dcrat | 078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

646A50D060AE1B649F0CA735AABF5744.exe
Size

3.6MB
MD5

646a50d060ae1b649f0ca735aabf5744
SHA1

a666932e153ef1d2c2463009e0df4de9bdf73322
SHA256

078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd
SHA512

0872641f90557c8ab8dd015b9486061b85a48ab7db06a74f6787ab87685f2bb6358eda822ba16757a7b6fc8fe1744a831ea76f47d6130225596a285bf9dd1f4c
SSDEEP

98304:EbRxeIaNRcgnk9MO32RzRpAH267w3adH2fte4I/Bu:E+IoREF32B67wuH2I5/M

Score

10^/10

dcrat discovery evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 44 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		4884	schtasks.exe
		1560	schtasks.exe
		532	schtasks.exe
		3748	schtasks.exe
		2720	schtasks.exe
		2108	schtasks.exe
		3308	schtasks.exe
		2264	schtasks.exe
		2084	schtasks.exe
		5056	schtasks.exe
		2488	schtasks.exe
		4928	schtasks.exe
		1068	schtasks.exe
		4868	schtasks.exe
		2364	schtasks.exe
		4236	schtasks.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\55b276f4edf653		chainagent.exe
		1040	schtasks.exe
		1424	schtasks.exe
		3968	schtasks.exe
		2456	schtasks.exe
		2156	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		646A50D060AE1B649F0CA735AABF5744.exe
		4732	schtasks.exe
		2240	schtasks.exe
		3376	schtasks.exe
		2544	schtasks.exe
		2552	schtasks.exe
		2212	schtasks.exe
		3196	schtasks.exe
		496	schtasks.exe
		1096	schtasks.exe
		2428	schtasks.exe
		3524	schtasks.exe
		4456	schtasks.exe
		4608	schtasks.exe
		4568	schtasks.exe
		4444	schtasks.exe
		2680	schtasks.exe
		4948	schtasks.exe
		4384	schtasks.exe
		3224	schtasks.exe
		3568	schtasks.exe
		1384	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 14 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\services.exe\", \"C:\\fontMonitor\\explorer.exe\", \"C:\\Windows\\tracing\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\fontMonitor\\smss.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\fontMonitor\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\SearchApp.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\services.exe\", \"C:\\fontMonitor\\explorer.exe\", \"C:\\Windows\\tracing\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\fontMonitor\\smss.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\fontMonitor\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\SearchApp.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\spoolsv.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\services.exe\", \"C:\\fontMonitor\\explorer.exe\", \"C:\\Windows\\tracing\\SearchApp.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\services.exe\", \"C:\\fontMonitor\\explorer.exe\", \"C:\\Windows\\tracing\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\fontMonitor\\smss.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\services.exe\", \"C:\\fontMonitor\\explorer.exe\", \"C:\\Windows\\tracing\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\fontMonitor\\smss.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\fontMonitor\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\SearchApp.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\spoolsv.exe\", \"C:\\fontMonitor\\unsecapp.exe\", \"C:\\Users\\Admin\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Snippets\\dwm.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\services.exe\", \"C:\\fontMonitor\\explorer.exe\", \"C:\\Windows\\tracing\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\services.exe\", \"C:\\fontMonitor\\explorer.exe\", \"C:\\Windows\\tracing\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\fontMonitor\\smss.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\fontMonitor\\wininit.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\services.exe\", \"C:\\fontMonitor\\explorer.exe\", \"C:\\Windows\\tracing\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\fontMonitor\\smss.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\fontMonitor\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\SearchApp.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\spoolsv.exe\", \"C:\\fontMonitor\\unsecapp.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\services.exe\", \"C:\\fontMonitor\\explorer.exe\", \"C:\\Windows\\tracing\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\fontMonitor\\smss.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\fontMonitor\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\SearchApp.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\spoolsv.exe\", \"C:\\fontMonitor\\unsecapp.exe\", \"C:\\Users\\Admin\\csrss.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\services.exe\", \"C:\\fontMonitor\\explorer.exe\", \"C:\\Windows\\tracing\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\fontMonitor\\smss.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\fontMonitor\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\SearchApp.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\spoolsv.exe\", \"C:\\fontMonitor\\unsecapp.exe\", \"C:\\Users\\Admin\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Snippets\\dwm.exe\", \"C:\\Program Files (x86)\\MSBuild\\cmd.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\services.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\services.exe\", \"C:\\fontMonitor\\explorer.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\services.exe\", \"C:\\fontMonitor\\explorer.exe\", \"C:\\Windows\\tracing\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\fontMonitor\\smss.exe\""	chainagent.exe

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3568	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3196	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	496	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3968	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4444	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3224	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3308	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	3244	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	3244	schtasks.exe	89

UAC bypass 3 TTPs 42 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	chainagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	chainagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	chainagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b5f-10.dat	dcrat
behavioral2/memory/4516-13-0x0000000000AE0000-0x0000000000E3C000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	646A50D060AE1B649F0CA735AABF5744.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	chainagent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 14 IoCs

pid	Process
4516	chainagent.exe
1656	dllhost.exe
4988	dllhost.exe
2132	dllhost.exe
3744	dllhost.exe
3216	dllhost.exe
1544	dllhost.exe
488	dllhost.exe
840	dllhost.exe
3216	dllhost.exe
3252	dllhost.exe
3724	dllhost.exe
4348	dllhost.exe
3104	dllhost.exe

Adds Run key to start application 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\fontMonitor\\unsecapp.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\All Users\\Templates\\SearchApp.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\spoolsv.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\fontMonitor\\unsecapp.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\fontMonitor\\explorer.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\MSBuild\\cmd.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\fontMonitor\\explorer.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\tracing\\SearchApp.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\fontMonitor\\wininit.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\spoolsv.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\services.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\fontMonitor\\smss.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\MSBuild\\cmd.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\tracing\\SearchApp.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\fontMonitor\\wininit.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Admin\\csrss.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\services.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\fontMonitor\\smss.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Admin\\csrss.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Snippets\\dwm.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\All Users\\Templates\\SearchApp.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Snippets\\dwm.exe\""	chainagent.exe

Checks whether UAC is enabled 1 TTPs 28 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	chainagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	chainagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe	chainagent.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\55b276f4edf653	chainagent.exe
File created	C:\Program Files (x86)\MSBuild\cmd.exe	chainagent.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe	chainagent.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\services.exe	chainagent.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\c5b4cb5e9653cc	chainagent.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\spoolsv.exe	chainagent.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\f3b6ecef712a24	chainagent.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\dwm.exe	chainagent.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\6cb0b6c459d5d3	chainagent.exe
File created	C:\Program Files (x86)\MSBuild\ebf1f9fa8afd6d	chainagent.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\tracing\38384e6a620884	chainagent.exe
File created	C:\Windows\tracing\SearchApp.exe	chainagent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	646A50D060AE1B649F0CA735AABF5744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	chainagent.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	646A50D060AE1B649F0CA735AABF5744.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1384	schtasks.exe
2720	schtasks.exe
4948	schtasks.exe
2680	schtasks.exe
3308	schtasks.exe
4884	schtasks.exe
2364	schtasks.exe
2240	schtasks.exe
2212	schtasks.exe
532	schtasks.exe
496	schtasks.exe
2552	schtasks.exe
2156	schtasks.exe
4236	schtasks.exe
4568	schtasks.exe
2084	schtasks.exe
1560	schtasks.exe
2108	schtasks.exe
2428	schtasks.exe
1424	schtasks.exe
3748	schtasks.exe
4732	schtasks.exe
1068	schtasks.exe
3224	schtasks.exe
4456	schtasks.exe
2264	schtasks.exe
3968	schtasks.exe
3196	schtasks.exe
1040	schtasks.exe
3524	schtasks.exe
5056	schtasks.exe
4444	schtasks.exe
4868	schtasks.exe
4608	schtasks.exe
3568	schtasks.exe
2544	schtasks.exe
1096	schtasks.exe
4928	schtasks.exe
4384	schtasks.exe
3376	schtasks.exe
2488	schtasks.exe
2456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4516	chainagent.exe
4516	chainagent.exe
4516	chainagent.exe
4516	chainagent.exe
4516	chainagent.exe
4516	chainagent.exe
4516	chainagent.exe
4516	chainagent.exe
4516	chainagent.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
1656	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
4988	dllhost.exe
2132	dllhost.exe
2132	dllhost.exe
2132	dllhost.exe
2132	dllhost.exe
2132	dllhost.exe
2132	dllhost.exe
2132	dllhost.exe
2132	dllhost.exe
2132	dllhost.exe
2132	dllhost.exe
2132	dllhost.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4516	chainagent.exe
Token: SeDebugPrivilege	1656	dllhost.exe
Token: SeDebugPrivilege	4988	dllhost.exe
Token: SeDebugPrivilege	2132	dllhost.exe
Token: SeDebugPrivilege	3744	dllhost.exe
Token: SeDebugPrivilege	3216	dllhost.exe
Token: SeDebugPrivilege	1544	dllhost.exe
Token: SeDebugPrivilege	488	dllhost.exe
Token: SeDebugPrivilege	840	dllhost.exe
Token: SeDebugPrivilege	3216	dllhost.exe
Token: SeDebugPrivilege	3252	dllhost.exe
Token: SeDebugPrivilege	3724	dllhost.exe
Token: SeDebugPrivilege	4348	dllhost.exe
Token: SeDebugPrivilege	3104	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 4360	3452	646A50D060AE1B649F0CA735AABF5744.exe	83
PID 3452 wrote to memory of 4360	3452	646A50D060AE1B649F0CA735AABF5744.exe	83
PID 3452 wrote to memory of 4360	3452	646A50D060AE1B649F0CA735AABF5744.exe	83
PID 4360 wrote to memory of 3880	4360	WScript.exe	91
PID 4360 wrote to memory of 3880	4360	WScript.exe	91
PID 4360 wrote to memory of 3880	4360	WScript.exe	91
PID 3880 wrote to memory of 4516	3880	cmd.exe	93
PID 3880 wrote to memory of 4516	3880	cmd.exe	93
PID 4516 wrote to memory of 1696	4516	chainagent.exe	139
PID 4516 wrote to memory of 1696	4516	chainagent.exe	139
PID 1696 wrote to memory of 4628	1696	cmd.exe	141
PID 1696 wrote to memory of 4628	1696	cmd.exe	141
PID 1696 wrote to memory of 1656	1696	cmd.exe	147
PID 1696 wrote to memory of 1656	1696	cmd.exe	147
PID 1656 wrote to memory of 4920	1656	dllhost.exe	149
PID 1656 wrote to memory of 4920	1656	dllhost.exe	149
PID 1656 wrote to memory of 1136	1656	dllhost.exe	150
PID 1656 wrote to memory of 1136	1656	dllhost.exe	150
PID 4920 wrote to memory of 4988	4920	WScript.exe	152
PID 4920 wrote to memory of 4988	4920	WScript.exe	152
PID 4988 wrote to memory of 3316	4988	dllhost.exe	154
PID 4988 wrote to memory of 3316	4988	dllhost.exe	154
PID 4988 wrote to memory of 3964	4988	dllhost.exe	155
PID 4988 wrote to memory of 3964	4988	dllhost.exe	155
PID 3316 wrote to memory of 2132	3316	WScript.exe	157
PID 3316 wrote to memory of 2132	3316	WScript.exe	157
PID 2132 wrote to memory of 1900	2132	dllhost.exe	161
PID 2132 wrote to memory of 1900	2132	dllhost.exe	161
PID 2132 wrote to memory of 2628	2132	dllhost.exe	162
PID 2132 wrote to memory of 2628	2132	dllhost.exe	162
PID 1900 wrote to memory of 3744	1900	WScript.exe	165
PID 1900 wrote to memory of 3744	1900	WScript.exe	165
PID 3744 wrote to memory of 2932	3744	dllhost.exe	167
PID 3744 wrote to memory of 2932	3744	dllhost.exe	167
PID 3744 wrote to memory of 5016	3744	dllhost.exe	168
PID 3744 wrote to memory of 5016	3744	dllhost.exe	168
PID 2932 wrote to memory of 3216	2932	WScript.exe	170
PID 2932 wrote to memory of 3216	2932	WScript.exe	170
PID 3216 wrote to memory of 3228	3216	dllhost.exe	172
PID 3216 wrote to memory of 3228	3216	dllhost.exe	172
PID 3216 wrote to memory of 4196	3216	dllhost.exe	173
PID 3216 wrote to memory of 4196	3216	dllhost.exe	173
PID 3228 wrote to memory of 1544	3228	WScript.exe	175
PID 3228 wrote to memory of 1544	3228	WScript.exe	175
PID 1544 wrote to memory of 116	1544	dllhost.exe	177
PID 1544 wrote to memory of 116	1544	dllhost.exe	177
PID 1544 wrote to memory of 4876	1544	dllhost.exe	178
PID 1544 wrote to memory of 4876	1544	dllhost.exe	178
PID 116 wrote to memory of 488	116	WScript.exe	181
PID 116 wrote to memory of 488	116	WScript.exe	181
PID 488 wrote to memory of 2332	488	dllhost.exe	183
PID 488 wrote to memory of 2332	488	dllhost.exe	183
PID 488 wrote to memory of 3568	488	dllhost.exe	184
PID 488 wrote to memory of 3568	488	dllhost.exe	184
PID 2332 wrote to memory of 840	2332	WScript.exe	186
PID 2332 wrote to memory of 840	2332	WScript.exe	186
PID 840 wrote to memory of 3144	840	dllhost.exe	188
PID 840 wrote to memory of 3144	840	dllhost.exe	188
PID 840 wrote to memory of 3952	840	dllhost.exe	189
PID 840 wrote to memory of 3952	840	dllhost.exe	189
PID 3144 wrote to memory of 3216	3144	WScript.exe	192
PID 3144 wrote to memory of 3216	3144	WScript.exe	192
PID 3216 wrote to memory of 1412	3216	dllhost.exe	194
PID 3216 wrote to memory of 1412	3216	dllhost.exe	194

System policy modification 1 TTPs 42 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	chainagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	chainagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	chainagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\646A50D060AE1B649F0CA735AABF5744.exe
"C:\Users\Admin\AppData\Local\Temp\646A50D060AE1B649F0CA735AABF5744.exe"
1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\fontMonitor\GFcBidplGj1mDhuTvzK8nh.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\fontMonitor\B6f2SnQ47.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\fontMonitor\chainagent.exe
      "C:\fontMonitor\chainagent.exe"
      4⤵
      DcRat
      Modifies WinLogon for persistence
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4516
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KubgcPF4Z1.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1696
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4628
      - C:\Recovery\WindowsRE\dllhost.exe
        
        "C:\Recovery\WindowsRE\dllhost.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1656
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3dc5aa83-e201-4a25-a2f2-2a7b5aa06266.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4920
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\77b9bf52-bea4-4302-a995-c9995d53ea07.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3316
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2132
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8ca406f-b218-4048-b413-15e84591e62a.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3744
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2c943bb6-7ed1-448f-869f-5505eea45009.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3216
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e3ad4f8-b924-4fcb-8e3e-b71bb9016d60.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1544
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3498440-025c-4dc6-9434-15bddc43a88f.vbs"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:116
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8f04c40f-008f-4b3c-96b5-4f4c0489176f.vbs"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:840
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\86298cc9-38bb-4c03-b405-0a41b091bc61.vbs"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3216
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a0014d0-0f8f-491a-af49-bda1d9629360.vbs"
        23⤵
        
        PID:1412
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        24⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3252
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f9cbdcd4-61dc-4869-81c2-8913b74d3d74.vbs"
        25⤵
        
        PID:3228
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        26⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3724
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\768c799c-435f-41f5-9f90-d1221e222b60.vbs"
        27⤵
        
        PID:224
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        28⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4348
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\98281b1c-1ee3-4fd7-8bb2-22eb34097ab7.vbs"
        29⤵
        
        PID:4676
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        30⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3104
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\85d6a6ac-9c06-4144-9941-97158d1f4cea.vbs"
        31⤵
        
        PID:4604
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\021623b5-b490-4b38-9cad-50df7a21965d.vbs"
        31⤵
        
        PID:2772
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1107bf13-a75a-4d77-b2b3-32d68c5adf2a.vbs"
        29⤵
        
        PID:828
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3b9eb0a1-424d-4718-9446-4ef79ffa6bef.vbs"
        27⤵
        
        PID:3632
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d7b5e990-74f1-4118-963b-bf0d9d8d9ad8.vbs"
        25⤵
        
        PID:3140
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\35fb35a2-3269-49fc-bf39-c92145ce42f9.vbs"
        23⤵
        
        PID:5032
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3aabddb4-c79e-47c2-9ad1-9d359d548e1b.vbs"
        21⤵
        
        PID:3952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7dd3bde9-8ef3-4866-bbe6-2de6e145ebe7.vbs"
        19⤵
        
        PID:3568
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4e675e08-83fb-4a4c-949b-3d3428788974.vbs"
        17⤵
        
        PID:4876
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e360a9d2-009f-4d1d-8024-d563e9f92a9a.vbs"
        15⤵
        
        PID:4196
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f27be54c-3e17-4412-b8fa-0dfe89c222da.vbs"
        13⤵
        
        PID:5016
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a0e42fd2-e89e-4058-8d73-f3ac1aee6c2c.vbs"
        11⤵
        
        PID:2628
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a60ad70e-8edf-46b7-8908-1be1a57cb796.vbs"
        9⤵
        
        PID:3964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\68664b3b-1289-45d1-964e-cccef863b8f8.vbs"
        7⤵
        
        PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\fontMonitor\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\fontMonitor\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\fontMonitor\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Windows\tracing\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\tracing\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Windows\tracing\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\fontMonitor\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\fontMonitor\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\fontMonitor\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\fontMonitor\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\fontMonitor\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\fontMonitor\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Templates\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\All Users\Templates\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Templates\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\fontMonitor\unsecapp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\fontMonitor\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\fontMonitor\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\cmd.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
49b64127208271d8f797256057d0b006

SHA1
b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

SHA256
2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

SHA512
f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2c943bb6-7ed1-448f-869f-5505eea45009.vbs

Filesize
709B

MD5
dcf96b7cc7733b5948f5c0c7d2a5f70c

SHA1
bedc4b17b4e5ba463ba4ac0a632e03a98faae08d

SHA256
fdc9430f5efe2b4d4aab030b80c1f294c072f1961c3357d326d1da0e6ee4bc73

SHA512
a353330f98516f28c3e6f9e7af6914c8f7525022905ef65a8fec0e6cbe29901cf6ea6e6f89c95f0c696ebad1315f858b594ed2700a2bdff77b642593339f99e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\3dc5aa83-e201-4a25-a2f2-2a7b5aa06266.vbs

Filesize
709B

MD5
d55bb408628f7027dcf94552fbfb8ce9

SHA1
8ea68b2855cede587eb04d22b7925213e77648d4

SHA256
065b408bdc2bce55d68562d0035da86af50ac0eacf2f0f8152fa3c0bdaa85a22

SHA512
2c4e7a33d8b23d194eb71f3bd6b4bc4663c90db26b063d6ad2eabd5f20d3a51f40b46e48e03d678d145d0777f1c201e84c942eaf7742aec424f37f3ea2b1b429

Download Submit
C:\Users\Admin\AppData\Local\Temp\68664b3b-1289-45d1-964e-cccef863b8f8.vbs

Filesize
485B

MD5
300365ce15245f82f0eab9219b0b4c39

SHA1
4d629fe7bec6082e784323b617cff6ed870da003

SHA256
401ff064bb45bf15681c51063753d3ce34f544b2d3fc14a3be52a7b2696bffe2

SHA512
65d7dc08796f7b8be18f19a9d5d485bce4af6d5c86aaa0d84ced21d0047963355ac6296f82bb43319194934d7fb4758a68055f02a540ea3842f65538ef58ab3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\768c799c-435f-41f5-9f90-d1221e222b60.vbs

Filesize
709B

MD5
0556901142138d23970cffc8d0da3a0f

SHA1
28c86739aae9cb9adcc18140de237c5ab15edb79

SHA256
ce122b4869db6796f4b3cf5617a00554eb033a1b4195370093ed7b5545812d75

SHA512
746e9c1ac686a5c45c9acaea5c62829803ddb97b898462718e6404b1f1ee5f7729cc19bad5f841f95b7b420573230cf6635c15072640ed4691bb4e98b2ac267a

Download Submit
C:\Users\Admin\AppData\Local\Temp\77b9bf52-bea4-4302-a995-c9995d53ea07.vbs

Filesize
709B

MD5
bd427397b755c9be7cc3200f2ed3a0e3

SHA1
ae38255df67b2759c3e39225713ed2387ea171a3

SHA256
59e3cf3a6721a7372b649da30385bad5bb7d89cf0c9196a76a3ebb1706eca1cb

SHA512
b380f8cfe8b3677acd35098c008dad59455ac4de6cfb818f7216b6737ab8592f886a4728de27376984d80213272eaad3cbc0e20a6ef4445541ae5cfdd99ca366

Download Submit
C:\Users\Admin\AppData\Local\Temp\85d6a6ac-9c06-4144-9941-97158d1f4cea.vbs

Filesize
709B

MD5
731b7060f22ba1770690894e3beea926

SHA1
126bb46fddee512159f0dfe78cc7cf8d2708afa1

SHA256
4dec398f5b202120b9ee500ffdfac63667209d92292ca6a3f943e7fe734df007

SHA512
c0e8887b9c2ba6ed2c982c2f17ffdca02a757ff81d1bb1ec077ae5b0d1fb26805836851d021e1f20f5f089639144f9864e30d29c41f6ddfffdf7dc7122b64f03

Download Submit
C:\Users\Admin\AppData\Local\Temp\86298cc9-38bb-4c03-b405-0a41b091bc61.vbs

Filesize
708B

MD5
9a2a690410003acbbd87fd9fd7e822cb

SHA1
de7c96affb160e8b6eb1b6e20ba6a8c28d69b630

SHA256
2fbf58dd785db5280296eca95e389746fb7f6b523b209f59e2d1729497e3da95

SHA512
75a8d2aa387974a50ca7fe0eb35281e3dd5a1b9701bd850efc72fa91fda5fe998aabeb983a8ce4a510617187b4aac878dd5d3a3bf61b06ebf0ec9610da53f422

Download Submit
C:\Users\Admin\AppData\Local\Temp\8e3ad4f8-b924-4fcb-8e3e-b71bb9016d60.vbs

Filesize
709B

MD5
10f1c1efae20bd62c4255104436fb1d5

SHA1
708ed48712d66edda7925b08a0467ff8df8494e3

SHA256
b55a5fc89837b93ab873ee4872405f3e5a04fe9bc4a68a9c739640d664d75024

SHA512
b6b4be4308bf44bf9f399fe2e58e13bebc9860871b2a246377fbd2cd273ef254bc6f31c8aafe918e6ad26b2bbfa34b1581747db7da375739c90c80585c4e1850

Download Submit
C:\Users\Admin\AppData\Local\Temp\8f04c40f-008f-4b3c-96b5-4f4c0489176f.vbs

Filesize
708B

MD5
588fe076d0c3940b33cd7089f962d0b8

SHA1
2a65a3837383565ed4daa74e544c32a4e49e6e61

SHA256
86fb99c949a8347ba443acb53b7b2f6105081739a26ac8a7801b21353600fbc7

SHA512
10f1f8ea7b34d9689c7bc65448192d19c088498b9064e6a2ef70edb73a3b0c4f5cf4010f9d543dd9c823bf1bb3621642b32441f2aa837f9e7b872283b5eaeb69

Download Submit
C:\Users\Admin\AppData\Local\Temp\98281b1c-1ee3-4fd7-8bb2-22eb34097ab7.vbs

Filesize
709B

MD5
306bbe655316b577736d3cba4c2ce9d1

SHA1
102c95aa2e7236368cc472c3a614b8fac59361d9

SHA256
81f05b43840a1303a4c17f0b29914425876fcc640f08242b27e58cc69f913120

SHA512
0eb53511bdd1aea77749fbec5c482de17fab4c077414db855a117b41d74fc64e1c22028edc7565c8a2ae86c3740fcd5df1152d7659c504b6a47d188d3586eebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\KubgcPF4Z1.bat

Filesize
198B

MD5
f724a337957ab3e641b5884ec162d21c

SHA1
3eb378742983f2e9c57286ac14926a1fa2a71882

SHA256
7f4bf15802c8407831cfa7f89f745d9b43db563c3ff9d26d30bd4c48a1d6a92e

SHA512
ef2bcce40525915240dc5bba12814df0ae3d2f5a4025ffee7991c91a98c7394204487c0a66507daecf372f81ee3142a9cba9c1f9b3fdf2fcd9b1391bd7c86965

Download Submit
C:\Users\Admin\AppData\Local\Temp\c8ca406f-b218-4048-b413-15e84591e62a.vbs

Filesize
709B

MD5
3e581654b4ba7d826f5f6d5420b0c069

SHA1
12fad63020ec41673c9df409812d215be29b9587

SHA256
3a8a4a50facff1707d14bb21f36cdc3b7d0da6999e9ee4e0500364acc7c48ca2

SHA512
84b77fc1499667fd995b3a039fb1ef5023b9b543c56dbee00ef60216471e133d4b862a954baf191b12a8581bd0807a906809e93494babcf6c257408b2dce6452

Download Submit
C:\Users\Admin\AppData\Local\Temp\e3498440-025c-4dc6-9434-15bddc43a88f.vbs

Filesize
709B

MD5
aa3644a10ec1f845ed0c66e69b9d5a62

SHA1
d0f34032daa1bcf481c2b322d846331aaeb7768d

SHA256
c86b6148c800e896ed0d255d2478f904220c6ce05743d7e201c4240d8497e48d

SHA512
4787d6ee8fd8959a493bbdbf6796cbd33d5bb5440a98d9daa28332861cd2766305e302c790c2d5fc2db36c70ba2e6f50d1e5608bee3779ba5c5f7b6b751a7e53

Download Submit
C:\Users\Admin\AppData\Local\Temp\f9cbdcd4-61dc-4869-81c2-8913b74d3d74.vbs

Filesize
709B

MD5
649e101f0f52de62ee83e9de4abf29d6

SHA1
c019f7483055e4de03e2d55cfe848113365ca4fd

SHA256
3c355c17bd17415050ee585f9239297d20ece820abcf942c5b67de2ef73c4d29

SHA512
b3e49297463739bfba22354e1b0f62e3bdebb86e2a814ddddb6e695fa767486bb714a4941290cfc048acb6f366cafd69a189146ee36d6185c862a45c0ad94ea3

Download Submit
C:\fontMonitor\B6f2SnQ47.bat

Filesize
31B

MD5
d919292d76ba6af3f0a7c88b2d07c4fa

SHA1
0fa76a1456603b525f53d9e787d1a800172afdf8

SHA256
52bde46534a8a1ea436617040c311631ce470e0e60875585921e2b3fbde3809c

SHA512
3a39f5a6a544634841f20d26dcbc3b2f875639e38eb1f5db1d243517ed87e8df542459e3b65d3336c69293a37e8f3ac03fd4a11330163fbf9eb8bc2218e7a9b5

Download Submit
C:\fontMonitor\GFcBidplGj1mDhuTvzK8nh.vbe

Filesize
197B

MD5
692908a9fe7461b9736233b4b217f221

SHA1
b3bb8803bba51dd7c622d2a1e4f2c8e4b1c4184d

SHA256
d3be77c2e695644f8dfbc8342c806f5f48c3074f5ea1000aa300b6c7061e591f

SHA512
f38138284e905c6c877dd67de0858ce6d80403c712249b6e353c51389aa86c67ca29ba4f455d4ab4f1b5f5c6e3c8e1fccbdf01b8d0766aa93b35fb8da5230788

Download Submit
C:\fontMonitor\chainagent.exe

Filesize
3.3MB

MD5
e74be6bbac3ea0713506397d5d6ef541

SHA1
dc4c91d512cb544c5c458e1aecc6bd8a7fab61f9

SHA256
58440f3b4db0b30ffa0001857bd2cf329d470c518895ac668ab2eb25a10499f7

SHA512
09f31ce980869b6e2d53ee391a62150fdec456ceafa22879f4268094eec03614e77def0dc1adea064e59982838286020e6af45e78c7db3c4cdc1da965c1cd185

Download Submit
memory/488-156-0x000000001B8E0000-0x000000001B8F2000-memory.dmp

Filesize
72KB

Download
memory/840-168-0x0000000002900000-0x0000000002912000-memory.dmp

Filesize
72KB

Download
memory/2132-110-0x000000001C490000-0x000000001C4A2000-memory.dmp

Filesize
72KB

Download
memory/3216-180-0x000000001BD00000-0x000000001BD12000-memory.dmp

Filesize
72KB

Download
memory/3724-203-0x00000000030C0000-0x00000000030D2000-memory.dmp

Filesize
72KB

Download
memory/3744-122-0x000000001BEF0000-0x000000001BF02000-memory.dmp

Filesize
72KB

Download
memory/4348-215-0x000000001B580000-0x000000001B592000-memory.dmp

Filesize
72KB

Download
memory/4516-24-0x000000001BA00000-0x000000001BA0C000-memory.dmp

Filesize
48KB

Download
memory/4516-21-0x000000001B9C0000-0x000000001B9D6000-memory.dmp

Filesize
88KB

Download
memory/4516-36-0x000000001C360000-0x000000001C368000-memory.dmp

Filesize
32KB

Download
memory/4516-37-0x000000001C370000-0x000000001C37C000-memory.dmp

Filesize
48KB

Download
memory/4516-38-0x0000000002F30000-0x0000000002F3C000-memory.dmp

Filesize
48KB

Download
memory/4516-39-0x000000001C5C0000-0x000000001C5C8000-memory.dmp

Filesize
32KB

Download
memory/4516-40-0x0000000002F40000-0x0000000002F4C000-memory.dmp

Filesize
48KB

Download
memory/4516-44-0x000000001C590000-0x000000001C59E000-memory.dmp

Filesize
56KB

Download
memory/4516-47-0x000000001C5D0000-0x000000001C5DA000-memory.dmp

Filesize
40KB

Download
memory/4516-43-0x000000001C580000-0x000000001C588000-memory.dmp

Filesize
32KB

Download
memory/4516-42-0x0000000002F60000-0x0000000002F6E000-memory.dmp

Filesize
56KB

Download
memory/4516-41-0x0000000002F50000-0x0000000002F5A000-memory.dmp

Filesize
40KB

Download
memory/4516-48-0x000000001C5E0000-0x000000001C5EC000-memory.dmp

Filesize
48KB

Download
memory/4516-46-0x000000001C5B0000-0x000000001C5B8000-memory.dmp

Filesize
32KB

Download
memory/4516-45-0x000000001C5A0000-0x000000001C5AC000-memory.dmp

Filesize
48KB

Download
memory/4516-34-0x000000001C880000-0x000000001CDA8000-memory.dmp

Filesize
5.2MB

Download
memory/4516-33-0x000000001C320000-0x000000001C332000-memory.dmp

Filesize
72KB

Download
memory/4516-32-0x000000001C310000-0x000000001C318000-memory.dmp

Filesize
32KB

Download
memory/4516-31-0x000000001BAA0000-0x000000001BAAC000-memory.dmp

Filesize
48KB

Download
memory/4516-12-0x00007FF8E1CD3000-0x00007FF8E1CD5000-memory.dmp

Filesize
8KB

Download
memory/4516-30-0x000000001BA90000-0x000000001BA98000-memory.dmp

Filesize
32KB

Download
memory/4516-29-0x000000001BA80000-0x000000001BA8C000-memory.dmp

Filesize
48KB

Download
memory/4516-28-0x000000001C2C0000-0x000000001C316000-memory.dmp

Filesize
344KB

Download
memory/4516-27-0x000000001BA70000-0x000000001BA7A000-memory.dmp

Filesize
40KB

Download
memory/4516-26-0x000000001BA60000-0x000000001BA70000-memory.dmp

Filesize
64KB

Download
memory/4516-25-0x000000001B9F0000-0x000000001B9F8000-memory.dmp

Filesize
32KB

Download
memory/4516-23-0x000000001B9E0000-0x000000001B9F2000-memory.dmp

Filesize
72KB

Download
memory/4516-22-0x0000000002FD0000-0x0000000002FD8000-memory.dmp

Filesize
32KB

Download
memory/4516-35-0x000000001C350000-0x000000001C35C000-memory.dmp

Filesize
48KB

Download
memory/4516-20-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/4516-19-0x0000000002FB0000-0x0000000002FB8000-memory.dmp

Filesize
32KB

Download
memory/4516-18-0x000000001BA10000-0x000000001BA60000-memory.dmp

Filesize
320KB

Download
memory/4516-17-0x0000000002F90000-0x0000000002FAC000-memory.dmp

Filesize
112KB

Download
memory/4516-16-0x0000000002F80000-0x0000000002F88000-memory.dmp

Filesize
32KB

Download
memory/4516-15-0x0000000002F70000-0x0000000002F7E000-memory.dmp

Filesize
56KB

Download
memory/4516-14-0x0000000002F10000-0x0000000002F1E000-memory.dmp

Filesize
56KB

Download
memory/4516-13-0x0000000000AE0000-0x0000000000E3C000-memory.dmp

Filesize
3.4MB

Download
memory/4988-98-0x000000001C3C0000-0x000000001C3D2000-memory.dmp

Filesize
72KB

Download