dcrat | 3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Size

4.9MB
MD5

a3f2103c4f5ac8042b106094412ec0d9
SHA1

55d76c32a1a7d471364add79e90dcf03a48ee226
SHA256

3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef
SHA512

2949789e3862a1e406ae20489134cab6a803702941be4e5730189a61a29265b2b170a5bc03340c165a8864936c8791da109eba25f2152f5be13c8d273346effe
SSDEEP

49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2780	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	2780	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2780	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2780	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2780	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2780	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2780	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2780	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2780	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2780	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2780	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2780	schtasks.exe	31

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/2320-3-0x000000001B620000-0x000000001B74E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
1364	powershell.exe
1296	powershell.exe
2996	powershell.exe
1672	powershell.exe
2808	powershell.exe
1556	powershell.exe
1168	powershell.exe
1388	powershell.exe
1464	powershell.exe
1900	powershell.exe
2836	powershell.exe
1884	powershell.exe

Executes dropped EXE 11 IoCs

Processes:

pid	Process
2160	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1016	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
2568	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
2292	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
2800	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
2284	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1204	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
2268	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
2572	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1596	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
956	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe

Drops file in Program Files directory 8 IoCs

Processes:

3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe

description	ioc	Process
File created	C:\Program Files (x86)\Google\CrashReports\d69be3a17f4ae3	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Program Files\Windows Portable Devices\RCXFA1A.tmp	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\RCXFC5C.tmp	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File opened for modification	C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Program Files\Windows Portable Devices\d69be3a17f4ae3	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
File created	C:\Program Files (x86)\Google\CrashReports\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
2656	schtasks.exe
2800	schtasks.exe
2632	schtasks.exe
2132	schtasks.exe
2616	schtasks.exe
2912	schtasks.exe
3052	schtasks.exe
2756	schtasks.exe
3044	schtasks.exe
2792	schtasks.exe
2892	schtasks.exe
2652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe

pid	Process
2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1364	powershell.exe
1884	powershell.exe
2808	powershell.exe
2996	powershell.exe
1388	powershell.exe
1296	powershell.exe
1464	powershell.exe
1168	powershell.exe
1900	powershell.exe
2836	powershell.exe
1672	powershell.exe
1556	powershell.exe
2160	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1016	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
2568	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
2292	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
2800	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
2284	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1204	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
2268	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
2572	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
1596	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
956	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

description	pid	Process
Token: SeDebugPrivilege	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeDebugPrivilege	1884	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	1296	powershell.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	2160	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Token: SeDebugPrivilege	1016	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Token: SeDebugPrivilege	2568	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Token: SeDebugPrivilege	2292	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Token: SeDebugPrivilege	2800	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Token: SeDebugPrivilege	2284	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Token: SeDebugPrivilege	1204	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Token: SeDebugPrivilege	2268	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Token: SeDebugPrivilege	2572	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Token: SeDebugPrivilege	1596	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Token: SeDebugPrivilege	956	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exeWScript.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exeWScript.exe3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exeWScript.exe

description	pid	Process	procid_target
PID 2320 wrote to memory of 2836	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	44
PID 2320 wrote to memory of 2836	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	44
PID 2320 wrote to memory of 2836	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	44
PID 2320 wrote to memory of 2808	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	45
PID 2320 wrote to memory of 2808	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	45
PID 2320 wrote to memory of 2808	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	45
PID 2320 wrote to memory of 1556	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	46
PID 2320 wrote to memory of 1556	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	46
PID 2320 wrote to memory of 1556	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	46
PID 2320 wrote to memory of 1364	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	47
PID 2320 wrote to memory of 1364	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	47
PID 2320 wrote to memory of 1364	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	47
PID 2320 wrote to memory of 1884	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	48
PID 2320 wrote to memory of 1884	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	48
PID 2320 wrote to memory of 1884	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	48
PID 2320 wrote to memory of 1296	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	49
PID 2320 wrote to memory of 1296	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	49
PID 2320 wrote to memory of 1296	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	49
PID 2320 wrote to memory of 1168	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	50
PID 2320 wrote to memory of 1168	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	50
PID 2320 wrote to memory of 1168	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	50
PID 2320 wrote to memory of 1388	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	51
PID 2320 wrote to memory of 1388	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	51
PID 2320 wrote to memory of 1388	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	51
PID 2320 wrote to memory of 1464	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	52
PID 2320 wrote to memory of 1464	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	52
PID 2320 wrote to memory of 1464	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	52
PID 2320 wrote to memory of 2996	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	53
PID 2320 wrote to memory of 2996	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	53
PID 2320 wrote to memory of 2996	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	53
PID 2320 wrote to memory of 1672	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	54
PID 2320 wrote to memory of 1672	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	54
PID 2320 wrote to memory of 1672	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	54
PID 2320 wrote to memory of 1900	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	55
PID 2320 wrote to memory of 1900	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	55
PID 2320 wrote to memory of 1900	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	55
PID 2320 wrote to memory of 2160	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	68
PID 2320 wrote to memory of 2160	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	68
PID 2320 wrote to memory of 2160	2320	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	68
PID 2160 wrote to memory of 2720	2160	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	69
PID 2160 wrote to memory of 2720	2160	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	69
PID 2160 wrote to memory of 2720	2160	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	69
PID 2160 wrote to memory of 1924	2160	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	70
PID 2160 wrote to memory of 1924	2160	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	70
PID 2160 wrote to memory of 1924	2160	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	70
PID 2720 wrote to memory of 1016	2720	WScript.exe	71
PID 2720 wrote to memory of 1016	2720	WScript.exe	71
PID 2720 wrote to memory of 1016	2720	WScript.exe	71
PID 1016 wrote to memory of 1468	1016	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	72
PID 1016 wrote to memory of 1468	1016	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	72
PID 1016 wrote to memory of 1468	1016	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	72
PID 1016 wrote to memory of 2272	1016	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	73
PID 1016 wrote to memory of 2272	1016	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	73
PID 1016 wrote to memory of 2272	1016	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	73
PID 1468 wrote to memory of 2568	1468	WScript.exe	74
PID 1468 wrote to memory of 2568	1468	WScript.exe	74
PID 1468 wrote to memory of 2568	1468	WScript.exe	74
PID 2568 wrote to memory of 2120	2568	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	75
PID 2568 wrote to memory of 2120	2568	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	75
PID 2568 wrote to memory of 2120	2568	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	75
PID 2568 wrote to memory of 1400	2568	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	76
PID 2568 wrote to memory of 1400	2568	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	76
PID 2568 wrote to memory of 1400	2568	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe	76
PID 2120 wrote to memory of 2292	2120	WScript.exe	77

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

Processes:

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
"C:\Users\Admin\AppData\Local\Temp\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1900
- C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
  "C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2160
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\73dab341-ab72-4afd-85c2-367aa0e10dc1.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
      "C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1016
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5e5f9f7b-0197-4483-86e0-992d134ce53d.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1468
      - C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
        
        "C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2568
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9d706cc6-d406-4d8f-bca0-4510159ce04e.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
        
        "C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2292
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\793b7496-d1f3-4642-8566-5068113d2594.vbs"
        9⤵
        
        PID:2472
        
        C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
        
        "C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2800
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e71f487c-f94e-400c-952c-aa708700ecb8.vbs"
        11⤵
        
        PID:2312
        
        C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
        
        "C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2284
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5514bb3-b73a-44af-95e2-ab7763c5c794.vbs"
        13⤵
        
        PID:3012
        
        C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
        
        "C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1204
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac14594e-756b-4a2a-8951-cc842b68da46.vbs"
        15⤵
        
        PID:2840
        
        C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
        
        "C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2268
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cef84255-fa37-46df-b3e1-eb936658e1f9.vbs"
        17⤵
        
        PID:2336
        
        C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
        
        "C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe"
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2572
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5463f74a-2456-428e-9656-6ae8e2ef079d.vbs"
        19⤵
        
        PID:1456
        
        C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
        
        "C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe"
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1596
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d2df144-7daf-4035-afd9-e29ba41ce9ae.vbs"
        21⤵
        
        PID:1568
        
        C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe
        
        "C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe"
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:956
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\786df083-23c0-44e5-8894-49511cf40654.vbs"
        23⤵
        
        PID:1468
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\56bfc90f-64a6-4835-8ae1-184b8eb7d2b0.vbs"
        23⤵
        
        PID:916
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bf3f7713-2dd5-4049-8af1-315bda7effb2.vbs"
        21⤵
        
        PID:2284
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c9cce8e-2e90-48a9-8554-e4c121d7cbf6.vbs"
        19⤵
        
        PID:1688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8079c3d-bffc-46f0-9eb1-ab53ee65e840.vbs"
        17⤵
        
        PID:2756
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ac8675b-8412-4eac-981e-85e1516e40c3.vbs"
        15⤵
        
        PID:1160
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d2a21147-f736-4e32-acf9-c7c6e0f55f10.vbs"
        13⤵
        
        PID:884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c050b10-5721-4d89-b8fc-6f822470e55b.vbs"
        11⤵
        
        PID:2692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fed8fc0d-9e45-4464-bb1d-768b63daa8ea.vbs"
        9⤵
        
        PID:1996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\45a97cfb-07ae-4f3a-a816-3e23f02a741b.vbs"
        7⤵
        
        PID:1400
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2816e434-3710-40e2-94de-31688dd40346.vbs"
        5⤵
        
        PID:2272
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\efc63486-c0db-4c94-b4c6-d7af27ac0a1f.vbs"
    3⤵
    PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef3" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef3" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef3" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\CrashReports\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef3" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\CrashReports\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef3" /sc MINUTE /mo 7 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef3" /sc MINUTE /mo 14 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Portable Devices\3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef.exe

Filesize
4.9MB

MD5
a3f2103c4f5ac8042b106094412ec0d9

SHA1
55d76c32a1a7d471364add79e90dcf03a48ee226

SHA256
3c20073074e9ce090a133b522cbd2a67392efcc961998e43b7226586d802c8ef

SHA512
2949789e3862a1e406ae20489134cab6a803702941be4e5730189a61a29265b2b170a5bc03340c165a8864936c8791da109eba25f2152f5be13c8d273346effe

Download Submit
C:\Users\Admin\AppData\Local\Temp\2d2df144-7daf-4035-afd9-e29ba41ce9ae.vbs

Filesize
786B

MD5
e789568ed9d1d4c3aa20b50f11b5ac8e

SHA1
9e67d52ba132bb05da82e8b3b95b8445f874739c

SHA256
20270921ec382357f4bfcaf3cdb90ad157ab574d855502d352962d3e955c2870

SHA512
6bcea3f14c2515f4631a10036bcede6c76162fef8fb8c053182442def62d2390cb5d1b5e9e82161dcb89757a86ac63a93fe2b6bcf181e586ac4db1596c2fce6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\5463f74a-2456-428e-9656-6ae8e2ef079d.vbs

Filesize
786B

MD5
7df67f2e56f6e0bdcad5b33405cd188b

SHA1
e50954d40f12d439bfa2f221d07570fb9172ad99

SHA256
fb71642b62e13611a9547689740c8d83e90267130e41177e11e0541f9ae2a7da

SHA512
a26fa6c7a541f0fbed0a4e5890fef602e2e1d85bcd50cb3c551de0bdfecaf0535a5a430f81ff1f1d4fe4b72bae4e4920e4abc956a47dfc4a3a1cbf8d0f1e942b

Download Submit
C:\Users\Admin\AppData\Local\Temp\5e5f9f7b-0197-4483-86e0-992d134ce53d.vbs

Filesize
786B

MD5
23ec5099c795f06100365e1b1b6b166c

SHA1
48347ff001494cf11ba7d366fe20f2ea3da3b013

SHA256
873323ee99d7b7eb0d80e8a7cceb6c8361ab4146ac7cbb5dab103aa54611d4dd

SHA512
586c6e2c73aa681cd82664a1b42fb861d724679ee5e8019b31329d360f50b6e4016964cb06e1e00473594fb563bd57cb4e1f7101b8f9d3744faa8845cf47a397

Download Submit
C:\Users\Admin\AppData\Local\Temp\73dab341-ab72-4afd-85c2-367aa0e10dc1.vbs

Filesize
786B

MD5
e5765dad32b218ec170d992f4b341f00

SHA1
ad8a6a2416e399f7d1ae6b5c96653ca547f295c5

SHA256
97a919c7e9626ec13859e454c3742c3b69381be435f97b7765fd3728483f519a

SHA512
29a179db546ad270eece337e3dca295c1cc4e2b780f119494981b2c34c5bb17cb4064a82402066c460fd741937b35b8930be4c15607e252e3eeaaf9575936e24

Download Submit
C:\Users\Admin\AppData\Local\Temp\786df083-23c0-44e5-8894-49511cf40654.vbs

Filesize
785B

MD5
a91cdb226d99673381f0bf7c20676bfd

SHA1
bd77dccbc9148029c38f89ac45ce7908f78c0dbc

SHA256
4ef0fac5281b712cb97b27328d400e76d7b9bf7593c1506c9ddf3df1d0e1f88b

SHA512
710d0b2066bc3a57ec61cd90000f65221596be923e28020be2b7cbc5975697ad209479edd718abdb4b778a4fe9b4aa422f50e4bd7341848d014511643a7d2f3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\793b7496-d1f3-4642-8566-5068113d2594.vbs

Filesize
786B

MD5
cc51fec9e54f8c2c2ed40eb24acfa14e

SHA1
9b3f2c60c70b9d99eae274229aa3469f83674111

SHA256
eed4fa71d76c2bef8f136c150bc0e8cb414e4c16bf67f7c6409eef798afc42f1

SHA512
92c1d7a48d144a21f9147fc84a7a57f5e63e49766f39c7429dfcc03ceb9133c550c6202e19eda2c6303f8a009eaf94b7b7da42afc7e0889f5f45bb19135d61ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\9d706cc6-d406-4d8f-bca0-4510159ce04e.vbs

Filesize
786B

MD5
3a7c6012a52d26f0b50b4c1becb5cb3b

SHA1
0bb3d33687ab8a98a1886d02128100d72df8f054

SHA256
6bc01852676b6412ccb8a638b99799bf9c5e4875b59d9724a23016f4d3a71917

SHA512
cce3ecf7a49d7cdd175184609ef7ffad3902701a5b0e98d8f22dfe731705ed3ad24b56324f60fd16c333d07a61f0fb8a287e5b7c687ee7b55d49a58453dfc3f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ac14594e-756b-4a2a-8951-cc842b68da46.vbs

Filesize
786B

MD5
a0d3b228d969a906b519d7dae2ae9cb0

SHA1
c40decbc320500f991d37709b737039b3da65ead

SHA256
1aee3dea69d529f5360c2ad9197f7648abdff27e1fac456cf7cb45d09ca5b4c0

SHA512
611e7e28eeee6f1acf047f891fe036354c0e88643bb70fbe40a35941bd1b600981bebe8d160236f5909a3e5001f21b0072a21a741d0f8462184aa31ef27a8ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\cef84255-fa37-46df-b3e1-eb936658e1f9.vbs

Filesize
786B

MD5
4cd880113e3caa67d56665e3e5611381

SHA1
23ee6a8d07842ff2f08081ce5fcd7cb11c1ce6eb

SHA256
345c096c87be70fa9cc1c7d9fdff0e00524e53b36509be30c656ef92dda88a15

SHA512
f2e4a928b8beea4a0a6e5faf2544c78f5794e6d222bfc5d6265e8fba2176b52d0353029faf91ed21598e16a987341f206f54c2a3e1947b9675604e7d1e20d71d

Download Submit
C:\Users\Admin\AppData\Local\Temp\e71f487c-f94e-400c-952c-aa708700ecb8.vbs

Filesize
786B

MD5
08aebddff73cac20d942fa9a628ce395

SHA1
3ff0e4863dd56bd27f43879fdc1b74453c41406a

SHA256
0549e8e8df6f4caf2d2a26553559c2f067b721c5b6f711b4c3280f280b53cf67

SHA512
cfc2abc8b7e3719aa7e29955658589e68d8fefd317bb0b8b8388f995070d2c2f3b6c7d5bef06e06ec13c0761e1756fd8d96eb980ff4f4264df451ac1d2874af2

Download Submit
C:\Users\Admin\AppData\Local\Temp\efc63486-c0db-4c94-b4c6-d7af27ac0a1f.vbs

Filesize
562B

MD5
d5613bd7642af9c105ffbbe32e711abe

SHA1
ef5d29c517a3b67d9d1ef9237abd163df272f686

SHA256
fdb8eb5c2f67d9bfbcdefcfb3972368b8cc862dfd133851d2fb6d35e972a1be5

SHA512
49233e76c3b29f04ac5197dec62a01012bb439723a46b1c921f4f958e011c2d9eea533fdbfbc7c3f0f7aef0f0d56f5fd4ac3d8a93dbc1924e5e50c5ce026f948

Download Submit
C:\Users\Admin\AppData\Local\Temp\f5514bb3-b73a-44af-95e2-ab7763c5c794.vbs

Filesize
786B

MD5
08f05fce4f0c7c9d5da561f14591af2a

SHA1
ce41720303bd6a7c5fd22a7f4e4ef3ceb3471f44

SHA256
4a0e584b71c5b01de01ac1f03d628674f9fd4338f477452ecb06d08d8936c604

SHA512
7511c542cd16173070fea1c4f667e2e727b42d83cf17f667de5f826e771e087255c7f5301953971846cc35bfa12098222a33bb08adf744ba5fd8dffc96629ac8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1767.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
440e48eac1fe6c503d910987ea6400a2

SHA1
97d8afea31281488dc56a697721b042bff5013d4

SHA256
66214eaa8df31bae3f1194a4aa17d951a8a0884a81d14042b82e0a43a29643e7

SHA512
698ae492001dad7ce3ea0dffbf6c0236e5df261a13d6d57c6aa5e5dacaa3eea13e973a9cb140fda75b3596d7aa6cfdadada8f3b4712e0afed878a933d3251866

Download Submit
memory/956-275-0x0000000000260000-0x0000000000754000-memory.dmp

Filesize
5.0MB

Download
memory/1016-137-0x0000000000220000-0x0000000000714000-memory.dmp

Filesize
5.0MB

Download
memory/1204-213-0x0000000000C00000-0x00000000010F4000-memory.dmp

Filesize
5.0MB

Download
memory/1364-95-0x000000001B2F0000-0x000000001B5D2000-memory.dmp

Filesize
2.9MB

Download
memory/1364-106-0x00000000023E0000-0x00000000023E8000-memory.dmp

Filesize
32KB

Download
memory/1596-260-0x0000000000510000-0x0000000000522000-memory.dmp

Filesize
72KB

Download
memory/2160-123-0x0000000000580000-0x0000000000592000-memory.dmp

Filesize
72KB

Download
memory/2160-63-0x0000000000860000-0x0000000000D54000-memory.dmp

Filesize
5.0MB

Download
memory/2268-229-0x0000000000BB0000-0x0000000000BC2000-memory.dmp

Filesize
72KB

Download
memory/2268-228-0x0000000000ED0000-0x00000000013C4000-memory.dmp

Filesize
5.0MB

Download
memory/2284-198-0x0000000000020000-0x0000000000514000-memory.dmp

Filesize
5.0MB

Download
memory/2292-167-0x0000000000A80000-0x0000000000F74000-memory.dmp

Filesize
5.0MB

Download
memory/2320-9-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/2320-11-0x0000000000B70000-0x0000000000B7A000-memory.dmp

Filesize
40KB

Download
memory/2320-3-0x000000001B620000-0x000000001B74E000-memory.dmp

Filesize
1.2MB

Download
memory/2320-0-0x000007FEF60D3000-0x000007FEF60D4000-memory.dmp

Filesize
4KB

Download
memory/2320-122-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

Filesize
9.9MB

Download
memory/2320-8-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/2320-1-0x0000000001260000-0x0000000001754000-memory.dmp

Filesize
5.0MB

Download
memory/2320-16-0x0000000000CC0000-0x0000000000CCC000-memory.dmp

Filesize
48KB

Download
memory/2320-7-0x00000000003B0000-0x00000000003C6000-memory.dmp

Filesize
88KB

Download
memory/2320-15-0x0000000000CB0000-0x0000000000CB8000-memory.dmp

Filesize
32KB

Download
memory/2320-6-0x00000000003A0000-0x00000000003B0000-memory.dmp

Filesize
64KB

Download
memory/2320-13-0x0000000000C90000-0x0000000000C9E000-memory.dmp

Filesize
56KB

Download
memory/2320-5-0x00000000002F0000-0x00000000002F8000-memory.dmp

Filesize
32KB

Download
memory/2320-12-0x0000000000B80000-0x0000000000B8E000-memory.dmp

Filesize
56KB

Download
memory/2320-14-0x0000000000CA0000-0x0000000000CA8000-memory.dmp

Filesize
32KB

Download
memory/2320-4-0x0000000000380000-0x000000000039C000-memory.dmp

Filesize
112KB

Download
memory/2320-10-0x00000000006C0000-0x00000000006D2000-memory.dmp

Filesize
72KB

Download
memory/2320-2-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

Filesize
9.9MB

Download
memory/2568-152-0x0000000000050000-0x0000000000544000-memory.dmp

Filesize
5.0MB

Download
memory/2572-244-0x0000000000F90000-0x0000000001484000-memory.dmp

Filesize
5.0MB

Download
memory/2572-245-0x0000000000510000-0x0000000000522000-memory.dmp

Filesize
72KB

Download
memory/2800-183-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/2800-182-0x00000000003E0000-0x00000000008D4000-memory.dmp

Filesize
5.0MB

Download