dcrat | 501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Size

1.4MB
MD5

181d043c0617914801548f09d5b776d4
SHA1

757f042065a3dc2c9f73e635b41f83591c8ad647
SHA256

501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad
SHA512

c56897c04b11db7c09ef21be8fe6a541c3c9ffb428b3e1340fce5b035f9f74bb133b57e7cc0852730efd20b4a49da0e8a79b6390f105d18f9fb39461559be574
SSDEEP

24576:6oIREGQw97lGTIYskQyxNtGSKERqWzAcqGv+3spCElJz009I+LU:gRdGcHkBxNYARdzAcqGv+cphlJzxV

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 56 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2332	schtasks.exe
		1616	schtasks.exe
		1588	schtasks.exe
		2412	schtasks.exe
		2232	schtasks.exe
		2748	schtasks.exe
		2252	schtasks.exe
		992	schtasks.exe
		2820	schtasks.exe
		2600	schtasks.exe
		2764	schtasks.exe
		1376	schtasks.exe
File created	C:\Windows\Setup\f3b6ecef712a24		501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
		2224	schtasks.exe
		1016	schtasks.exe
		3028	schtasks.exe
		2828	schtasks.exe
		524	schtasks.exe
		1592	schtasks.exe
		2632	schtasks.exe
		2264	schtasks.exe
		1536	schtasks.exe
		1672	schtasks.exe
		948	schtasks.exe
		1696	schtasks.exe
		1168	schtasks.exe
		2480	schtasks.exe
		2884	schtasks.exe
		2788	schtasks.exe
		968	schtasks.exe
		2684	schtasks.exe
		2740	schtasks.exe
		1836	schtasks.exe
		2940	schtasks.exe
		1448	schtasks.exe
		1044	schtasks.exe
		3004	schtasks.exe
		660	schtasks.exe
		868	schtasks.exe
		1764	schtasks.exe
		2664	schtasks.exe
		424	schtasks.exe
		2604	schtasks.exe
		1612	schtasks.exe
		2248	schtasks.exe
		2208	schtasks.exe
		2376	schtasks.exe
		1460	schtasks.exe
		2172	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
		2316	schtasks.exe
		1736	schtasks.exe
		2504	schtasks.exe
		2288	schtasks.exe
		1636	schtasks.exe
		2580	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\", \"C:\\Windows\\tracing\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\System.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\spoolsv.exe\", \"C:\\Program Files\\DVD Maker\\en-US\\csrss.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsm.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\", \"C:\\Windows\\tracing\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\System.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\spoolsv.exe\", \"C:\\Program Files\\DVD Maker\\en-US\\csrss.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsm.exe\", \"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\OSPPSVC.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\", \"C:\\Windows\\tracing\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\System.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\spoolsv.exe\", \"C:\\Program Files\\DVD Maker\\en-US\\csrss.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsm.exe\", \"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\", \"C:\\Windows\\tracing\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\System.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\spoolsv.exe\", \"C:\\Program Files\\DVD Maker\\en-US\\csrss.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsm.exe\", \"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Public\\Favorites\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\audiodg.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\", \"C:\\Windows\\tracing\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\System.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\spoolsv.exe\", \"C:\\Program Files\\DVD Maker\\en-US\\csrss.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsm.exe\", \"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Public\\Favorites\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\audiodg.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\lsass.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\", \"C:\\Windows\\tracing\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\System.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\spoolsv.exe\", \"C:\\Program Files\\DVD Maker\\en-US\\csrss.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsm.exe\", \"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Public\\Favorites\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\audiodg.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\taskhost.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\", \"C:\\Windows\\tracing\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\System.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\spoolsv.exe\", \"C:\\Program Files\\DVD Maker\\en-US\\csrss.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsm.exe\", \"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\", \"C:\\Windows\\tracing\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\System.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\spoolsv.exe\", \"C:\\Program Files\\DVD Maker\\en-US\\csrss.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsm.exe\", \"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Public\\Favorites\\dwm.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\", \"C:\\Windows\\tracing\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\System.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\spoolsv.exe\", \"C:\\Program Files\\DVD Maker\\en-US\\csrss.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsm.exe\", \"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Public\\Favorites\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\audiodg.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\taskhost.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\ja-JP\\lsm.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\", \"C:\\Windows\\tracing\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\System.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\spoolsv.exe\", \"C:\\Program Files\\DVD Maker\\en-US\\csrss.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsm.exe\", \"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Public\\Favorites\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\audiodg.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\taskhost.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\ja-JP\\lsm.exe\", \"C:\\MSOCache\\All Users\\WmiPrvSE.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\", \"C:\\Windows\\tracing\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\System.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\", \"C:\\Windows\\tracing\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\System.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\spoolsv.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\", \"C:\\Windows\\tracing\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\System.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\spoolsv.exe\", \"C:\\Program Files\\DVD Maker\\en-US\\csrss.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\", \"C:\\Windows\\tracing\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\System.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\spoolsv.exe\", \"C:\\Program Files\\DVD Maker\\en-US\\csrss.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\winlogon.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\", \"C:\\Windows\\tracing\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\System.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\spoolsv.exe\", \"C:\\Program Files\\DVD Maker\\en-US\\csrss.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsm.exe\", \"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Public\\Favorites\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\audiodg.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\taskhost.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\ja-JP\\lsm.exe\", \"C:\\MSOCache\\All Users\\WmiPrvSE.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\lsass.exe\", \"C:\\Users\\Admin\\smss.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\", \"C:\\Windows\\tracing\\sppsvc.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Setup\\spoolsv.exe\", \"C:\\Windows\\tracing\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\System.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\spoolsv.exe\", \"C:\\Program Files\\DVD Maker\\en-US\\csrss.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsm.exe\", \"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\", \"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Public\\Favorites\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\audiodg.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\taskhost.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\ja-JP\\lsm.exe\", \"C:\\MSOCache\\All Users\\WmiPrvSE.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\lsass.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	424	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	524	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	2184	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2184	schtasks.exe	30

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

DCRat payload 11 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2408-1-0x00000000008D0000-0x0000000000A38000-memory.dmp	dcrat
behavioral1/files/0x0005000000019515-18.dat	dcrat
behavioral1/memory/2800-54-0x00000000003A0000-0x0000000000508000-memory.dmp	dcrat
behavioral1/memory/2192-65-0x0000000000950000-0x0000000000AB8000-memory.dmp	dcrat
behavioral1/memory/1744-77-0x0000000000280000-0x00000000003E8000-memory.dmp	dcrat
behavioral1/memory/1884-89-0x0000000000900000-0x0000000000A68000-memory.dmp	dcrat
behavioral1/memory/2656-101-0x0000000001140000-0x00000000012A8000-memory.dmp	dcrat
behavioral1/memory/1108-135-0x00000000001C0000-0x0000000000328000-memory.dmp	dcrat
behavioral1/memory/1060-147-0x00000000011F0000-0x0000000001358000-memory.dmp	dcrat
behavioral1/memory/1488-159-0x0000000000230000-0x0000000000398000-memory.dmp	dcrat
behavioral1/memory/3004-171-0x0000000000F20000-0x0000000001088000-memory.dmp	dcrat

Executes dropped EXE 11 IoCs

pid	Process
2800	winlogon.exe
2192	winlogon.exe
1744	winlogon.exe
1884	winlogon.exe
2656	winlogon.exe
2120	winlogon.exe
1556	winlogon.exe
1108	winlogon.exe
1060	winlogon.exe
1488	winlogon.exe
3004	winlogon.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\OSPPSVC.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Public\\Favorites\\dwm.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\audiodg.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files\\Windows NT\\Accessories\\ja-JP\\lsm.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\MSOCache\\All Users\\WmiPrvSE.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\tracing\\sppsvc.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\winlogon.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\lsass.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Public\\Documents\\My Videos\\spoolsv.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsm.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\lsass.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\lsass.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\MSOCache\\All Users\\System.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\winlogon.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files\\Windows NT\\Accessories\\ja-JP\\lsm.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Admin\\smss.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\tracing\\sppsvc.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\MSOCache\\All Users\\System.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Public\\Documents\\My Videos\\spoolsv.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\DVD Maker\\en-US\\csrss.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsm.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\MSOCache\\All Users\\WmiPrvSE.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Admin\\smss.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\Setup\\spoolsv.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\taskhost.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Recovery\\31f19e42-8726-11ef-be9a-dab21757c799\\OSPPSVC.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\csrss.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\csrss.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Public\\Favorites\\dwm.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\taskhost.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\DVD Maker\\en-US\\csrss.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\audiodg.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\lsass.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\Setup\\spoolsv.exe\""	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\Windows NT\Accessories\ja-JP\101b941d020240	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\6203df4a6bafc7	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\101b941d020240	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\b75386f1303e64	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
File created	C:\Program Files\Windows NT\Accessories\ja-JP\lsm.exe	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\taskhost.exe	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\lsass.exe	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
File created	C:\Program Files\DVD Maker\en-US\csrss.exe	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
File created	C:\Program Files\DVD Maker\en-US\886983d96e3d3e	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
File created	C:\Program Files (x86)\MSBuild\f3b6ecef712a24	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsm.exe	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\lsass.exe	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\6203df4a6bafc7	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
File created	C:\Program Files (x86)\MSBuild\spoolsv.exe	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Setup\spoolsv.exe	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
File created	C:\Windows\Setup\f3b6ecef712a24	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
File created	C:\Windows\tracing\sppsvc.exe	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
File created	C:\Windows\tracing\0a1fd5f707cd16	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
File created	C:\Windows\Setup\spoolsv.exe	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2684	schtasks.exe
1616	schtasks.exe
1836	schtasks.exe
2264	schtasks.exe
2172	schtasks.exe
2764	schtasks.exe
2316	schtasks.exe
1588	schtasks.exe
2740	schtasks.exe
2580	schtasks.exe
1460	schtasks.exe
2412	schtasks.exe
1448	schtasks.exe
2820	schtasks.exe
992	schtasks.exe
1696	schtasks.exe
424	schtasks.exe
2208	schtasks.exe
968	schtasks.exe
1612	schtasks.exe
2480	schtasks.exe
1736	schtasks.exe
2788	schtasks.exe
1636	schtasks.exe
2828	schtasks.exe
948	schtasks.exe
1016	schtasks.exe
868	schtasks.exe
3004	schtasks.exe
2632	schtasks.exe
1168	schtasks.exe
1672	schtasks.exe
2664	schtasks.exe
660	schtasks.exe
1376	schtasks.exe
2884	schtasks.exe
2248	schtasks.exe
1764	schtasks.exe
1592	schtasks.exe
2748	schtasks.exe
2252	schtasks.exe
524	schtasks.exe
2332	schtasks.exe
2288	schtasks.exe
2504	schtasks.exe
2604	schtasks.exe
1044	schtasks.exe
2224	schtasks.exe
2376	schtasks.exe
2940	schtasks.exe
2232	schtasks.exe
2600	schtasks.exe
1536	schtasks.exe
3028	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
2800	winlogon.exe
2192	winlogon.exe
1744	winlogon.exe
1884	winlogon.exe
2656	winlogon.exe
2120	winlogon.exe
1556	winlogon.exe
1108	winlogon.exe
1060	winlogon.exe
1488	winlogon.exe
3004	winlogon.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Token: SeDebugPrivilege	2800	winlogon.exe
Token: SeDebugPrivilege	2192	winlogon.exe
Token: SeDebugPrivilege	1744	winlogon.exe
Token: SeDebugPrivilege	1884	winlogon.exe
Token: SeDebugPrivilege	2656	winlogon.exe
Token: SeDebugPrivilege	2120	winlogon.exe
Token: SeDebugPrivilege	1556	winlogon.exe
Token: SeDebugPrivilege	1108	winlogon.exe
Token: SeDebugPrivilege	1060	winlogon.exe
Token: SeDebugPrivilege	1488	winlogon.exe
Token: SeDebugPrivilege	3004	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2564	2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe	85
PID 2408 wrote to memory of 2564	2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe	85
PID 2408 wrote to memory of 2564	2408	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe	85
PID 2564 wrote to memory of 3056	2564	cmd.exe	87
PID 2564 wrote to memory of 3056	2564	cmd.exe	87
PID 2564 wrote to memory of 3056	2564	cmd.exe	87
PID 2564 wrote to memory of 2800	2564	cmd.exe	88
PID 2564 wrote to memory of 2800	2564	cmd.exe	88
PID 2564 wrote to memory of 2800	2564	cmd.exe	88
PID 2800 wrote to memory of 2792	2800	winlogon.exe	89
PID 2800 wrote to memory of 2792	2800	winlogon.exe	89
PID 2800 wrote to memory of 2792	2800	winlogon.exe	89
PID 2800 wrote to memory of 2884	2800	winlogon.exe	90
PID 2800 wrote to memory of 2884	2800	winlogon.exe	90
PID 2800 wrote to memory of 2884	2800	winlogon.exe	90
PID 2792 wrote to memory of 2192	2792	WScript.exe	91
PID 2792 wrote to memory of 2192	2792	WScript.exe	91
PID 2792 wrote to memory of 2192	2792	WScript.exe	91
PID 2192 wrote to memory of 672	2192	winlogon.exe	92
PID 2192 wrote to memory of 672	2192	winlogon.exe	92
PID 2192 wrote to memory of 672	2192	winlogon.exe	92
PID 2192 wrote to memory of 1968	2192	winlogon.exe	93
PID 2192 wrote to memory of 1968	2192	winlogon.exe	93
PID 2192 wrote to memory of 1968	2192	winlogon.exe	93
PID 672 wrote to memory of 1744	672	WScript.exe	94
PID 672 wrote to memory of 1744	672	WScript.exe	94
PID 672 wrote to memory of 1744	672	WScript.exe	94
PID 1744 wrote to memory of 2236	1744	winlogon.exe	95
PID 1744 wrote to memory of 2236	1744	winlogon.exe	95
PID 1744 wrote to memory of 2236	1744	winlogon.exe	95
PID 1744 wrote to memory of 1792	1744	winlogon.exe	96
PID 1744 wrote to memory of 1792	1744	winlogon.exe	96
PID 1744 wrote to memory of 1792	1744	winlogon.exe	96
PID 2236 wrote to memory of 1884	2236	WScript.exe	97
PID 2236 wrote to memory of 1884	2236	WScript.exe	97
PID 2236 wrote to memory of 1884	2236	WScript.exe	97
PID 1884 wrote to memory of 2676	1884	winlogon.exe	98
PID 1884 wrote to memory of 2676	1884	winlogon.exe	98
PID 1884 wrote to memory of 2676	1884	winlogon.exe	98
PID 1884 wrote to memory of 1648	1884	winlogon.exe	99
PID 1884 wrote to memory of 1648	1884	winlogon.exe	99
PID 1884 wrote to memory of 1648	1884	winlogon.exe	99
PID 2676 wrote to memory of 2656	2676	WScript.exe	100
PID 2676 wrote to memory of 2656	2676	WScript.exe	100
PID 2676 wrote to memory of 2656	2676	WScript.exe	100
PID 2656 wrote to memory of 1208	2656	winlogon.exe	101
PID 2656 wrote to memory of 1208	2656	winlogon.exe	101
PID 2656 wrote to memory of 1208	2656	winlogon.exe	101
PID 2656 wrote to memory of 3024	2656	winlogon.exe	102
PID 2656 wrote to memory of 3024	2656	winlogon.exe	102
PID 2656 wrote to memory of 3024	2656	winlogon.exe	102
PID 1208 wrote to memory of 2120	1208	WScript.exe	103
PID 1208 wrote to memory of 2120	1208	WScript.exe	103
PID 1208 wrote to memory of 2120	1208	WScript.exe	103
PID 2120 wrote to memory of 2008	2120	winlogon.exe	104
PID 2120 wrote to memory of 2008	2120	winlogon.exe	104
PID 2120 wrote to memory of 2008	2120	winlogon.exe	104
PID 2120 wrote to memory of 264	2120	winlogon.exe	105
PID 2120 wrote to memory of 264	2120	winlogon.exe	105
PID 2120 wrote to memory of 264	2120	winlogon.exe	105
PID 2008 wrote to memory of 1556	2008	WScript.exe	106
PID 2008 wrote to memory of 1556	2008	WScript.exe	106
PID 2008 wrote to memory of 1556	2008	WScript.exe	106
PID 1556 wrote to memory of 1444	1556	winlogon.exe	107

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
"C:\Users\Admin\AppData\Local\Temp\501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kAPuqzhMGP.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3056
- - C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
    "C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2800
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aff566d1-e65c-42e5-8bd6-efdf3e3ca4c5.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2792
    - - C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2192
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52db4f62-e7ed-48ce-a3c2-d75318427712.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:672
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1744
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\35c9273d-0b39-4bf5-9e48-4f7b284d520f.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6f8968bd-3835-4efc-94a0-b06be3eb0e83.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2656
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\45e496e1-2010-4e49-b65a-5b621567378c.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1208
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2120
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\69403930-5ba0-4822-8d5c-5d0dd0de775f.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1556
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\54823048-3ccc-4a21-997a-2a4a68d04ce6.vbs"
        16⤵
        
        PID:1444
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1108
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43d2f58c-13b8-43ad-9917-671692360d86.vbs"
        18⤵
        
        PID:2236
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6dd6ca9d-74b7-4a70-ae0e-578a1943ed7e.vbs"
        20⤵
        
        PID:2968
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        21⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\73945727-0939-4350-9213-bca2eabc186f.vbs"
        22⤵
        
        PID:1992
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        
        C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe
        23⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3004
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6460a4b9-503b-4e28-995b-3fb77aed25fe.vbs"
        24⤵
        
        PID:2720
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e121ab4b-676e-4488-8a7a-29ca5b340ff1.vbs"
        24⤵
        
        PID:1588
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b2c3b8d-57ee-4c40-aba2-76a5a0176cb1.vbs"
        22⤵
        
        PID:2380
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e8d45a2-d7e8-4dd4-bd19-29ef1bcc1aaf.vbs"
        20⤵
        
        PID:2100
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d059ff32-b2fc-4b80-a8db-fa0a396f4c08.vbs"
        18⤵
        
        PID:2664
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10cacfb7-52fe-41a3-9b5f-a82a74ab07e4.vbs"
        16⤵
        
        PID:2692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32fe3a47-fb9a-475d-a18b-9d1942d9e3bc.vbs"
        14⤵
        
        PID:264
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e0e19e1-8055-44e1-aeb2-6b0c7a8817d0.vbs"
        12⤵
        
        PID:3024
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0943be2-4b54-4c73-99c1-c7f82ffac34d.vbs"
        10⤵
        
        PID:1648
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f9e6d29-fa20-482f-9f66-3583d433b2e6.vbs"
        8⤵
        
        PID:1792
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb38a2a8-8f17-4c37-8982-29f49c76d046.vbs"
        6⤵
        
        PID:1968
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c85d7574-645f-411e-aa11-9ec7388491d3.vbs"
      4⤵
      PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Windows\Setup\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Setup\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\Setup\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Windows\tracing\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\tracing\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\tracing\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Documents\My Videos\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Videos\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Documents\My Videos\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\DVD Maker\en-US\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\DVD Maker\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\OSPPSVC.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Favorites\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Favorites\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Favorites\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\Accessories\ja-JP\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\ja-JP\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\Accessories\ja-JP\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Admin\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\DVD Maker\en-US\csrss.exe

Filesize
1.4MB

MD5
181d043c0617914801548f09d5b776d4

SHA1
757f042065a3dc2c9f73e635b41f83591c8ad647

SHA256
501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad

SHA512
c56897c04b11db7c09ef21be8fe6a541c3c9ffb428b3e1340fce5b035f9f74bb133b57e7cc0852730efd20b4a49da0e8a79b6390f105d18f9fb39461559be574

Download Submit
C:\Users\Admin\AppData\Local\Temp\35c9273d-0b39-4bf5-9e48-4f7b284d520f.vbs

Filesize
737B

MD5
08f878eff2b401fe1eb5304521b13792

SHA1
2daa8fda118c025e99d1396e29192d9d5fcb4fe0

SHA256
fc769da49c9e29b7a8e39932bad5fc9f9c37200b8ad23322455077bb651ab246

SHA512
ef6c576052d4dcc6dbeb0fdf6de1dfea1baca693562dcac7f9488f4374014f9b0e0966abd48fb345b182791d9474dc7e1fd7c20742577477b6e6f0a180d5309d

Download Submit
C:\Users\Admin\AppData\Local\Temp\43d2f58c-13b8-43ad-9917-671692360d86.vbs

Filesize
737B

MD5
deb09cfb2578f0e8fb24d55299939a5d

SHA1
ef8399f9e3bbb64a5debffa3df8c002e83e6daa7

SHA256
9b7afbf1ade8405a06ece64459cd0989f9f9c5535330c74204ee28fed06a5592

SHA512
8c43aa39fcbb139626972d9484495da3d5918e2d4aa363194c4eb4a8995755d27556fbd37e57619497ad34520d98c219f8d8a6e99314829bf4b48348625cdc63

Download Submit
C:\Users\Admin\AppData\Local\Temp\45e496e1-2010-4e49-b65a-5b621567378c.vbs

Filesize
737B

MD5
25d484e9c7a9a72ec4a0619db23b70ac

SHA1
6bf0d98ef60bae1478c16fc02d4c599fecddc786

SHA256
09bcde2e4954a0b899126547cfe891fb31b0222a41d8ea1aca41b61f4d1984aa

SHA512
378f96361672316ea5e009d2e12bd7dfa526dd2006eead01e941913e6e65dd7efce5e066c25cb9986cd7782bbab8af1de3628bd4ed7a2676ae2dfa87760a0ed2

Download Submit
C:\Users\Admin\AppData\Local\Temp\52db4f62-e7ed-48ce-a3c2-d75318427712.vbs

Filesize
737B

MD5
2a2b7a5d47f5a39e346daac41c62d2f0

SHA1
b4561efb42ee5141f070317dd6e69f4bb814eced

SHA256
61d66731b32413eb82986ab76e2a903517db10ba145b0d616c8dc947134f248e

SHA512
58253d67c594be42dd3104a5a12ada70b3cdd15873b8304d804fa15518e327feaa365b66abd1974e95cf98dc062bf0baa1f74bd19a1e16d749be609bfdcb947c

Download Submit
C:\Users\Admin\AppData\Local\Temp\54823048-3ccc-4a21-997a-2a4a68d04ce6.vbs

Filesize
737B

MD5
9c08a189ba698005d59b345832d45df4

SHA1
a05256f09630bc554e5cb2437c6e92fa327359f9

SHA256
84b5540bf11489e38c9e8e686a48d4b27d733617630818915bf0afeb16e53e54

SHA512
470120bb253726e93080ee454ab110765836857348285fda39183cf6b0a5ba74613112688cf70c4c4e5fcfbe287dd7178734a2bedbeb0df6013b3cfa4f0cea80

Download Submit
C:\Users\Admin\AppData\Local\Temp\6460a4b9-503b-4e28-995b-3fb77aed25fe.vbs

Filesize
737B

MD5
8655b679bd7123a047c623d48e495ed6

SHA1
a6eafa7b1dbd5e17ec8542f008b6b82897245800

SHA256
b8bbe3d3e5b90adcf6cd499b0ece93a995311f67f589700113f5a55868879fb4

SHA512
4fe546d303b4b8d910e185dd5c6e73fcf4fe9f5b90dad912a59dff51221787d0f58aeebe44d6d4210897ccceee2f05a80b9845ec17a0a6feae66ea0b7d3e9a4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\69403930-5ba0-4822-8d5c-5d0dd0de775f.vbs

Filesize
737B

MD5
0f6a8f74d30d2919c6ba9774d013cfc9

SHA1
7d42f711875f4b7d534a273a0eed802c5cfd1489

SHA256
f7bbda85384002d81024f5558915db6cf6c9eeff5943c1fde1b7a976a97568b9

SHA512
8a2b5286c0c07f0980733d9603ef32506b1d8deb49678b8ddf7647688a49e84786a526afd42a6cec8c5ae1eaef0e6b5c3d39b11a02c2d611aa21304e5001b1bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\6dd6ca9d-74b7-4a70-ae0e-578a1943ed7e.vbs

Filesize
737B

MD5
09e1bd4d8c092b49ca18e5ff4f5158a1

SHA1
0f19d9473fedf68e749d22d802bcf356d15437f3

SHA256
1e6d07f6a783ba6e05643bc3e34f1667b6ac740cc09df77a0606963a58eb83b4

SHA512
ec3151d456a09de0a8dfe73a592fc43249a7182d2fef6b3656854f80d05ff1ea8862ff352f4b747fa21928a068a26fd72343d6d78812a92b922b3def4f5950e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\6f8968bd-3835-4efc-94a0-b06be3eb0e83.vbs

Filesize
737B

MD5
363f454b5fecc12be19b9d35e24efd69

SHA1
6a2eba5a06caa1c0d42afff76163b65a206f7a56

SHA256
0dfcf3b746623c1a04b274dcdff5ec070ccf07a2bef65051561e35de812eb9d3

SHA512
345ed01663946b84b51375b1a9c695acc80a9fbfda2dee8d97298fe7f09ac3598d5a0943c5f46c77db3b511cd830385dababb31664a2ba5365627d870f831728

Download Submit
C:\Users\Admin\AppData\Local\Temp\73945727-0939-4350-9213-bca2eabc186f.vbs

Filesize
737B

MD5
976e2b536c01012510ba63cfd962b06b

SHA1
71a9599cb4342550319397623273eaf94f64f431

SHA256
76280576f8e577a7a87609fb3555e8a1e68862a0c70d40e17a56a1a3685db87d

SHA512
a5cf5f6a886e403c23bbfce0f65fe570343fd84bcdeed92fea640aeae05d609d241adc159b2f4ce19e5f77300b38911ade3f918b28018a4ceabcfa977405cb4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\aff566d1-e65c-42e5-8bd6-efdf3e3ca4c5.vbs

Filesize
737B

MD5
efd3d1c40832eaf14e0b0f29bb8ebdc5

SHA1
6e381047d2f149d0829c61f2342545217f9fab2d

SHA256
26e77bedac8dd4a7e0cfed150f8047cfb1bbb2755ad938650fc8d6b1fa075a1c

SHA512
ed34e22429aea1ba2591cea2483fd0fc38ed45e8e26b46262fee500b9a72320e0a0e0583cce8872c991a41365c8e9e1f8082b6ba8093f86501d6178890a08bd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\c85d7574-645f-411e-aa11-9ec7388491d3.vbs

Filesize
513B

MD5
55a39434bd65fecb70779341ccd295e1

SHA1
9bfacd2df7f5cfc88263d12ace25c774e578e34a

SHA256
9cb84daeec9d55ae206db320ace93da4472ced84cef0d1642167a49a281c7ea9

SHA512
e49e926c829e1a25ccd41002169b74f0eaaabd3210b7808204a5dd84ce6df3cfc3d04cce6639d914126553e5f253de59bbcd70a24212de38315865865703b70a

Download Submit
C:\Users\Admin\AppData\Local\Temp\kAPuqzhMGP.bat

Filesize
226B

MD5
4d1d0ef689377ba1b0f79234ebc58e21

SHA1
0a19933f4996a6ce851bd0678c19b92d5bbbb009

SHA256
55cefc489ddbe94fd2fbe7fa5c5bd6b9eeec7fd765c19f35c5e06ffd3aa08851

SHA512
fddae10e7f3ffd5622b7d86443be89b42f946e327b90f2b9dad9e9b2821eb656a56574a389dc9f4338ba1d42f4259921423d5446031b7e3598bc39b324df30a7

Download Submit
memory/1060-147-0x00000000011F0000-0x0000000001358000-memory.dmp

Filesize
1.4MB

Download
memory/1108-135-0x00000000001C0000-0x0000000000328000-memory.dmp

Filesize
1.4MB

Download
memory/1488-159-0x0000000000230000-0x0000000000398000-memory.dmp

Filesize
1.4MB

Download
memory/1744-77-0x0000000000280000-0x00000000003E8000-memory.dmp

Filesize
1.4MB

Download
memory/1884-89-0x0000000000900000-0x0000000000A68000-memory.dmp

Filesize
1.4MB

Download
memory/2192-65-0x0000000000950000-0x0000000000AB8000-memory.dmp

Filesize
1.4MB

Download
memory/2408-7-0x0000000000440000-0x000000000044C000-memory.dmp

Filesize
48KB

Download
memory/2408-0-0x000007FEF5163000-0x000007FEF5164000-memory.dmp

Filesize
4KB

Download
memory/2408-1-0x00000000008D0000-0x0000000000A38000-memory.dmp

Filesize
1.4MB

Download
memory/2408-51-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

Filesize
9.9MB

Download
memory/2408-9-0x0000000002060000-0x000000000206E000-memory.dmp

Filesize
56KB

Download
memory/2408-8-0x0000000001FD0000-0x0000000001FDA000-memory.dmp

Filesize
40KB

Download
memory/2408-2-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

Filesize
9.9MB

Download
memory/2408-6-0x0000000000430000-0x000000000043A000-memory.dmp

Filesize
40KB

Download
memory/2408-3-0x00000000003F0000-0x000000000040C000-memory.dmp

Filesize
112KB

Download
memory/2408-5-0x00000000001E0000-0x00000000001F0000-memory.dmp

Filesize
64KB

Download
memory/2408-4-0x0000000000410000-0x0000000000426000-memory.dmp

Filesize
88KB

Download
memory/2656-101-0x0000000001140000-0x00000000012A8000-memory.dmp

Filesize
1.4MB

Download
memory/2800-54-0x00000000003A0000-0x0000000000508000-memory.dmp

Filesize
1.4MB

Download
memory/3004-171-0x0000000000F20000-0x0000000001088000-memory.dmp

Filesize
1.4MB

Download