dcrat | 15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Size

4.9MB
MD5

0ebd2dc160f7d5627aef291ba8fe1723
SHA1

f19f6aae9588fa548e768924114b4a6ca6021c9e
SHA256

15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5
SHA512

aa5dd361118de60d42e5cb1fec62011cda145d721c04f736d2e27984e7eb478e884bacc5f5ac7b957d3e2786035341d1906886a0eed511ec3e54278e68dbc161
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx82:u

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2752	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2752	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2752	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	2752	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2752	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2752	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2752	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	2752	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2752	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2752	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2752	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2752	schtasks.exe	31

UAC bypass 3 TTPs 33 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/628-2-0x000000001B660000-0x000000001B78E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1976	powershell.exe
776	powershell.exe
668	powershell.exe
1644	powershell.exe
2260	powershell.exe
748	powershell.exe
2300	powershell.exe
2796	powershell.exe
2644	powershell.exe
2820	powershell.exe
2624	powershell.exe
1996	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
1696	OSPPSVC.exe
1736	OSPPSVC.exe
3008	OSPPSVC.exe
2268	OSPPSVC.exe
2848	OSPPSVC.exe
2000	OSPPSVC.exe
1424	OSPPSVC.exe
3016	OSPPSVC.exe
2568	OSPPSVC.exe
2228	OSPPSVC.exe

Checks whether UAC is enabled 1 TTPs 22 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2012	schtasks.exe
2140	schtasks.exe
2656	schtasks.exe
2892	schtasks.exe
2580	schtasks.exe
2608	schtasks.exe
2548	schtasks.exe
1612	schtasks.exe
2912	schtasks.exe
3000	schtasks.exe
2744	schtasks.exe
2808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
776	powershell.exe
2644	powershell.exe
2300	powershell.exe
1996	powershell.exe
1644	powershell.exe
2820	powershell.exe
668	powershell.exe
1976	powershell.exe
2260	powershell.exe
2796	powershell.exe
748	powershell.exe
2624	powershell.exe
1696	OSPPSVC.exe
1736	OSPPSVC.exe
3008	OSPPSVC.exe
2268	OSPPSVC.exe
2848	OSPPSVC.exe
2000	OSPPSVC.exe
1424	OSPPSVC.exe
3016	OSPPSVC.exe
2568	OSPPSVC.exe
2228	OSPPSVC.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Token: SeDebugPrivilege	776	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	1644	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	748	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	1696	OSPPSVC.exe
Token: SeDebugPrivilege	1736	OSPPSVC.exe
Token: SeDebugPrivilege	3008	OSPPSVC.exe
Token: SeDebugPrivilege	2268	OSPPSVC.exe
Token: SeDebugPrivilege	2848	OSPPSVC.exe
Token: SeDebugPrivilege	2000	OSPPSVC.exe
Token: SeDebugPrivilege	1424	OSPPSVC.exe
Token: SeDebugPrivilege	3016	OSPPSVC.exe
Token: SeDebugPrivilege	2568	OSPPSVC.exe
Token: SeDebugPrivilege	2228	OSPPSVC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 1976	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	44
PID 628 wrote to memory of 1976	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	44
PID 628 wrote to memory of 1976	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	44
PID 628 wrote to memory of 776	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	45
PID 628 wrote to memory of 776	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	45
PID 628 wrote to memory of 776	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	45
PID 628 wrote to memory of 748	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	46
PID 628 wrote to memory of 748	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	46
PID 628 wrote to memory of 748	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	46
PID 628 wrote to memory of 2300	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	48
PID 628 wrote to memory of 2300	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	48
PID 628 wrote to memory of 2300	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	48
PID 628 wrote to memory of 668	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	49
PID 628 wrote to memory of 668	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	49
PID 628 wrote to memory of 668	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	49
PID 628 wrote to memory of 2796	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	50
PID 628 wrote to memory of 2796	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	50
PID 628 wrote to memory of 2796	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	50
PID 628 wrote to memory of 2644	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	51
PID 628 wrote to memory of 2644	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	51
PID 628 wrote to memory of 2644	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	51
PID 628 wrote to memory of 1644	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	52
PID 628 wrote to memory of 1644	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	52
PID 628 wrote to memory of 1644	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	52
PID 628 wrote to memory of 2820	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	53
PID 628 wrote to memory of 2820	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	53
PID 628 wrote to memory of 2820	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	53
PID 628 wrote to memory of 2624	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	54
PID 628 wrote to memory of 2624	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	54
PID 628 wrote to memory of 2624	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	54
PID 628 wrote to memory of 1996	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	55
PID 628 wrote to memory of 1996	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	55
PID 628 wrote to memory of 1996	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	55
PID 628 wrote to memory of 2260	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	56
PID 628 wrote to memory of 2260	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	56
PID 628 wrote to memory of 2260	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	56
PID 628 wrote to memory of 1696	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	68
PID 628 wrote to memory of 1696	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	68
PID 628 wrote to memory of 1696	628	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	68
PID 1696 wrote to memory of 2580	1696	OSPPSVC.exe	69
PID 1696 wrote to memory of 2580	1696	OSPPSVC.exe	69
PID 1696 wrote to memory of 2580	1696	OSPPSVC.exe	69
PID 1696 wrote to memory of 2808	1696	OSPPSVC.exe	70
PID 1696 wrote to memory of 2808	1696	OSPPSVC.exe	70
PID 1696 wrote to memory of 2808	1696	OSPPSVC.exe	70
PID 2580 wrote to memory of 1736	2580	WScript.exe	71
PID 2580 wrote to memory of 1736	2580	WScript.exe	71
PID 2580 wrote to memory of 1736	2580	WScript.exe	71
PID 1736 wrote to memory of 2108	1736	OSPPSVC.exe	72
PID 1736 wrote to memory of 2108	1736	OSPPSVC.exe	72
PID 1736 wrote to memory of 2108	1736	OSPPSVC.exe	72
PID 1736 wrote to memory of 2456	1736	OSPPSVC.exe	73
PID 1736 wrote to memory of 2456	1736	OSPPSVC.exe	73
PID 1736 wrote to memory of 2456	1736	OSPPSVC.exe	73
PID 2108 wrote to memory of 3008	2108	WScript.exe	74
PID 2108 wrote to memory of 3008	2108	WScript.exe	74
PID 2108 wrote to memory of 3008	2108	WScript.exe	74
PID 3008 wrote to memory of 2220	3008	OSPPSVC.exe	75
PID 3008 wrote to memory of 2220	3008	OSPPSVC.exe	75
PID 3008 wrote to memory of 2220	3008	OSPPSVC.exe	75
PID 3008 wrote to memory of 2116	3008	OSPPSVC.exe	76
PID 3008 wrote to memory of 2116	3008	OSPPSVC.exe	76
PID 3008 wrote to memory of 2116	3008	OSPPSVC.exe	76
PID 2220 wrote to memory of 2268	2220	WScript.exe	77

System policy modification 1 TTPs 33 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
"C:\Users\Admin\AppData\Local\Temp\15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe
  "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1696
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b984f334-ccf0-474e-9b74-a41d5dca93b2.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe
      "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1736
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\21dbb042-2552-4a5a-a2b3-d0bafb3b1de7.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2108
      - C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67e286f8-2eb5-40a2-ad75-0a95c3eb9a9c.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2268
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5759517-7e64-4f48-bae3-69776f36b39f.vbs"
        9⤵
        
        PID:2180
        
        C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b444383-edb0-4f8a-b6b2-313a2a93619e.vbs"
        11⤵
        
        PID:1572
        
        C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2000
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\61659dea-edd4-49b2-9aad-0b189d745ad9.vbs"
        13⤵
        
        PID:2844
        
        C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1424
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c08b5ef0-7d9d-4ed9-b985-d77c7012c248.vbs"
        15⤵
        
        PID:748
        
        C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3016
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\754513fa-b2be-4bb2-af61-f65456d91eb8.vbs"
        17⤵
        
        PID:448
        
        C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe"
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2568
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee6a1f7c-1115-4189-9f33-c4fdce51fb51.vbs"
        19⤵
        
        PID:276
        
        C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe
        
        "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe"
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2228
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7620d1b9-c024-428c-b98b-5fa8bc00854a.vbs"
        21⤵
        
        PID:2156
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ff7a8899-f3f8-4cfe-99e2-c4a57126e497.vbs"
        21⤵
        
        PID:268
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\916f4bf8-c117-4cd9-bfb5-0eeb5eb49b22.vbs"
        19⤵
        
        PID:2440
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\019ac30f-5260-40ff-9e36-a753280f8d3d.vbs"
        17⤵
        
        PID:932
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1fadb200-c320-4849-b44c-01bdb390cf8a.vbs"
        15⤵
        
        PID:2488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36e7306f-9790-4b5a-8d6b-ec694a7cc92c.vbs"
        13⤵
        
        PID:2076
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32986589-6910-4185-97be-06872f8b658e.vbs"
        11⤵
        
        PID:3052
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e02c0bf5-f923-442c-a6a2-f61b5178f41c.vbs"
        9⤵
        
        PID:2404
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c881f97b-9094-4705-a6d2-c211edd18a16.vbs"
        7⤵
        
        PID:2116
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23f7fbaf-18b4-4041-80d8-2acb47fe375e.vbs"
        5⤵
        
        PID:2456
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eb2fd0d5-1a33-4763-a6dc-be708c284a80.vbs"
    3⤵
    PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Users\Default\PrintHood\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Default\PrintHood\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OSPPSVC.exe

Filesize
4.9MB

MD5
52cd16cbc0b7838a6909da1c8224d898

SHA1
155bafa0147406539d942f20c620008eaec45a1f

SHA256
82b284be69bff4e92347ed9c7dcb713942a9213d9b3469c27c464a653310aecb

SHA512
eb792d82f7ba511168a11347e37bf7e7e39c5e023917d0aa682e0eb1af9f86e71d35d271ccea6e1438d64cc3bb098e1aedf73dea034b4be5d6d9ca07be32a229

Download Submit
C:\Users\Admin\AppData\Local\Temp\21dbb042-2552-4a5a-a2b3-d0bafb3b1de7.vbs

Filesize
750B

MD5
1e4d9e9882162bc51053fc154019404e

SHA1
c94d577248de467a530d9d7f3c215adfa16ecb33

SHA256
60283977c7b2fb51b472c33bf7a9e96d40fb0ca174df7f32109471e47247d0bb

SHA512
c6306d15ba3c8191c987d2ba60363dc92a1096a6f8e88d268251fc1f6063b293ce8adfd7417ea9ce1500c292afd5e48318f5c17541796d9bd4ba71410dfac257

Download Submit
C:\Users\Admin\AppData\Local\Temp\61659dea-edd4-49b2-9aad-0b189d745ad9.vbs

Filesize
750B

MD5
1c90bc2445d01c2cf50dad337d1a5b1d

SHA1
8cc1d044a5b5a4c1aa0ebc5b2c5aa8068bf2e517

SHA256
4898655faf221baf588318142d16811faa6bc459ee925bbb146af7e5245f65d1

SHA512
15d116353ce32bc332a44531da2cc7bd64196c13f855afb37ea98df4097ccedb3fcb045d7513cb9afd63d1805e2fb6adf3575b9740cd8240cb16c4295de7b356

Download Submit
C:\Users\Admin\AppData\Local\Temp\67e286f8-2eb5-40a2-ad75-0a95c3eb9a9c.vbs

Filesize
750B

MD5
5f6eb352a0153c1b8529b1ece3702ed9

SHA1
dbe54dcbf9d56d8b57dd322a6eba1c512be418e9

SHA256
917eed0bef32d4eade70e7f8ed7c17bc1de2abaa17217adde23b36bd2abd2947

SHA512
3d6352966680859d4d4ffef554bded2060a0783fd87404753891bf6fc0407173a6028195625223b3d18fbcd1bde2069555d884291133bfb4d6ef5a87666c9f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\754513fa-b2be-4bb2-af61-f65456d91eb8.vbs

Filesize
750B

MD5
06c064425dc63caf347ada40bb75f32d

SHA1
0093b28b0fa0b3c54cee010f8b8deda02869e5a1

SHA256
c7d49a64c77d73835d5b19e8ba798cb67c04774fd2803a49af5aefb4c36e62b4

SHA512
ddd547990d5582e37b41e16f930e037de24532ac6080a2399ee4af28d4b7149bdd0cfa77502813982f57209cdef0cd649ca3877fbf94391535bd209bc0a3fc1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7620d1b9-c024-428c-b98b-5fa8bc00854a.vbs

Filesize
750B

MD5
24938069cd89ba7846ac3677ea01b660

SHA1
f262594cfb20f18679196bf25168b67c7fe13245

SHA256
5a3a973faf003a53f1aa593b14576a99d934ea4952cb85828c375f86df4d4a5e

SHA512
9b7479d7ea2d00a7bea18125f8d87a046f0f867f5a16d77789abcb6d3071f96e47a48b1796ed3aad0b16a2fe79767c51f347d2675b5d13af6d288648656fdfd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\8b444383-edb0-4f8a-b6b2-313a2a93619e.vbs

Filesize
750B

MD5
3c9b45d376e44faaea751311d4e7b7b0

SHA1
ac39d584684655f1955e57956ac5259079b5e466

SHA256
f09eb4c934a10e119af700237a7f28c9308b9af3f13314199465331fac897c8f

SHA512
39d03b505ed2f8f4a98d59e6fc59f5fc3247585f35ebc133a6f8f24a02dba875ae37e467c4d3068e9b4cec7ced155a22a15d625ddb8a86eb8876e5af2f68d4b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\b984f334-ccf0-474e-9b74-a41d5dca93b2.vbs

Filesize
750B

MD5
a56d4ea413892e63a2298ec79f13b446

SHA1
ae350d91f7757fc5da107d00f0ac2d89b29a5e90

SHA256
5c95a7890eed15183bdd7f2896054f1da9303464b2e3b29e5e89335811cffbfa

SHA512
f3136d48f07327dcd439b83fe107e8fce4098740b4f0db3f5e016fab118e32a757e5cfd108e4c597627c326993e9652147f0f56cb7a9ae34a7f22af4a7ed4f82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c08b5ef0-7d9d-4ed9-b985-d77c7012c248.vbs

Filesize
750B

MD5
4518ecd475e7cdb613b83d047ef98606

SHA1
946a91dd9274721a5dfa924805e654da6996025f

SHA256
3e762e09d8160ec90d580266bbca1abd38d7b4fa15b1266357cb19435e6274ac

SHA512
db0b90753bd7c7635b440cbb5c97070856a7a632a6967a35827ed844582a105352cf24409067f0bd8947b21d0ccaac6d16de5c249d930bbd24081d426b79a11e

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5759517-7e64-4f48-bae3-69776f36b39f.vbs

Filesize
750B

MD5
1f3145a82612d0126076790f26f95edd

SHA1
7bf20525d10fcf47c8792cdb9c3a351ee746e70a

SHA256
9f6077091f5c15f8b2635f76ffeabab992403166f7bebc9655887b8f2dc45ba8

SHA512
cf6df0cde67146e167135498271eddb8490c77fe23580c35281dab97892ae2a489ac253759425a79a12a44b149345c1faf4567c5884a2b6bddfa4998a856a694

Download Submit
C:\Users\Admin\AppData\Local\Temp\eb2fd0d5-1a33-4763-a6dc-be708c284a80.vbs

Filesize
526B

MD5
66657da73ba93b2d1f6fcb4452a16f27

SHA1
53bd9643d17490f42c606ae87c9f7909a335ab23

SHA256
8b0a7bce339dac463e34a777eb6460c33b45a4e27d04f3fd0f154aab29bd1b05

SHA512
a828d6f72e92a58cfc49daedeba23f69ca1b78efcc1dd972b3662568f546c7056cdb3f028567c6733219b3937811bb6769c0646acd5f440bfba0c1a5ec181d3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ee6a1f7c-1115-4189-9f33-c4fdce51fb51.vbs

Filesize
750B

MD5
e012cb84bca28ec327e291be79a35693

SHA1
27d17925e781dbe93562bee110444bf328d10b48

SHA256
55cd6415b5ece94c3824aeb62f0520f5979da5d287e711aa03378811bf398e21

SHA512
e07fcfffc2dc4055f34138fb76d0858d4e2433886dfda08dfbb1fd4c9663c4ea1fff4a079aaa2d106ef06756d6022faa20eae716687887a619a3b7231c08585f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFFA3.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
ba5673876445b5e79bca5efae82079b7

SHA1
ad67c259614f93c4b13516b7afad8d8492396c01

SHA256
0641da0ab37f975242c3f0a42ece6772a1a1fc4fb584540b2841a2632bbcaf91

SHA512
36fcdafd3d424db139b7a3d7aabe0f6e0ecdeb06e04390553f63f52a328b7a6e9d7945475ab00bcc0dcfe5d389418009bab30f05d33f5e9db7e6564b22df6f75

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\winlogon.exe

Filesize
4.9MB

MD5
0ebd2dc160f7d5627aef291ba8fe1723

SHA1
f19f6aae9588fa548e768924114b4a6ca6021c9e

SHA256
15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5

SHA512
aa5dd361118de60d42e5cb1fec62011cda145d721c04f736d2e27984e7eb478e884bacc5f5ac7b957d3e2786035341d1906886a0eed511ec3e54278e68dbc161

Download Submit
memory/628-8-0x0000000000460000-0x0000000000470000-memory.dmp

Filesize
64KB

Download
memory/628-10-0x00000000005A0000-0x00000000005B2000-memory.dmp

Filesize
72KB

Download
memory/628-15-0x00000000025A0000-0x00000000025A8000-memory.dmp

Filesize
32KB

Download
memory/628-14-0x0000000002590000-0x0000000002598000-memory.dmp

Filesize
32KB

Download
memory/628-13-0x0000000002580000-0x000000000258E000-memory.dmp

Filesize
56KB

Download
memory/628-0-0x000007FEF5D53000-0x000007FEF5D54000-memory.dmp

Filesize
4KB

Download
memory/628-12-0x0000000002570000-0x000000000257E000-memory.dmp

Filesize
56KB

Download
memory/628-11-0x00000000005B0000-0x00000000005BA000-memory.dmp

Filesize
40KB

Download
memory/628-120-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/628-16-0x00000000025B0000-0x00000000025BC000-memory.dmp

Filesize
48KB

Download
memory/628-9-0x0000000000510000-0x000000000051A000-memory.dmp

Filesize
40KB

Download
memory/628-7-0x00000000004F0000-0x0000000000506000-memory.dmp

Filesize
88KB

Download
memory/628-6-0x0000000000450000-0x0000000000460000-memory.dmp

Filesize
64KB

Download
memory/628-5-0x0000000000440000-0x0000000000448000-memory.dmp

Filesize
32KB

Download
memory/628-4-0x0000000000410000-0x000000000042C000-memory.dmp

Filesize
112KB

Download
memory/628-3-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/628-2-0x000000001B660000-0x000000001B78E000-memory.dmp

Filesize
1.2MB

Download
memory/628-1-0x0000000000C00000-0x00000000010F4000-memory.dmp

Filesize
5.0MB

Download
memory/776-62-0x000000001B7D0000-0x000000001BAB2000-memory.dmp

Filesize
2.9MB

Download
memory/776-77-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/1696-101-0x0000000001000000-0x00000000014F4000-memory.dmp

Filesize
5.0MB

Download
memory/1736-134-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Filesize
72KB

Download
memory/2000-193-0x0000000000C60000-0x0000000001154000-memory.dmp

Filesize
5.0MB

Download
memory/2268-163-0x00000000012C0000-0x00000000017B4000-memory.dmp

Filesize
5.0MB

Download
memory/2568-236-0x0000000000C70000-0x0000000001164000-memory.dmp

Filesize
5.0MB

Download
memory/2848-178-0x0000000000110000-0x0000000000604000-memory.dmp

Filesize
5.0MB

Download