dcrat | d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 11:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Size

1.4MB
MD5

b8324173f87ae8a5c69a1e3f7ce33e1a
SHA1

882bec5816d33f1d1c58be5244e3c2dfbf62b184
SHA256

d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073
SHA512

dccd1c3d1f6bc33011e377bdd1fda0bca5116326de8b5b219d977e7d9c16ad214eaf717eabf2730bdacb3c68dce5aedeb5f459af58b27765bdab95549b7b9a14
SSDEEP

24576:6oIREGQw97lGTIYskQyxNtGSKERqWzAcqGv+3spCElJz009I+LUy:gRdGcHkBxNYARdzAcqGv+cphlJzxVV

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 55 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exed631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	pid	Process
		828	schtasks.exe
		2128	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
		2172	schtasks.exe
		2124	schtasks.exe
		1096	schtasks.exe
		912	schtasks.exe
		2020	schtasks.exe
		2820	schtasks.exe
		2728	schtasks.exe
		2588	schtasks.exe
		1776	schtasks.exe
		3028	schtasks.exe
		776	schtasks.exe
		1496	schtasks.exe
		2984	schtasks.exe
		2988	schtasks.exe
		2848	schtasks.exe
		2096	schtasks.exe
		1484	schtasks.exe
		2524	schtasks.exe
		2224	schtasks.exe
		1764	schtasks.exe
		2540	schtasks.exe
		2180	schtasks.exe
		2056	schtasks.exe
		2584	schtasks.exe
		2268	schtasks.exe
		692	schtasks.exe
		2060	schtasks.exe
		856	schtasks.exe
		2692	schtasks.exe
		3032	schtasks.exe
		1336	schtasks.exe
		2288	schtasks.exe
		1128	schtasks.exe
		900	schtasks.exe
		284	schtasks.exe
		1512	schtasks.exe
		996	schtasks.exe
		2800	schtasks.exe
		2996	schtasks.exe
		1140	schtasks.exe
		2604	schtasks.exe
		2732	schtasks.exe
		2568	schtasks.exe
		2204	schtasks.exe
		592	schtasks.exe
		1272	schtasks.exe
		2900	schtasks.exe
		2116	schtasks.exe
		2064	schtasks.exe
		1780	schtasks.exe
		1432	schtasks.exe
		788	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	284	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	788	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2704	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	2704	schtasks.exe	30

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

spoolsv.exed631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/2888-1-0x0000000000B90000-0x0000000000CF8000-memory.dmp	dcrat
behavioral1/files/0x0009000000016ca5-18.dat	dcrat
behavioral1/memory/1388-54-0x0000000000190000-0x00000000002F8000-memory.dmp	dcrat
behavioral1/memory/2724-65-0x00000000000D0000-0x0000000000238000-memory.dmp	dcrat
behavioral1/memory/1520-77-0x0000000000950000-0x0000000000AB8000-memory.dmp	dcrat
behavioral1/memory/2096-89-0x0000000000F90000-0x00000000010F8000-memory.dmp	dcrat
behavioral1/memory/2060-126-0x00000000013E0000-0x0000000001548000-memory.dmp	dcrat
behavioral1/memory/2436-160-0x0000000000250000-0x00000000003B8000-memory.dmp	dcrat

Executes dropped EXE 11 IoCs

Processes:

spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	Process
1388	spoolsv.exe
2724	spoolsv.exe
1520	spoolsv.exe
2096	spoolsv.exe
856	spoolsv.exe
2732	spoolsv.exe
3000	spoolsv.exe
2060	spoolsv.exe
2764	spoolsv.exe
2500	spoolsv.exe
2436	spoolsv.exe

Adds Run key to start application 2 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\services.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\Globalization\\Sorting\\explorer.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\Fonts\\dwm.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Users\\Default\\SendTo\\lsm.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Common Files\\spoolsv.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\WmiPrvSE.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\smss.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\System.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\Fonts\\dwm.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Users\\Default\\SendTo\\lsm.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Admin\\System.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files\\Windows Media Player\\ja-JP\\taskhost.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\All Users\\Application Data\\Idle.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\Globalization\\Sorting\\explorer.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073 = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073 = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\System.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files\\Windows Media Player\\ja-JP\\taskhost.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\csrss.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\WmiPrvSE.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\smss.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\csrss.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Default User\\WmiPrvSE.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Common Files\\spoolsv.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Default User\\WmiPrvSE.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Admin\\System.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\All Users\\Application Data\\Idle.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\services.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exed631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe

Drops file in Program Files directory 10 IoCs

Processes:

d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\fr-FR\WmiPrvSE.exe	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\24dbde2999530e	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
File created	C:\Program Files\Common Files\spoolsv.exe	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
File created	C:\Program Files\Common Files\f3b6ecef712a24	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\WmiPrvSE.exe	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\24dbde2999530e	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\services.exe	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\c5b4cb5e9653cc	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
File created	C:\Program Files\Windows Media Player\ja-JP\taskhost.exe	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
File created	C:\Program Files\Windows Media Player\ja-JP\b75386f1303e64	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe

Drops file in Windows directory 6 IoCs

Processes:

d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe

description	ioc	Process
File created	C:\Windows\security\ApplicationId\PolicyManagement\Idle.exe	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
File created	C:\Windows\security\ApplicationId\PolicyManagement\6ccacd8608530f	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
File created	C:\Windows\Fonts\dwm.exe	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
File created	C:\Windows\Fonts\6cb0b6c459d5d3	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
File created	C:\Windows\Globalization\Sorting\explorer.exe	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
File created	C:\Windows\Globalization\Sorting\7a0fd90576e088	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
2128	schtasks.exe
2096	schtasks.exe
2064	schtasks.exe
2800	schtasks.exe
2116	schtasks.exe
2524	schtasks.exe
1272	schtasks.exe
776	schtasks.exe
2224	schtasks.exe
2588	schtasks.exe
2984	schtasks.exe
2584	schtasks.exe
1140	schtasks.exe
828	schtasks.exe
2180	schtasks.exe
2604	schtasks.exe
2172	schtasks.exe
1776	schtasks.exe
2848	schtasks.exe
2060	schtasks.exe
2204	schtasks.exe
1484	schtasks.exe
2692	schtasks.exe
2988	schtasks.exe
2124	schtasks.exe
912	schtasks.exe
2732	schtasks.exe
1096	schtasks.exe
692	schtasks.exe
1764	schtasks.exe
856	schtasks.exe
3032	schtasks.exe
996	schtasks.exe
592	schtasks.exe
1432	schtasks.exe
2020	schtasks.exe
2288	schtasks.exe
284	schtasks.exe
1780	schtasks.exe
1496	schtasks.exe
3028	schtasks.exe
2996	schtasks.exe
2056	schtasks.exe
2820	schtasks.exe
2728	schtasks.exe
788	schtasks.exe
1336	schtasks.exe
2900	schtasks.exe
2268	schtasks.exe
900	schtasks.exe
1128	schtasks.exe
1512	schtasks.exe
2540	schtasks.exe
2568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	Process
2888	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
2888	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
2888	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
1388	spoolsv.exe
2724	spoolsv.exe
1520	spoolsv.exe
2096	spoolsv.exe
2732	spoolsv.exe
3000	spoolsv.exe
2060	spoolsv.exe
2764	spoolsv.exe
2500	spoolsv.exe
2436	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

description	pid	Process
Token: SeDebugPrivilege	2888	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Token: SeDebugPrivilege	1388	spoolsv.exe
Token: SeDebugPrivilege	2724	spoolsv.exe
Token: SeDebugPrivilege	1520	spoolsv.exe
Token: SeDebugPrivilege	2096	spoolsv.exe
Token: SeDebugPrivilege	2732	spoolsv.exe
Token: SeDebugPrivilege	3000	spoolsv.exe
Token: SeDebugPrivilege	2060	spoolsv.exe
Token: SeDebugPrivilege	2764	spoolsv.exe
Token: SeDebugPrivilege	2500	spoolsv.exe
Token: SeDebugPrivilege	2436	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.execmd.exespoolsv.exeWScript.exespoolsv.exeWScript.exespoolsv.exeWScript.exespoolsv.exeWScript.exeWScript.exespoolsv.exeWScript.exespoolsv.exeWScript.exe

description	pid	Process	procid_target
PID 2888 wrote to memory of 2956	2888	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe	85
PID 2888 wrote to memory of 2956	2888	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe	85
PID 2888 wrote to memory of 2956	2888	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe	85
PID 2956 wrote to memory of 3056	2956	cmd.exe	87
PID 2956 wrote to memory of 3056	2956	cmd.exe	87
PID 2956 wrote to memory of 3056	2956	cmd.exe	87
PID 2956 wrote to memory of 1388	2956	cmd.exe	88
PID 2956 wrote to memory of 1388	2956	cmd.exe	88
PID 2956 wrote to memory of 1388	2956	cmd.exe	88
PID 1388 wrote to memory of 2108	1388	spoolsv.exe	89
PID 1388 wrote to memory of 2108	1388	spoolsv.exe	89
PID 1388 wrote to memory of 2108	1388	spoolsv.exe	89
PID 1388 wrote to memory of 3060	1388	spoolsv.exe	90
PID 1388 wrote to memory of 3060	1388	spoolsv.exe	90
PID 1388 wrote to memory of 3060	1388	spoolsv.exe	90
PID 2108 wrote to memory of 2724	2108	WScript.exe	91
PID 2108 wrote to memory of 2724	2108	WScript.exe	91
PID 2108 wrote to memory of 2724	2108	WScript.exe	91
PID 2724 wrote to memory of 2620	2724	spoolsv.exe	93
PID 2724 wrote to memory of 2620	2724	spoolsv.exe	93
PID 2724 wrote to memory of 2620	2724	spoolsv.exe	93
PID 2724 wrote to memory of 2608	2724	spoolsv.exe	94
PID 2724 wrote to memory of 2608	2724	spoolsv.exe	94
PID 2724 wrote to memory of 2608	2724	spoolsv.exe	94
PID 2620 wrote to memory of 1520	2620	WScript.exe	95
PID 2620 wrote to memory of 1520	2620	WScript.exe	95
PID 2620 wrote to memory of 1520	2620	WScript.exe	95
PID 1520 wrote to memory of 2988	1520	spoolsv.exe	96
PID 1520 wrote to memory of 2988	1520	spoolsv.exe	96
PID 1520 wrote to memory of 2988	1520	spoolsv.exe	96
PID 1520 wrote to memory of 2172	1520	spoolsv.exe	97
PID 1520 wrote to memory of 2172	1520	spoolsv.exe	97
PID 1520 wrote to memory of 2172	1520	spoolsv.exe	97
PID 2988 wrote to memory of 2096	2988	WScript.exe	98
PID 2988 wrote to memory of 2096	2988	WScript.exe	98
PID 2988 wrote to memory of 2096	2988	WScript.exe	98
PID 2096 wrote to memory of 2284	2096	spoolsv.exe	99
PID 2096 wrote to memory of 2284	2096	spoolsv.exe	99
PID 2096 wrote to memory of 2284	2096	spoolsv.exe	99
PID 2096 wrote to memory of 1612	2096	spoolsv.exe	100
PID 2096 wrote to memory of 1612	2096	spoolsv.exe	100
PID 2096 wrote to memory of 1612	2096	spoolsv.exe	100
PID 2284 wrote to memory of 856	2284	WScript.exe	101
PID 2284 wrote to memory of 856	2284	WScript.exe	101
PID 2284 wrote to memory of 856	2284	WScript.exe	101
PID 2776 wrote to memory of 2732	2776	WScript.exe	104
PID 2776 wrote to memory of 2732	2776	WScript.exe	104
PID 2776 wrote to memory of 2732	2776	WScript.exe	104
PID 2732 wrote to memory of 1364	2732	spoolsv.exe	105
PID 2732 wrote to memory of 1364	2732	spoolsv.exe	105
PID 2732 wrote to memory of 1364	2732	spoolsv.exe	105
PID 2732 wrote to memory of 2968	2732	spoolsv.exe	106
PID 2732 wrote to memory of 2968	2732	spoolsv.exe	106
PID 2732 wrote to memory of 2968	2732	spoolsv.exe	106
PID 1364 wrote to memory of 3000	1364	WScript.exe	107
PID 1364 wrote to memory of 3000	1364	WScript.exe	107
PID 1364 wrote to memory of 3000	1364	WScript.exe	107
PID 3000 wrote to memory of 1084	3000	spoolsv.exe	108
PID 3000 wrote to memory of 1084	3000	spoolsv.exe	108
PID 3000 wrote to memory of 1084	3000	spoolsv.exe	108
PID 3000 wrote to memory of 1704	3000	spoolsv.exe	109
PID 3000 wrote to memory of 1704	3000	spoolsv.exe	109
PID 3000 wrote to memory of 1704	3000	spoolsv.exe	109
PID 1084 wrote to memory of 2060	1084	WScript.exe	110

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

Processes:

spoolsv.exed631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
"C:\Users\Admin\AppData\Local\Temp\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GspXHkBp0S.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3056
- - C:\Program Files\Common Files\spoolsv.exe
    "C:\Program Files\Common Files\spoolsv.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1388
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1becae17-b139-4a9e-9ca1-3f80e111a962.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2108
    - - C:\Program Files\Common Files\spoolsv.exe
        
        "C:\Program Files\Common Files\spoolsv.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2724
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ce645d9-c689-4db7-850e-ac17aee7d5b0.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Program Files\Common Files\spoolsv.exe
        
        "C:\Program Files\Common Files\spoolsv.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1520
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2c1fa256-b9fa-4d41-aaf7-09124ac6a41c.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Program Files\Common Files\spoolsv.exe
        
        "C:\Program Files\Common Files\spoolsv.exe"
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2096
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\deac9ebf-0ed5-4cb6-9345-1dd9be86db71.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Program Files\Common Files\spoolsv.exe
        
        "C:\Program Files\Common Files\spoolsv.exe"
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        System policy modification
        
        PID:856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\833131dd-3317-4ee5-b661-e256843b9b07.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Program Files\Common Files\spoolsv.exe
        
        "C:\Program Files\Common Files\spoolsv.exe"
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\93a1bff4-a02a-4b14-a949-c0e98d1e0fd6.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1364
        
        C:\Program Files\Common Files\spoolsv.exe
        
        "C:\Program Files\Common Files\spoolsv.exe"
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3000
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed5c6b01-989f-4248-a08d-33945b93fff1.vbs"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Program Files\Common Files\spoolsv.exe
        
        "C:\Program Files\Common Files\spoolsv.exe"
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6148fbe1-6a0c-4054-a296-10efae65c239.vbs"
        18⤵
        
        PID:2020
        
        C:\Program Files\Common Files\spoolsv.exe
        
        "C:\Program Files\Common Files\spoolsv.exe"
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5da01736-301c-4b8e-b4ab-c9a178a4eba0.vbs"
        20⤵
        
        PID:1916
        
        C:\Program Files\Common Files\spoolsv.exe
        
        "C:\Program Files\Common Files\spoolsv.exe"
        21⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2500
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb3feb4c-84e6-41f7-a17a-a1447717a302.vbs"
        22⤵
        
        PID:2360
        
        C:\Program Files\Common Files\spoolsv.exe
        
        "C:\Program Files\Common Files\spoolsv.exe"
        23⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2436
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\96d08dd6-e359-43ab-88d4-c62eab8d9f0b.vbs"
        24⤵
        
        PID:2196
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\06b7db4c-2e35-46ff-8630-b11dc3005d8f.vbs"
        24⤵
        
        PID:1600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\238b6c51-c1f8-4000-b8bb-cb730f99cf4d.vbs"
        22⤵
        
        PID:2384
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\56598047-1d51-404e-ba37-9032124816fc.vbs"
        20⤵
        
        PID:2088
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\076805f9-f012-4f16-83ec-0820b94aa512.vbs"
        18⤵
        
        PID:1592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\66635f4e-107e-4873-babd-cc8f2f38c7c6.vbs"
        16⤵
        
        PID:1704
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f7243497-da3c-4350-8eec-a5d583db187d.vbs"
        14⤵
        
        PID:2968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\576b4d4d-af11-42af-be6e-985384fb9edb.vbs"
        12⤵
        
        PID:2992
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\156079e7-06b6-4e23-986a-0f50ad18a257.vbs"
        10⤵
        
        PID:1612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15748abf-6fda-4fb8-b732-7efaf1aff5a6.vbs"
        8⤵
        
        PID:2172
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d8d17e7-9c03-4084-9c9c-cbe690f91163.vbs"
        6⤵
        
        PID:2608
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1fc18282-617a-4248-9af7-e8797ffbce5f.vbs"
      4⤵
      PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Windows\Globalization\Sorting\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Globalization\Sorting\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Windows\Globalization\Sorting\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Windows\security\ApplicationId\PolicyManagement\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\security\ApplicationId\PolicyManagement\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\security\ApplicationId\PolicyManagement\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073d" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073d" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\Fonts\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Fonts\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\Fonts\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Users\Default\SendTo\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Default\SendTo\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Users\Default\SendTo\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files\Common Files\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Common Files\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Media Player\ja-JP\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\ja-JP\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Media Player\ja-JP\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Application Data\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Application Data\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Defender\fr-FR\WmiPrvSE.exe

Filesize
1.4MB

MD5
b8324173f87ae8a5c69a1e3f7ce33e1a

SHA1
882bec5816d33f1d1c58be5244e3c2dfbf62b184

SHA256
d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073

SHA512
dccd1c3d1f6bc33011e377bdd1fda0bca5116326de8b5b219d977e7d9c16ad214eaf717eabf2730bdacb3c68dce5aedeb5f459af58b27765bdab95549b7b9a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\1becae17-b139-4a9e-9ca1-3f80e111a962.vbs

Filesize
717B

MD5
b4960cf576da18e61a6652e135b84339

SHA1
0227075a990bf17c0de56cb0351ac8d7fb12cb47

SHA256
400633388baab6767a6ad4ce461b8df2537f30b2fd8312edd23e6e14dad3455b

SHA512
2d1e4ecbf416519487e260fe4333c4b268383b5d709a5f772d40f3e163d3399f7cd1bce5f5898d4a761e93c8344bb470a724400210b7891a6e66e60070e72eac

Download Submit
C:\Users\Admin\AppData\Local\Temp\1ce645d9-c689-4db7-850e-ac17aee7d5b0.vbs

Filesize
717B

MD5
82da6d67ad167d280ce1c9c81b1fd120

SHA1
4b2bc6c0bd41590fa29527b717384f4d689b5591

SHA256
353b50939a8c79601491ed270d73f71c8b61828b2e34b796a3f350c9ed1da999

SHA512
e288d7e63550f0987ef20ea6351862e5094a360afd33e3c10ef4f8a2f00872bf9c763227b6d2b6f0c525717335e0a4c46de11194aa0adaaa61c3724428f2719b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1fc18282-617a-4248-9af7-e8797ffbce5f.vbs

Filesize
493B

MD5
6f969f054559fada3d0dfcafe3aa532f

SHA1
d5d58d53b2a572843548c440b6be6ea9a68b4250

SHA256
64490c17d9bbada6485bb9106b5f811891f86663f83a5a4a7fa887ed667589d7

SHA512
918236d5f5c9be26030a99ffd919d01f79d9783eb6a4a12c6edee7d90bc61749bd2cc4d22217f829eaa2d8d7dcbcae0581e80dac9867c24a2df4b70818020618

Download Submit
C:\Users\Admin\AppData\Local\Temp\2c1fa256-b9fa-4d41-aaf7-09124ac6a41c.vbs

Filesize
717B

MD5
7e7846542722894d7509966162c6460c

SHA1
7f500bfdad705a136c166f054cf40c57e0d166df

SHA256
2f6f48f98b2e457a94422738e955eb68237887851d0dadc428d07c2d9cf02657

SHA512
93f02ab548620e64ca372d674eebae3504420f1cf083e8b79d67e0468b954ff88396d9a4c7d2cb4bd1f271d841a039592f29f32e24015b5f2a6115bad36d5cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\5da01736-301c-4b8e-b4ab-c9a178a4eba0.vbs

Filesize
717B

MD5
2fbc9b84a3dfda3bb2a6ca7d7a84d4b5

SHA1
772a57cf6ba2dba9d8412b349e9d7b5f8331b6c1

SHA256
5a0e2717d4e2917fc9b4cd27a6eda18d5ba7f4f2ca770e1af90bd4de7d4126ca

SHA512
a49bc64a49f71d55f4fa577a1b69daf666caa07c1ec8df43704d9d1e7d187f46f98bdd0ab19b8ed2566bb3c43f229238395af660d38cb459a616c4e54a7593ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\6148fbe1-6a0c-4054-a296-10efae65c239.vbs

Filesize
717B

MD5
e89ce9a21ec39c25359fb50c4fa2a11a

SHA1
9a138d90a75c6c08017a32dff1ffa82abef62935

SHA256
26e9c4d2942b544dfe7771700dd8fc7841afa74899c783d5ef5ad7f17834e4c2

SHA512
dc0d54e9c56e140f0390e044edbea97638a0f38baac6f5e51bdf470c2a89025a20113c04232ba14e8a228e167bfd313c455f94eb10644e1d18ca70be1a469a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\93a1bff4-a02a-4b14-a949-c0e98d1e0fd6.vbs

Filesize
717B

MD5
439819e89e518599d9103ddb5ffa11d5

SHA1
e06e8e4e4f43d33e37583f4d4e61efe9b468dbfa

SHA256
f2a583f0b2ebe754f20d838be04d3b1f239deb4f50a652dc6c30ff33c25abfd1

SHA512
d30ae5e2fdc979d1808fa278c3f7a06efebc182026872c7fd20dcedffcd2a6f089f3c2d52237aefa3026dd3bdfc59fb9a8531e71d780ac416318805ff1328e05

Download Submit
C:\Users\Admin\AppData\Local\Temp\96d08dd6-e359-43ab-88d4-c62eab8d9f0b.vbs

Filesize
717B

MD5
46da879f94ea1feadd4b904f72ba9499

SHA1
2f0d7a24b293ed51770aec59477efe418792eddf

SHA256
ae043500fa12e6e3c915f8e2b153bc1607dcd3fe6926c309c322508c01181b83

SHA512
081661c45784aa98e6a4f287daa9804c0c1c28144a4d4be508aa203964bacdf2bf1471a0a06ae45c78345403ec787d6b92bf3d7d516af093e066a9076a8089d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\GspXHkBp0S.bat

Filesize
206B

MD5
858df111a93950914d827b3092cd2f7b

SHA1
a456e774ae69b0caf09dfa3023356d78c178eb39

SHA256
7c963967768c09cfabe9ad965a6c3133c461ddc5ba08b5dba486c14e2c064bd2

SHA512
53b9746fcb8071973f847beb4e8056a499f6fd99c6ea43460cfa8c292622fb9d444c2a5931a4edfb2819d992f9208e5f715a283007d3d387abbb176ac37c9c78

Download Submit
C:\Users\Admin\AppData\Local\Temp\deac9ebf-0ed5-4cb6-9345-1dd9be86db71.vbs

Filesize
717B

MD5
f01cebe3d3b2236c4753d939a470ce51

SHA1
25b861cf658795f7b41680b2ac57e019f0365758

SHA256
fd8cc65a26458df8bf909f356ff289e99b90f05ccda9c323864b5e84795f8bfd

SHA512
9a42a1a6bf2adb927ab694b0ca32be5427f9fc98c271dda04c951f3be9609c16974d200c6d5850d451ede34ab6d1dfd3dafb78bbf9bb022fb17822eb5cc62c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\ed5c6b01-989f-4248-a08d-33945b93fff1.vbs

Filesize
717B

MD5
68393ed11d8777384153bd212d8cb7ea

SHA1
d5107c596f45a275186842aacdb9b2e710dfd155

SHA256
5282ea4ef46e7697655afb264f85eeee90ff2b9cf3f502e828b07407495a8fc1

SHA512
55d722183ae987282ffbff516ba928127092b58d6c44583c301fabb2c42317c4cdbb1cfdc3b19978b6d56a8fc3fc4f1f4532bfef26973e642e53fb99489419cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\fb3feb4c-84e6-41f7-a17a-a1447717a302.vbs

Filesize
717B

MD5
68374fa44faa1ccff6099eb16c2448cc

SHA1
8dd8922c67caa8ea074d64c0f0f2e2d66d39b3c1

SHA256
3267bab5c614d5fada41301557bd620fdaba2db604e53dd526d699837f90bfcc

SHA512
e4b1175be4d5a1faf5b92d29cd96e9afe0a811457cfc1c40cbdb2ee6589493f234fac2abcfbfaede1c21eabe9b0a73602d635f35cc5233a006e4d518a4ffae97

Download Submit
memory/1388-54-0x0000000000190000-0x00000000002F8000-memory.dmp

Filesize
1.4MB

Download
memory/1520-77-0x0000000000950000-0x0000000000AB8000-memory.dmp

Filesize
1.4MB

Download
memory/2060-126-0x00000000013E0000-0x0000000001548000-memory.dmp

Filesize
1.4MB

Download
memory/2096-89-0x0000000000F90000-0x00000000010F8000-memory.dmp

Filesize
1.4MB

Download
memory/2436-160-0x0000000000250000-0x00000000003B8000-memory.dmp

Filesize
1.4MB

Download
memory/2724-65-0x00000000000D0000-0x0000000000238000-memory.dmp

Filesize
1.4MB

Download
memory/2888-7-0x0000000000420000-0x000000000042C000-memory.dmp

Filesize
48KB

Download
memory/2888-5-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2888-0-0x000007FEF5E33000-0x000007FEF5E34000-memory.dmp

Filesize
4KB

Download
memory/2888-4-0x00000000003E0000-0x00000000003F6000-memory.dmp

Filesize
88KB

Download
memory/2888-6-0x0000000000410000-0x000000000041A000-memory.dmp

Filesize
40KB

Download
memory/2888-9-0x0000000000440000-0x000000000044E000-memory.dmp

Filesize
56KB

Download
memory/2888-3-0x00000000001C0000-0x00000000001DC000-memory.dmp

Filesize
112KB

Download
memory/2888-2-0x000007FEF5E30000-0x000007FEF681C000-memory.dmp

Filesize
9.9MB

Download
memory/2888-8-0x0000000000430000-0x000000000043A000-memory.dmp

Filesize
40KB

Download
memory/2888-51-0x000007FEF5E30000-0x000007FEF681C000-memory.dmp

Filesize
9.9MB

Download
memory/2888-1-0x0000000000B90000-0x0000000000CF8000-memory.dmp

Filesize
1.4MB

Download

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\explorer.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\explorer.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\explorer.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\csrss.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\explorer.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\csrss.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe\", \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\System.exe\", \"C:\\Windows\\Fonts\\dwm.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\explorer.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\csrss.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe\", \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\System.exe\", \"C:\\Windows\\Fonts\\dwm.exe\", \"C:\\Users\\Default\\SendTo\\lsm.exe\", \"C:\\Program Files\\Common Files\\spoolsv.exe\", \"C:\\Users\\Admin\\System.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\services.exe\", \"C:\\Program Files\\Windows Media Player\\ja-JP\\taskhost.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\explorer.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\csrss.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe\", \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\System.exe\", \"C:\\Windows\\Fonts\\dwm.exe\", \"C:\\Users\\Default\\SendTo\\lsm.exe\", \"C:\\Program Files\\Common Files\\spoolsv.exe\", \"C:\\Users\\Admin\\System.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\services.exe\", \"C:\\Program Files\\Windows Media Player\\ja-JP\\taskhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\smss.exe\", \"C:\\Users\\All Users\\Application Data\\Idle.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\explorer.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\explorer.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\csrss.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe\", \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\System.exe\", \"C:\\Windows\\Fonts\\dwm.exe\", \"C:\\Users\\Default\\SendTo\\lsm.exe\", \"C:\\Program Files\\Common Files\\spoolsv.exe\", \"C:\\Users\\Admin\\System.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\WmiPrvSE.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\explorer.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\csrss.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\explorer.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\csrss.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\explorer.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\csrss.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe\", \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\System.exe\", \"C:\\Windows\\Fonts\\dwm.exe\", \"C:\\Users\\Default\\SendTo\\lsm.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\explorer.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\csrss.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe\", \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\System.exe\", \"C:\\Windows\\Fonts\\dwm.exe\", \"C:\\Users\\Default\\SendTo\\lsm.exe\", \"C:\\Program Files\\Common Files\\spoolsv.exe\", \"C:\\Users\\Admin\\System.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\explorer.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\csrss.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe\", \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\System.exe\", \"C:\\Windows\\Fonts\\dwm.exe\", \"C:\\Users\\Default\\SendTo\\lsm.exe\", \"C:\\Program Files\\Common Files\\spoolsv.exe\", \"C:\\Users\\Admin\\System.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\services.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\explorer.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\explorer.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\csrss.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe\", \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\System.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\explorer.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\csrss.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe\", \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\System.exe\", \"C:\\Windows\\Fonts\\dwm.exe\", \"C:\\Users\\Default\\SendTo\\lsm.exe\", \"C:\\Program Files\\Common Files\\spoolsv.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\explorer.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\csrss.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe\", \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\System.exe\", \"C:\\Windows\\Fonts\\dwm.exe\", \"C:\\Users\\Default\\SendTo\\lsm.exe\", \"C:\\Program Files\\Common Files\\spoolsv.exe\", \"C:\\Users\\Admin\\System.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\services.exe\", \"C:\\Program Files\\Windows Media Player\\ja-JP\\taskhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\smss.exe\""	d631d97e01717786e4b9e3bbafa89e90ce56d917a29697c8a7ed1cabd4d42073.exe