.exe
		2696	schtasks.exe
		2532	schtasks.exe
		2948	schtasks.exe
		2832	schtasks.exe
		1300	schtasks.exe
		1424	schtasks.exe
		1860	schtasks.exe
		768	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 13 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\", \"C:\\Windows\\AppPatch\\de-DE\\services.exe\", \"C:\\Windows\\DigitalLocker\\services.exe\", \"C:\\MSOCache\\All Users\\taskhost.exe\", \"C:\\Windows\\Globalization\\181d043c0617914801548f09d5b776d4.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\", \"C:\\Windows\\AppPatch\\de-DE\\services.exe\", \"C:\\Windows\\DigitalLocker\\services.exe\", \"C:\\MSOCache\\All Users\\taskhost.exe\", \"C:\\Windows\\Globalization\\181d043c0617914801548f09d5b776d4.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\", \"C:\\Users\\Default\\SendTo\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\explorer.exe\", \"C:\\Windows\\Performance\\WinSAT\\181d043c0617914801548f09d5b776d4.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\", \"C:\\Windows\\AppPatch\\de-DE\\services.exe\", \"C:\\Windows\\DigitalLocker\\services.exe\", \"C:\\MSOCache\\All Users\\taskhost.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\", \"C:\\Windows\\AppPatch\\de-DE\\services.exe\", \"C:\\Windows\\DigitalLocker\\services.exe\", \"C:\\MSOCache\\All Users\\taskhost.exe\", \"C:\\Windows\\Globalization\\181d043c0617914801548f09d5b776d4.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\", \"C:\\Windows\\AppPatch\\de-DE\\services.exe\", \"C:\\Windows\\DigitalLocker\\services.exe\", \"C:\\MSOCache\\All Users\\taskhost.exe\", \"C:\\Windows\\Globalization\\181d043c0617914801548f09d5b776d4.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\", \"C:\\Windows\\AppPatch\\de-DE\\services.exe\", \"C:\\Windows\\DigitalLocker\\services.exe\", \"C:\\MSOCache\\All Users\\taskhost.exe\", \"C:\\Windows\\Globalization\\181d043c0617914801548f09d5b776d4.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\", \"C:\\Users\\Default\\SendTo\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\explorer.exe\", \"C:\\Windows\\Performance\\WinSAT\\181d043c0617914801548f09d5b776d4.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\winlogon.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\System.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\", \"C:\\Windows\\AppPatch\\de-DE\\services.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\", \"C:\\Windows\\AppPatch\\de-DE\\services.exe\", \"C:\\Windows\\DigitalLocker\\services.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\", \"C:\\Windows\\AppPatch\\de-DE\\services.exe\", \"C:\\Windows\\DigitalLocker\\services.exe\", \"C:\\MSOCache\\All Users\\taskhost.exe\", \"C:\\Windows\\Globalization\\181d043c0617914801548f09d5b776d4.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\", \"C:\\Users\\Default\\SendTo\\services.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\", \"C:\\Windows\\AppPatch\\de-DE\\services.exe\", \"C:\\Windows\\DigitalLocker\\services.exe\", \"C:\\MSOCache\\All Users\\taskhost.exe\", \"C:\\Windows\\Globalization\\181d043c0617914801548f09d5b776d4.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\", \"C:\\Users\\Default\\SendTo\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\explorer.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\", \"C:\\Windows\\AppPatch\\de-DE\\services.exe\", \"C:\\Windows\\DigitalLocker\\services.exe\", \"C:\\MSOCache\\All Users\\taskhost.exe\", \"C:\\Windows\\Globalization\\181d043c0617914801548f09d5b776d4.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\", \"C:\\Users\\Default\\SendTo\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\explorer.exe\", \"C:\\Windows\\Performance\\WinSAT\\181d043c0617914801548f09d5b776d4.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\winlogon.exe\""	181d043c0617914801548f09d5b776d4.exe

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	264	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2212	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	2212	schtasks.exe	28

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	181d043c0617914801548f09d5b776d4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	181d043c0617914801548f09d5b776d4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	181d043c0617914801548f09d5b776d4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1868-1-0x00000000013B0000-0x0000000001518000-memory.dmp	dcrat
behavioral1/files/0x0008000000016d9f-18.dat	dcrat
behavioral1/memory/1632-44-0x0000000000AA0000-0x0000000000C08000-memory.dmp	dcrat
behavioral1/memory/3000-55-0x0000000000200000-0x0000000000368000-memory.dmp	dcrat
behavioral1/memory/2272-67-0x0000000001010000-0x0000000001178000-memory.dmp	dcrat
behavioral1/memory/292-145-0x0000000000030000-0x0000000000198000-memory.dmp	dcrat
behavioral1/memory/1696-157-0x0000000000B90000-0x0000000000CF8000-memory.dmp	dcrat
behavioral1/memory/2336-169-0x0000000001360000-0x00000000014C8000-memory.dmp	dcrat

Executes dropped EXE 12 IoCs

pid	Process
1632	services.exe
3000	services.exe
2272	services.exe
2800	services.exe
1300	services.exe
1748	services.exe
2708	services.exe
316	services.exe
2964	services.exe
292	services.exe
1696	services.exe
2336	services.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Default\\SendTo\\services.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\181d043c0617914801548f09d5b776d4 = "\"C:\\Windows\\Performance\\WinSAT\\181d043c0617914801548f09d5b776d4.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Microsoft Sync Framework\\winlogon.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\taskhost.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\explorer.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Microsoft Sync Framework\\winlogon.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\AppPatch\\de-DE\\services.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\181d043c0617914801548f09d5b776d4 = "\"C:\\Windows\\Globalization\\181d043c0617914801548f09d5b776d4.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\181d043c0617914801548f09d5b776d4 = "\"C:\\Windows\\Globalization\\181d043c0617914801548f09d5b776d4.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Default\\SendTo\\services.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\181d043c0617914801548f09d5b776d4 = "\"C:\\Windows\\Performance\\WinSAT\\181d043c0617914801548f09d5b776d4.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\System.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\csrss.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\DigitalLocker\\services.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\DigitalLocker\\services.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\taskhost.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\AppPatch\\de-DE\\services.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\explorer.exe\""	181d043c0617914801548f09d5b776d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\System.exe\""	181d043c0617914801548f09d5b776d4.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	181d043c0617914801548f09d5b776d4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	181d043c0617914801548f09d5b776d4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\886983d96e3d3e	181d043c0617914801548f09d5b776d4.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\winlogon.exe	181d043c0617914801548f09d5b776d4.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\cc11b995f2a76d	181d043c0617914801548f09d5b776d4.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe	181d043c0617914801548f09d5b776d4.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe	181d043c0617914801548f09d5b776d4.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\cc11b995f2a76d	181d043c0617914801548f09d5b776d4.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\csrss.exe	181d043c0617914801548f09d5b776d4.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\DigitalLocker\c5b4cb5e9653cc	181d043c0617914801548f09d5b776d4.exe
File created	C:\Windows\Globalization\181d043c0617914801548f09d5b776d4.exe	181d043c0617914801548f09d5b776d4.exe
File created	C:\Windows\Globalization\42edfc2b0858ee	181d043c0617914801548f09d5b776d4.exe
File created	C:\Windows\Performance\WinSAT\181d043c0617914801548f09d5b776d4.exe	181d043c0617914801548f09d5b776d4.exe
File created	C:\Windows\Performance\WinSAT\42edfc2b0858ee	181d043c0617914801548f09d5b776d4.exe
File created	C:\Windows\AppPatch\de-DE\services.exe	181d043c0617914801548f09d5b776d4.exe
File created	C:\Windows\AppPatch\de-DE\c5b4cb5e9653cc	181d043c0617914801548f09d5b776d4.exe
File created	C:\Windows\DigitalLocker\services.exe	181d043c0617914801548f09d5b776d4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2696	schtasks.exe
2740	schtasks.exe
1800	schtasks.exe
536	schtasks.exe
1484	schtasks.exe
2092	schtasks.exe
2324	schtasks.exe
2132	schtasks.exe
768	schtasks.exe
2180	schtasks.exe
2616	schtasks.exe
3036	schtasks.exe
1892	schtasks.exe
2804	schtasks.exe
2748	schtasks.exe
2712	schtasks.exe
2948	schtasks.exe
1784	schtasks.exe
2268	schtasks.exe
2676	schtasks.exe
1860	schtasks.exe
740	schtasks.exe
2736	schtasks.exe
2440	schtasks.exe
2820	schtasks.exe
1424	schtasks.exe
1300	schtasks.exe
2356	schtasks.exe
2376	schtasks.exe
2532	schtasks.exe
1444	schtasks.exe
1948	schtasks.exe
264	schtasks.exe
2752	schtasks.exe
448	schtasks.exe
2624	schtasks.exe
2732	schtasks.exe
2832	schtasks.exe
2344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1868	181d043c0617914801548f09d5b776d4.exe
1868	181d043c0617914801548f09d5b776d4.exe
1868	181d043c0617914801548f09d5b776d4.exe
1632	services.exe
3000	services.exe
2272	services.exe
2800	services.exe
1300	services.exe
1748	services.exe
2708	services.exe
316	services.exe
2964	services.exe
292	services.exe
1696	services.exe
2336	services.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	181d043c0617914801548f09d5b776d4.exe
Token: SeDebugPrivilege	1632	services.exe
Token: SeDebugPrivilege	3000	services.exe
Token: SeDebugPrivilege	2272	services.exe
Token: SeDebugPrivilege	2800	services.exe
Token: SeDebugPrivilege	1300	services.exe
Token: SeDebugPrivilege	1748	services.exe
Token: SeDebugPrivilege	2708	services.exe
Token: SeDebugPrivilege	316	services.exe
Token: SeDebugPrivilege	2964	services.exe
Token: SeDebugPrivilege	292	services.exe
Token: SeDebugPrivilege	1696	services.exe
Token: SeDebugPrivilege	2336	services.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 1972	1868	181d043c0617914801548f09d5b776d4.exe	68
PID 1868 wrote to memory of 1972	1868	181d043c0617914801548f09d5b776d4.exe	68
PID 1868 wrote to memory of 1972	1868	181d043c0617914801548f09d5b776d4.exe	68
PID 1972 wrote to memory of 1404	1972	cmd.exe	70
PID 1972 wrote to memory of 1404	1972	cmd.exe	70
PID 1972 wrote to memory of 1404	1972	cmd.exe	70
PID 1972 wrote to memory of 1632	1972	cmd.exe	71
PID 1972 wrote to memory of 1632	1972	cmd.exe	71
PID 1972 wrote to memory of 1632	1972	cmd.exe	71
PID 1632 wrote to memory of 984	1632	services.exe	72
PID 1632 wrote to memory of 984	1632	services.exe	72
PID 1632 wrote to memory of 984	1632	services.exe	72
PID 1632 wrote to memory of 2988	1632	services.exe	73
PID 1632 wrote to memory of 2988	1632	services.exe	73
PID 1632 wrote to memory of 2988	1632	services.exe	73
PID 984 wrote to memory of 3000	984	WScript.exe	74
PID 984 wrote to memory of 3000	984	WScript.exe	74
PID 984 wrote to memory of 3000	984	WScript.exe	74
PID 3000 wrote to memory of 2632	3000	services.exe	75
PID 3000 wrote to memory of 2632	3000	services.exe	75
PID 3000 wrote to memory of 2632	3000	services.exe	75
PID 3000 wrote to memory of 2576	3000	services.exe	76
PID 3000 wrote to memory of 2576	3000	services.exe	76
PID 3000 wrote to memory of 2576	3000	services.exe	76
PID 2632 wrote to memory of 2272	2632	WScript.exe	79
PID 2632 wrote to memory of 2272	2632	WScript.exe	79
PID 2632 wrote to memory of 2272	2632	WScript.exe	79
PID 2272 wrote to memory of 2752	2272	services.exe	80
PID 2272 wrote to memory of 2752	2272	services.exe	80
PID 2272 wrote to memory of 2752	2272	services.exe	80
PID 2272 wrote to memory of 2352	2272	services.exe	81
PID 2272 wrote to memory of 2352	2272	services.exe	81
PID 2272 wrote to memory of 2352	2272	services.exe	81
PID 2752 wrote to memory of 2800	2752	WScript.exe	82
PID 2752 wrote to memory of 2800	2752	WScript.exe	82
PID 2752 wrote to memory of 2800	2752	WScript.exe	82
PID 2800 wrote to memory of 980	2800	services.exe	83
PID 2800 wrote to memory of 980	2800	services.exe	83
PID 2800 wrote to memory of 980	2800	services.exe	83
PID 2800 wrote to memory of 1860	2800	services.exe	84
PID 2800 wrote to memory of 1860	2800	services.exe	84
PID 2800 wrote to memory of 1860	2800	services.exe	84
PID 980 wrote to memory of 1300	980	WScript.exe	85
PID 980 wrote to memory of 1300	980	WScript.exe	85
PID 980 wrote to memory of 1300	980	WScript.exe	85
PID 1300 wrote to memory of 700	1300	services.exe	86
PID 1300 wrote to memory of 700	1300	services.exe	86
PID 1300 wrote to memory of 700	1300	services.exe	86
PID 1300 wrote to memory of 752	1300	services.exe	87
PID 1300 wrote to memory of 752	1300	services.exe	87
PID 1300 wrote to memory of 752	1300	services.exe	87
PID 700 wrote to memory of 1748	700	WScript.exe	88
PID 700 wrote to memory of 1748	700	WScript.exe	88
PID 700 wrote to memory of 1748	700	WScript.exe	88
PID 1748 wrote to memory of 2920	1748	services.exe	89
PID 1748 wrote to memory of 2920	1748	services.exe	89
PID 1748 wrote to memory of 2920	1748	services.exe	89
PID 1748 wrote to memory of 2776	1748	services.exe	90
PID 1748 wrote to memory of 2776	1748	services.exe	90
PID 1748 wrote to memory of 2776	1748	services.exe	90
PID 2920 wrote to memory of 2708	2920	WScript.exe	91
PID 2920 wrote to memory of 2708	2920	WScript.exe	91
PID 2920 wrote to memory of 2708	2920	WScript.exe	91
PID 2708 wrote to memory of 1656	2708	services.exe	92

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	181d043c0617914801548f09d5b776d4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	181d043c0617914801548f09d5b776d4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	181d043c0617914801548f09d5b776d4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\181d043c0617914801548f09d5b776d4.exe
"C:\Users\Admin\AppData\Local\Temp\181d043c0617914801548f09d5b776d4.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Vx3o3eVAfD.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1404
- - C:\Windows\DigitalLocker\services.exe
    "C:\Windows\DigitalLocker\services.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1632
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a0d729f-3523-4a90-a2bd-8a761333e0ac.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:984
    - - C:\Windows\DigitalLocker\services.exe
        
        C:\Windows\DigitalLocker\services.exe
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3000
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a659c74-ed39-4bc6-a3d3-cba31702cf6a.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\DigitalLocker\services.exe
        
        C:\Windows\DigitalLocker\services.exe
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8eb24e23-e891-4993-8f1d-a298249c5dab.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Windows\DigitalLocker\services.exe
        
        C:\Windows\DigitalLocker\services.exe
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2800
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d48c6137-ee57-41aa-ba70-e273b7f49ecc.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:980
        
        C:\Windows\DigitalLocker\services.exe
        
        C:\Windows\DigitalLocker\services.exe
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1300
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cae73f29-c19f-4039-878b-6433e9a894ab.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:700
        
        C:\Windows\DigitalLocker\services.exe
        
        C:\Windows\DigitalLocker\services.exe
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1748
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be4117eb-72b0-45f5-8d97-5d92b10456e7.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Windows\DigitalLocker\services.exe
        
        C:\Windows\DigitalLocker\services.exe
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2708
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20b5aacb-c6ec-48cb-8db8-0ae1bbdcb1a7.vbs"
        16⤵
        
        PID:1656
        
        C:\Windows\DigitalLocker\services.exe
        
        C:\Windows\DigitalLocker\services.exe
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:316
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97ea8eb8-7967-465d-80c4-ef8b716c5802.vbs"
        18⤵
        
        PID:1908
        
        C:\Windows\DigitalLocker\services.exe
        
        C:\Windows\DigitalLocker\services.exe
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c89c278-999a-46d1-a2f0-6db492679784.vbs"
        20⤵
        
        PID:2364
        
        C:\Windows\DigitalLocker\services.exe
        
        C:\Windows\DigitalLocker\services.exe
        21⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:292
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ce724db-8704-482d-9c35-9c0139e6c1fc.vbs"
        22⤵
        
        PID:1168
        
        C:\Windows\DigitalLocker\services.exe
        
        C:\Windows\DigitalLocker\services.exe
        23⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d61f9915-0f64-47ba-ac15-88c5094400e8.vbs"
        24⤵
        
        PID:1828
        
        C:\Windows\DigitalLocker\services.exe
        
        C:\Windows\DigitalLocker\services.exe
        25⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2336
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\07f03248-33ea-4724-9e7c-8e016a7ee803.vbs"
        26⤵
        
        PID:2584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6d7a1996-a56f-42a9-8f7a-4d99386aa95f.vbs"
        26⤵
        
        PID:2168
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\662ab133-ed29-4625-ae47-6f48eaab961e.vbs"
        24⤵
        
        PID:2520
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47d5ef9c-cb8c-40ee-9efb-8ab1047940ed.vbs"
        22⤵
        
        PID:2600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5bc6812-eee3-40a4-85b2-6ea5ee11fca6.vbs"
        20⤵
        
        PID:584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9c0f49f5-b92f-42ec-97ab-f61eb15f7d49.vbs"
        18⤵
        
        PID:2020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7be84dd3-1a31-47a4-aeef-97e43b877ddd.vbs"
        16⤵
        
        PID:1252
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ca269bf-8637-4b3d-90d9-81f9bca4140b.vbs"
        14⤵
        
        PID:2776
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\869cc073-f272-4e15-b973-e4fe0367ac1f.vbs"
        12⤵
        
        PID:752
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dcb6ca7b-ba5b-468e-a6f2-58c517601655.vbs"
        10⤵
        
        PID:1860
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d9e8d941-01b5-4fde-8f06-3543894dcf5c.vbs"
        8⤵
        
        PID:2352
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c5b91688-dbe3-4fb3-9eb0-26ac4bb088ef.vbs"
        6⤵
        
        PID:2576
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\16200d94-44b6-4cde-a331-d6de16faa7b4.vbs"
      4⤵
      PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\AppPatch\de-DE\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\AppPatch\de-DE\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\AppPatch\de-DE\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\DigitalLocker\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Windows\DigitalLocker\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "181d043c0617914801548f09d5b776d41" /sc MINUTE /mo 11 /tr "'C:\Windows\Globalization\181d043c0617914801548f09d5b776d4.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "181d043c0617914801548f09d5b776d4" /sc ONLOGON /tr "'C:\Windows\Globalization\181d043c0617914801548f09d5b776d4.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "181d043c0617914801548f09d5b776d41" /sc MINUTE /mo 5 /tr "'C:\Windows\Globalization\181d043c0617914801548f09d5b776d4.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Users\Default\SendTo\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\SendTo\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Users\Default\SendTo\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "181d043c0617914801548f09d5b776d41" /sc MINUTE /mo 11 /tr "'C:\Windows\Performance\WinSAT\181d043c0617914801548f09d5b776d4.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "181d043c0617914801548f09d5b776d4" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\181d043c0617914801548f09d5b776d4.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "181d043c0617914801548f09d5b776d41" /sc MINUTE /mo 13 /tr "'C:\Windows\Performance\WinSAT\181d043c0617914801548f09d5b776d4.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\taskhost.exe

Filesize
1.4MB

MD5
181d043c0617914801548f09d5b776d4

SHA1
757f042065a3dc2c9f73e635b41f83591c8ad647

SHA256
501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad

SHA512
c56897c04b11db7c09ef21be8fe6a541c3c9ffb428b3e1340fce5b035f9f74bb133b57e7cc0852730efd20b4a49da0e8a79b6390f105d18f9fb39461559be574

Download Submit
C:\Users\Admin\AppData\Local\Temp\07f03248-33ea-4724-9e7c-8e016a7ee803.vbs

Filesize
713B

MD5
52b6d53b6804e780e738d4455ac58eff

SHA1
132c286a4283d66635361e45edea2f8b6c32dd1f

SHA256
3a69e3b989747aaa4bfc2beb19a59ab27531bdefd0977a762908272d342c4b36

SHA512
755e578a371eda6fc92a57335fd318ee9f22b451c93c9a555b6fc9c689f66b9c5753f6a80935e0d366b4dd484189bee7ae7daa8060dc101f036d6ac18a92f0d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\0a0d729f-3523-4a90-a2bd-8a761333e0ac.vbs

Filesize
713B

MD5
d9f99321a08a877e3e39994cee78d5d8

SHA1
71f3e854e7d4f977cb6d2deac7c8edf7b8f60370

SHA256
fe42d0bc4388bab2cb4c887d01766c1eb3a5a8b21e3fe5923c2b22dec73d2a58

SHA512
91a58e06df7e33b2ff4cd8a5e853c2240cc7ce302f65090bb3af5ee4fd117905475346a27c7056a88d9b0ae7e29ef95307acbb85fcfdbbbfe9f1ba4f9e4be7d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\0c89c278-999a-46d1-a2f0-6db492679784.vbs

Filesize
713B

MD5
f4546b81a1dcbe4fd2d1236987a4ecfc

SHA1
ed531ab65b4a7a5f749a5ce50f144800664c6933

SHA256
d61f9d5472c716e7a34035b142f4c8defffff6fb91b342ce12156f1dbcc39d82

SHA512
b197695e1ceb15b0b545fef3b9200a958dd4af76629286f83356484823f0b82bf2a5a1be5a6ea01aa6648e71a3a29670cca58814ce559fb24d856e61e7e34121

Download Submit
C:\Users\Admin\AppData\Local\Temp\16200d94-44b6-4cde-a331-d6de16faa7b4.vbs

Filesize
489B

MD5
5009ea6d9d96a31b34a08473d768d8e8

SHA1
a51bf6b206ab395359268de36acbaf5e2c279f86

SHA256
8216c01d8dc4591b4394f42ec048121419f9042bc218a3f1ecd4d1cf19a3deff

SHA512
e853e10e7288c60a533312436a468577cd0dbf74bb246faab327e2ecde4afafa01a99c810945f0bfbe5ff2dc3fea51bf61914bc654563e154577bc5fd2c1e430

Download Submit
C:\Users\Admin\AppData\Local\Temp\1a659c74-ed39-4bc6-a3d3-cba31702cf6a.vbs

Filesize
713B

MD5
ebf710c8d962680769e895659b243ef2

SHA1
b838fd36086ea48b876273f817723053950241b7

SHA256
23c5c84f39b38d353fe8b9ddbaa0e0b45fddf0855ea5c977caa0a3aa4a30cd16

SHA512
4d496db3cf8f5127487e84124e53634367676ef6467f7c890fe904f66646fbc0499c6ff1f6829f8574400f257994d74996c1b85b993ad09bffa0ce02d0629c44

Download Submit
C:\Users\Admin\AppData\Local\Temp\20b5aacb-c6ec-48cb-8db8-0ae1bbdcb1a7.vbs

Filesize
713B

MD5
5de5285cd599be03e0a51cffdace3b40

SHA1
87905a2c3ba7ec554ea994d61f3e2c71a74552e1

SHA256
d7d17c04d8eeeebe1cf8e0c1f27854d6b116568aad2061d75b36fe13fa0354bb

SHA512
fb6cd5ba94b394bad98cef8aeaf7ad6f45198dee785172dc332f87103b469fe88224a95351681bedba92b43fa97f5b04a0d1b92efd5a0bdc881f60a0a7b479ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\4ce724db-8704-482d-9c35-9c0139e6c1fc.vbs

Filesize
712B

MD5
ab6b6b58a193cffed51d3011c1d6c483

SHA1
9b499bf4470b2912572971a98ccf1651462b15fa

SHA256
b2ee7d05988109e5b754571f38d0290e5b44740d90c91b733c69681a042e9570

SHA512
3b5bd6a326881162d997f7705a8e02acb14d05762c2294c10eacf73dc07875b7ce782f04a25827ba519c14a2a569400ed95118b2575788835b5fd9b526fefa1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8eb24e23-e891-4993-8f1d-a298249c5dab.vbs

Filesize
713B

MD5
6412e4fc6e7b53e58ddd39fc11afd717

SHA1
de2fef810110760c4235a5cb19e3256368f2cde2

SHA256
5f80dc5f95f887e733b99738600e29e8289ec266efebc405185210658637c0e2

SHA512
b9ff74e68e3d9dfb5b835d30f15d5b7303b06f21de41519d60d3b7d823985ee95c165d4cd6c6808809749b972452a8727a238d654e9045f6a139f1a14d3d4c20

Download Submit
C:\Users\Admin\AppData\Local\Temp\97ea8eb8-7967-465d-80c4-ef8b716c5802.vbs

Filesize
712B

MD5
464a61f00bcbddabf8b44bf7279dfa61

SHA1
e1594adc632963a9eca37693537411b3c856b971

SHA256
ae829efd74116013faf33c67683013356259e048d85a3df1ae39758eb2e4aa9c

SHA512
fb08e857475f68d56c85d23405e10b4cf4e0c2414fe7dbc0e5ce49d97a1622071fa68c066fb94da5977fd0ef04ce17e81e80fc6af08d9ec3e98af0c5b4f11b0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Vx3o3eVAfD.bat

Filesize
202B

MD5
eb4af045bc625aea65d25eb6fc3e0310

SHA1
289e909e79e661fa77c5ec61a8a0d0bfbf9a9269

SHA256
a61771b61c6081e495f5b402ee5ed0726823f3979f99b108b0314e159c0bc909

SHA512
a2f5a3e6087470dfcb61818c0f99ce582b114f8d0276ed9e13aac91229b0314de31887e1c91e530b3368cdc8b91627782a62cd36fb9d891547c0c368bc6ead08

Download Submit
C:\Users\Admin\AppData\Local\Temp\be4117eb-72b0-45f5-8d97-5d92b10456e7.vbs

Filesize
713B

MD5
694c15dfee2b7117260a44fb1830b049

SHA1
19a463a9e1fbf91bad4d60dc5e44a0e6466ed551

SHA256
f1ea6651018afe114c440e58c5ed5da4afb366eaf2b72925eec997e637bb5580

SHA512
f77263bf04cc982d44969e316df08846251fb6c47b2a2f773a2978d5f75b13905a73ba6cb93a81b85bfe0bdb85cadcdd33acba822587ea18ff603fb8a5b54591

Download Submit
C:\Users\Admin\AppData\Local\Temp\cae73f29-c19f-4039-878b-6433e9a894ab.vbs

Filesize
713B

MD5
b558a3ab82db17adb47c5e6031ba93e4

SHA1
01b17220d9f8efcb9c4e8f3de9913f916fc81fcc

SHA256
47edaa357aa538389c9239e65ed57ef18b1a01ed1002bf8bb351eabe636bdefc

SHA512
4b6dd9efecb9551688a8fc051bf4248a85eb55a509e121dcec44e610af4c60625f099480b7371110b9faee9e822eddb9ab08a68b110561762328b9ee8bed617a

Download Submit
C:\Users\Admin\AppData\Local\Temp\d48c6137-ee57-41aa-ba70-e273b7f49ecc.vbs

Filesize
713B

MD5
1d671c541e97e0e060ba9750787234c8

SHA1
3a24f1b6da14f49ca60f631765b49b38fb0d7914

SHA256
8f2fc9b611dabf75118f9aa91bac50ec1f2305bf2ea4b5fcbffaa620a4dbb561

SHA512
3406df0d158977f80906fb68aa747fae5ab0e6a344f8bd127a46db3bf35b14c4416c93a0e287cc44fd4cd28168df3a2e69371a5e2e40a9fa282871bc03737917

Download Submit
C:\Users\Admin\AppData\Local\Temp\d61f9915-0f64-47ba-ac15-88c5094400e8.vbs

Filesize
713B

MD5
bebbd5c11a0eaa6adfa3381614c3872f

SHA1
e9a2f79ada9b56375732735703f6487fd0e4d17f

SHA256
790eb95f25b1591aa89fd64cf8037cb7956ec6b8939b2b93636432011231aab7

SHA512
8766ae92a26b216c7a3a3934a1eb51a0cdf115f53a0362cda8cdfcf8753e99ae296b3b91a93d257e7ae0a1c20b3ac1f27a93229fdb59a3afb3764169a91ff30f

Download Submit
memory/292-145-0x0000000000030000-0x0000000000198000-memory.dmp

Filesize
1.4MB

Download
memory/1632-44-0x0000000000AA0000-0x0000000000C08000-memory.dmp

Filesize
1.4MB

Download
memory/1696-157-0x0000000000B90000-0x0000000000CF8000-memory.dmp

Filesize
1.4MB

Download
memory/1868-8-0x0000000000BF0000-0x0000000000BFA000-memory.dmp

Filesize
40KB

Download
memory/1868-6-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download
memory/1868-1-0x00000000013B0000-0x0000000001518000-memory.dmp

Filesize
1.4MB

Download
memory/1868-41-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

Filesize
9.9MB

Download
memory/1868-9-0x0000000000C80000-0x0000000000C8E000-memory.dmp

Filesize
56KB

Download
memory/1868-0-0x000007FEF5493000-0x000007FEF5494000-memory.dmp

Filesize
4KB

Download
memory/1868-7-0x0000000000BE0000-0x0000000000BEC000-memory.dmp

Filesize
48KB

Download
memory/1868-2-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

Filesize
9.9MB

Download
memory/1868-5-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download
memory/1868-4-0x0000000000BC0000-0x0000000000BD6000-memory.dmp

Filesize
88KB

Download
memory/1868-3-0x0000000000350000-0x000000000036C000-memory.dmp

Filesize
112KB

Download
memory/2272-67-0x0000000001010000-0x0000000001178000-memory.dmp

Filesize
1.4MB

Download
memory/2336-169-0x0000000001360000-0x00000000014C8000-memory.dmp

Filesize
1.4MB

Download
memory/3000-55-0x0000000000200000-0x0000000000368000-memory.dmp

Filesize
1.4MB

Download