dcrat | 078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd.exe
Size

3.6MB
MD5

646a50d060ae1b649f0ca735aabf5744
SHA1

a666932e153ef1d2c2463009e0df4de9bdf73322
SHA256

078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd
SHA512

0872641f90557c8ab8dd015b9486061b85a48ab7db06a74f6787ab87685f2bb6358eda822ba16757a7b6fc8fe1744a831ea76f47d6130225596a285bf9dd1f4c
SSDEEP

98304:EbRxeIaNRcgnk9MO32RzRpAH267w3adH2fte4I/Bu:E+IoREF32B67wuH2I5/M

Score

10^/10

dcrat discovery evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 58 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		3756	schtasks.exe
		2568	schtasks.exe
		4924	schtasks.exe
		4776	schtasks.exe
		900	schtasks.exe
		1144	schtasks.exe
		1152	schtasks.exe
		3096	schtasks.exe
		2288	schtasks.exe
		4736	schtasks.exe
		2660	schtasks.exe
		3268	schtasks.exe
		1044	schtasks.exe
		4480	schtasks.exe
		3516	schtasks.exe
		3272	schtasks.exe
		3512	schtasks.exe
		4388	schtasks.exe
		4404	schtasks.exe
		4472	schtasks.exe
		4860	schtasks.exe
		3048	schtasks.exe
		116	schtasks.exe
		4996	schtasks.exe
		2976	schtasks.exe
		3616	schtasks.exe
		3152	schtasks.exe
		4712	schtasks.exe
		2612	schtasks.exe
		2928	schtasks.exe
		4700	schtasks.exe
		4756	schtasks.exe
		4424	schtasks.exe
		2816	schtasks.exe
		5012	schtasks.exe
		3296	schtasks.exe
		2892	schtasks.exe
		4624	schtasks.exe
		4408	schtasks.exe
		1956	schtasks.exe
		3636	schtasks.exe
		4572	schtasks.exe
		3720	schtasks.exe
		3052	schtasks.exe
		1872	schtasks.exe
		2484	schtasks.exe
		748	schtasks.exe
		1968	schtasks.exe
		1496	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd.exe
		3652	schtasks.exe
		3648	schtasks.exe
		1492	schtasks.exe
		3988	schtasks.exe
		932	schtasks.exe
		4496	schtasks.exe
		3916	schtasks.exe
		4320	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 19 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\", \"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\fontMonitor\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Users\\Default\\dwm.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\sihost.exe\", \"C:\\fontMonitor\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\WmiPrvSE.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\", \"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\fontMonitor\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Users\\Default\\dwm.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\sihost.exe\", \"C:\\fontMonitor\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\WmiPrvSE.exe\", \"C:\\fontMonitor\\spoolsv.exe\", \"C:\\Users\\All Users\\ssh\\sppsvc.exe\", \"C:\\fontMonitor\\SearchApp.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\Idle.exe\", \"C:\\Windows\\it-IT\\dllhost.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\", \"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\", \"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\OfficeClickToRun.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\", \"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\fontMonitor\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\", \"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\fontMonitor\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Users\\Default\\dwm.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\sihost.exe\", \"C:\\fontMonitor\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\WmiPrvSE.exe\", \"C:\\fontMonitor\\spoolsv.exe\", \"C:\\Users\\All Users\\ssh\\sppsvc.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\", \"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\fontMonitor\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Users\\Default\\dwm.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\sihost.exe\", \"C:\\fontMonitor\\csrss.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\", \"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\fontMonitor\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Users\\Default\\dwm.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\sihost.exe\", \"C:\\fontMonitor\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\WmiPrvSE.exe\", \"C:\\fontMonitor\\spoolsv.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\", \"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\fontMonitor\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Users\\Default\\dwm.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\sihost.exe\", \"C:\\fontMonitor\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\WmiPrvSE.exe\", \"C:\\fontMonitor\\spoolsv.exe\", \"C:\\Users\\All Users\\ssh\\sppsvc.exe\", \"C:\\fontMonitor\\SearchApp.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\", \"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\fontMonitor\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Users\\Default\\dwm.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\sihost.exe\", \"C:\\fontMonitor\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\WmiPrvSE.exe\", \"C:\\fontMonitor\\spoolsv.exe\", \"C:\\Users\\All Users\\ssh\\sppsvc.exe\", \"C:\\fontMonitor\\SearchApp.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\Idle.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\", \"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\fontMonitor\\System.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\", \"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\fontMonitor\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Users\\Default\\dwm.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\", \"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\fontMonitor\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Users\\Default\\dwm.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\sihost.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\", \"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\fontMonitor\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Users\\Default\\dwm.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\sihost.exe\", \"C:\\fontMonitor\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\WmiPrvSE.exe\", \"C:\\fontMonitor\\spoolsv.exe\", \"C:\\Users\\All Users\\ssh\\sppsvc.exe\", \"C:\\fontMonitor\\SearchApp.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\Idle.exe\", \"C:\\Windows\\it-IT\\dllhost.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\Idle.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\", \"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\", \"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontMonitor\\fontdrvhost.exe\", \"C:\\Windows\\Help\\Help\\unsecapp.exe\", \"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\fontMonitor\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\", \"C:\\Users\\Default\\dwm.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\sihost.exe\", \"C:\\fontMonitor\\csrss.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\WmiPrvSE.exe\", \"C:\\fontMonitor\\spoolsv.exe\", \"C:\\Users\\All Users\\ssh\\sppsvc.exe\", \"C:\\fontMonitor\\SearchApp.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\Idle.exe\", \"C:\\Windows\\it-IT\\dllhost.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\Idle.exe\", \"C:\\Users\\Admin\\Desktop\\explorer.exe\""	chainagent.exe

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3096	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3720	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3296	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	932	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3516	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3652	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3272	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4736	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	2036	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	2036	schtasks.exe	87

UAC bypass 3 TTPs 33 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	chainagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	chainagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	chainagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b90-10.dat	dcrat
behavioral2/memory/1928-13-0x0000000000B10000-0x0000000000E6C000-memory.dmp	dcrat
behavioral2/files/0x0008000000023c4f-123.dat	dcrat

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	chainagent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Idle.exe

Executes dropped EXE 11 IoCs

pid	Process
1928	chainagent.exe
1548	Idle.exe
4444	Idle.exe
5064	Idle.exe
5044	Idle.exe
3968	Idle.exe
1260	Idle.exe
2660	Idle.exe
1864	Idle.exe
4196	Idle.exe
4472	Idle.exe

Adds Run key to start application 2 TTPs 38 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\fontMonitor\\spoolsv.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\it-IT\\dllhost.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\it-IT\\dllhost.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\fontMonitor\\fontdrvhost.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\Help\\Help\\unsecapp.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Google\\Update\\Offline\\WmiPrvSE.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Google\\Update\\Offline\\WmiPrvSE.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Windows Multimedia Platform\\Idle.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Windows Multimedia Platform\\Idle.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\fontMonitor\\fontdrvhost.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\Help\\Help\\unsecapp.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Default User\\dwm.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Default\\dwm.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Default\\dwm.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Admin\\Desktop\\explorer.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\fontMonitor\\spoolsv.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\Idle.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Default User\\dwm.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\Microsoft.NET\\assembly\\OfficeClickToRun.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\Windows Portable Devices\\Registry.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files\\Windows Multimedia Platform\\sihost.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\All Users\\ssh\\sppsvc.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\Idle.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\fontMonitor\\csrss.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Admin\\Desktop\\explorer.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\OneDrive\\RuntimeBroker.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\fontMonitor\\System.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files\\Windows Multimedia Platform\\sihost.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\fontMonitor\\csrss.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\fontMonitor\\SearchApp.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\Microsoft.NET\\assembly\\OfficeClickToRun.exe\""	chainagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\fontMonitor\\System.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\All Users\\ssh\\sppsvc.exe\""	chainagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\fontMonitor\\SearchApp.exe\""	chainagent.exe

Checks whether UAC is enabled 1 TTPs 22 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	chainagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	chainagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Multimedia Platform\66fc9ff0ee96c2	chainagent.exe
File created	C:\Program Files (x86)\Google\Update\Offline\WmiPrvSE.exe	chainagent.exe
File created	C:\Program Files (x86)\Google\Update\Offline\24dbde2999530e	chainagent.exe
File created	C:\Program Files\Windows Multimedia Platform\Idle.exe	chainagent.exe
File created	C:\Program Files\Windows Multimedia Platform\6ccacd8608530f	chainagent.exe
File created	C:\Program Files (x86)\Windows Portable Devices\Registry.exe	chainagent.exe
File created	C:\Program Files (x86)\Windows Portable Devices\ee2ad38f3d4382	chainagent.exe
File created	C:\Program Files\Windows Multimedia Platform\sihost.exe	chainagent.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Help\Help\29c1c3cc0f7685	chainagent.exe
File created	C:\Windows\Microsoft.NET\assembly\OfficeClickToRun.exe	chainagent.exe
File created	C:\Windows\Microsoft.NET\assembly\e6c9b481da804f	chainagent.exe
File created	C:\Windows\it-IT\dllhost.exe	chainagent.exe
File created	C:\Windows\it-IT\5940a34987c991	chainagent.exe
File created	C:\Windows\Help\Help\unsecapp.exe	chainagent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	chainagent.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Idle.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3052	schtasks.exe
3636	schtasks.exe
3512	schtasks.exe
900	schtasks.exe
2484	schtasks.exe
4996	schtasks.exe
4860	schtasks.exe
4736	schtasks.exe
2568	schtasks.exe
4424	schtasks.exe
2660	schtasks.exe
3616	schtasks.exe
3152	schtasks.exe
2612	schtasks.exe
4388	schtasks.exe
1492	schtasks.exe
2816	schtasks.exe
1496	schtasks.exe
4700	schtasks.exe
3516	schtasks.exe
4776	schtasks.exe
4712	schtasks.exe
1968	schtasks.exe
3048	schtasks.exe
116	schtasks.exe
4472	schtasks.exe
1152	schtasks.exe
4572	schtasks.exe
4404	schtasks.exe
4624	schtasks.exe
1144	schtasks.exe
4320	schtasks.exe
1872	schtasks.exe
4408	schtasks.exe
4924	schtasks.exe
3988	schtasks.exe
748	schtasks.exe
2892	schtasks.exe
4756	schtasks.exe
3756	schtasks.exe
932	schtasks.exe
4480	schtasks.exe
3916	schtasks.exe
4496	schtasks.exe
3268	schtasks.exe
2288	schtasks.exe
3648	schtasks.exe
1956	schtasks.exe
3096	schtasks.exe
3720	schtasks.exe
1044	schtasks.exe
2976	schtasks.exe
3296	schtasks.exe
3652	schtasks.exe
3272	schtasks.exe
5012	schtasks.exe
2928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1928	chainagent.exe
1928	chainagent.exe
1928	chainagent.exe
1928	chainagent.exe
1928	chainagent.exe
1928	chainagent.exe
1928	chainagent.exe
1928	chainagent.exe
1928	chainagent.exe
1928	chainagent.exe
1928	chainagent.exe
1928	chainagent.exe
1928	chainagent.exe
1928	chainagent.exe
1928	chainagent.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
1548	Idle.exe
4444	Idle.exe
4444	Idle.exe
4444	Idle.exe
4444	Idle.exe
4444	Idle.exe
4444	Idle.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	chainagent.exe
Token: SeDebugPrivilege	1548	Idle.exe
Token: SeDebugPrivilege	4444	Idle.exe
Token: SeDebugPrivilege	5064	Idle.exe
Token: SeDebugPrivilege	5044	Idle.exe
Token: SeDebugPrivilege	3968	Idle.exe
Token: SeDebugPrivilege	1260	Idle.exe
Token: SeDebugPrivilege	2660	Idle.exe
Token: SeDebugPrivilege	1864	Idle.exe
Token: SeDebugPrivilege	4196	Idle.exe
Token: SeDebugPrivilege	4472	Idle.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 3504	5036	078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd.exe	83
PID 5036 wrote to memory of 3504	5036	078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd.exe	83
PID 5036 wrote to memory of 3504	5036	078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd.exe	83
PID 3504 wrote to memory of 1660	3504	WScript.exe	89
PID 3504 wrote to memory of 1660	3504	WScript.exe	89
PID 3504 wrote to memory of 1660	3504	WScript.exe	89
PID 1660 wrote to memory of 1928	1660	cmd.exe	91
PID 1660 wrote to memory of 1928	1660	cmd.exe	91
PID 1928 wrote to memory of 3944	1928	chainagent.exe	151
PID 1928 wrote to memory of 3944	1928	chainagent.exe	151
PID 3944 wrote to memory of 2536	3944	cmd.exe	153
PID 3944 wrote to memory of 2536	3944	cmd.exe	153
PID 3944 wrote to memory of 1548	3944	cmd.exe	160
PID 3944 wrote to memory of 1548	3944	cmd.exe	160
PID 1548 wrote to memory of 4016	1548	Idle.exe	162
PID 1548 wrote to memory of 4016	1548	Idle.exe	162
PID 1548 wrote to memory of 892	1548	Idle.exe	163
PID 1548 wrote to memory of 892	1548	Idle.exe	163
PID 4016 wrote to memory of 4444	4016	WScript.exe	165
PID 4016 wrote to memory of 4444	4016	WScript.exe	165
PID 4444 wrote to memory of 5084	4444	Idle.exe	167
PID 4444 wrote to memory of 5084	4444	Idle.exe	167
PID 4444 wrote to memory of 5008	4444	Idle.exe	168
PID 4444 wrote to memory of 5008	4444	Idle.exe	168
PID 5084 wrote to memory of 5064	5084	WScript.exe	173
PID 5084 wrote to memory of 5064	5084	WScript.exe	173
PID 5064 wrote to memory of 4568	5064	Idle.exe	176
PID 5064 wrote to memory of 4568	5064	Idle.exe	176
PID 5064 wrote to memory of 4076	5064	Idle.exe	177
PID 5064 wrote to memory of 4076	5064	Idle.exe	177
PID 4568 wrote to memory of 5044	4568	WScript.exe	180
PID 4568 wrote to memory of 5044	4568	WScript.exe	180
PID 5044 wrote to memory of 2560	5044	Idle.exe	182
PID 5044 wrote to memory of 2560	5044	Idle.exe	182
PID 5044 wrote to memory of 748	5044	Idle.exe	183
PID 5044 wrote to memory of 748	5044	Idle.exe	183
PID 2560 wrote to memory of 3968	2560	WScript.exe	186
PID 2560 wrote to memory of 3968	2560	WScript.exe	186
PID 3968 wrote to memory of 408	3968	Idle.exe	188
PID 3968 wrote to memory of 408	3968	Idle.exe	188
PID 3968 wrote to memory of 1156	3968	Idle.exe	189
PID 3968 wrote to memory of 1156	3968	Idle.exe	189
PID 408 wrote to memory of 1260	408	WScript.exe	192
PID 408 wrote to memory of 1260	408	WScript.exe	192
PID 1260 wrote to memory of 2760	1260	Idle.exe	194
PID 1260 wrote to memory of 2760	1260	Idle.exe	194
PID 1260 wrote to memory of 1736	1260	Idle.exe	195
PID 1260 wrote to memory of 1736	1260	Idle.exe	195
PID 2760 wrote to memory of 2660	2760	WScript.exe	197
PID 2760 wrote to memory of 2660	2760	WScript.exe	197
PID 2660 wrote to memory of 4320	2660	Idle.exe	199
PID 2660 wrote to memory of 4320	2660	Idle.exe	199
PID 2660 wrote to memory of 5036	2660	Idle.exe	200
PID 2660 wrote to memory of 5036	2660	Idle.exe	200
PID 4320 wrote to memory of 1864	4320	WScript.exe	202
PID 4320 wrote to memory of 1864	4320	WScript.exe	202
PID 1864 wrote to memory of 544	1864	Idle.exe	204
PID 1864 wrote to memory of 544	1864	Idle.exe	204
PID 1864 wrote to memory of 4248	1864	Idle.exe	205
PID 1864 wrote to memory of 4248	1864	Idle.exe	205
PID 544 wrote to memory of 4196	544	WScript.exe	207
PID 544 wrote to memory of 4196	544	WScript.exe	207
PID 4196 wrote to memory of 3132	4196	Idle.exe	209
PID 4196 wrote to memory of 3132	4196	Idle.exe	209

System policy modification 1 TTPs 33 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	chainagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	chainagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	chainagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd.exe
"C:\Users\Admin\AppData\Local\Temp\078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd.exe"
1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\fontMonitor\GFcBidplGj1mDhuTvzK8nh.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\fontMonitor\B6f2SnQ47.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\fontMonitor\chainagent.exe
      "C:\fontMonitor\chainagent.exe"
      4⤵
      Modifies WinLogon for persistence
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1928
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hN7lqUtaMK.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3944
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2536
      - C:\Program Files\Windows Multimedia Platform\Idle.exe
        
        "C:\Program Files\Windows Multimedia Platform\Idle.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\41b83793-e2ad-41a5-b47d-8feff72ce335.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Program Files\Windows Multimedia Platform\Idle.exe
        
        "C:\Program Files\Windows Multimedia Platform\Idle.exe"
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89ab88bf-3e5c-4e3c-ac4e-0c190f655a3e.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\Program Files\Windows Multimedia Platform\Idle.exe
        
        "C:\Program Files\Windows Multimedia Platform\Idle.exe"
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:5064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d2ebf27d-5255-48a3-ad2d-b04b33a0bfb6.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Program Files\Windows Multimedia Platform\Idle.exe
        
        "C:\Program Files\Windows Multimedia Platform\Idle.exe"
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:5044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3feaf566-e357-4373-a1f4-ceded6941c55.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Program Files\Windows Multimedia Platform\Idle.exe
        
        "C:\Program Files\Windows Multimedia Platform\Idle.exe"
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d8488d8-faf6-46f7-a96d-f53a1f0321a3.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:408
        
        C:\Program Files\Windows Multimedia Platform\Idle.exe
        
        "C:\Program Files\Windows Multimedia Platform\Idle.exe"
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1260
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b3795f7a-b10a-44d2-8885-e0ff6e0f8222.vbs"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:2760
        
        C:\Program Files\Windows Multimedia Platform\Idle.exe
        
        "C:\Program Files\Windows Multimedia Platform\Idle.exe"
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2660
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\21508530-6010-4b1c-9ea3-91777b837c6b.vbs"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Program Files\Windows Multimedia Platform\Idle.exe
        
        "C:\Program Files\Windows Multimedia Platform\Idle.exe"
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1864
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\922471fe-b2e1-4a93-8568-bee17d50e264.vbs"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:544
        
        C:\Program Files\Windows Multimedia Platform\Idle.exe
        
        "C:\Program Files\Windows Multimedia Platform\Idle.exe"
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4196
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43c651b8-d140-4465-9e2e-f3b49ff86023.vbs"
        23⤵
        
        PID:3132
        
        C:\Program Files\Windows Multimedia Platform\Idle.exe
        
        "C:\Program Files\Windows Multimedia Platform\Idle.exe"
        24⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4472
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c651c68-7154-4278-bc16-c1aa362a98d4.vbs"
        25⤵
        
        PID:2724
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6183a588-e4f5-4211-9e21-30aa515427ee.vbs"
        25⤵
        
        PID:2808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f342d70-931c-48f2-a363-c0dc0dcd314e.vbs"
        23⤵
        
        PID:1720
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\018096db-c518-44d7-aed0-f210f62f0720.vbs"
        21⤵
        
        PID:4248
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d6c18ca0-beae-469b-bc3d-ad3f37d53960.vbs"
        19⤵
        
        PID:5036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1783b19-f2c6-49a6-9938-cadb0e207846.vbs"
        17⤵
        
        PID:1736
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4ec0d2b-6054-4440-bd70-a0268217ff1f.vbs"
        15⤵
        
        PID:1156
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac149429-b2c4-456f-abc3-08cc9c7582d8.vbs"
        13⤵
        
        PID:748
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4b52f775-692d-499a-b698-f323bde9ae94.vbs"
        11⤵
        
        PID:4076
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ecdfab58-a235-48d7-a968-9b7bbd45dd00.vbs"
        9⤵
        
        PID:5008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b11b54f-24f1-4282-82fc-353f362403ec.vbs"
        7⤵
        
        PID:892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\fontMonitor\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\fontMonitor\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\fontMonitor\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Windows\Help\Help\unsecapp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\Help\Help\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Windows\Help\Help\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\OneDrive\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\OneDrive\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\OneDrive\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Windows\Microsoft.NET\assembly\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\assembly\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Windows\Microsoft.NET\assembly\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\fontMonitor\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\fontMonitor\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\fontMonitor\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Users\Default\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\Default\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Multimedia Platform\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Multimedia Platform\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\fontMonitor\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\fontMonitor\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\fontMonitor\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Update\Offline\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Offline\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Update\Offline\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\fontMonitor\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\fontMonitor\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\fontMonitor\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\ssh\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\All Users\ssh\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\ssh\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\fontMonitor\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\fontMonitor\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\fontMonitor\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\it-IT\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\it-IT\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\it-IT\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Multimedia Platform\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Desktop\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Desktop\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Idle.exe.log

Filesize
1KB

MD5
49b64127208271d8f797256057d0b006

SHA1
b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

SHA256
2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

SHA512
f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1d8488d8-faf6-46f7-a96d-f53a1f0321a3.vbs

Filesize
729B

MD5
1181c95c7fe85c36be1b414ad8b5f2e6

SHA1
c7e382f146c924828cbf125f661552f20004da3a

SHA256
f5d75301db02cb01daf3a962397c115c4b0a1626c44deeaa46a720b56e74bd1f

SHA512
a8c50372967bf9d90de7bb07f20f56d25803995dc3d703cf484d4f015d58e0957becc1e809203bf1ec0ab088fe4a14bc959d286bd5f76f07739bd3254a9f01f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\21508530-6010-4b1c-9ea3-91777b837c6b.vbs

Filesize
729B

MD5
d22e711509c9a8788269a7fd3fd1a885

SHA1
4eaa93ffed43331a6c23189ac099390992b2c0c0

SHA256
ecd4c8308ce01959131ae39ca1bc15d32b4fe2a31a6be1fd7c6e8617505ebc9f

SHA512
df2302ecfad748ea2b038aa7cadae4dbf2b6cf27f6584c958bd8be5c8cf56102ff47a684a3f802e38a718b8b373c45c1cb2bc3b3ffcdd7599d19d7b99fe70dce

Download Submit
C:\Users\Admin\AppData\Local\Temp\2c73ab11a3be8e627c58726ff693cfeeea4d7891.exe

Filesize
3.3MB

MD5
ffc7c91046f1c36b96f73d00bfce7e44

SHA1
887b1f0d9b2b942bd3c21c38707ff3461633f7a1

SHA256
5ea7184d19e1593abd67a4d8ce0aa6f7c89e59f2dbec3eac20337296faa92e9a

SHA512
9bc882610c641eb92c78daeac1543cae5c55cade27c8abb7320a878ed40a407312ce171fbcc1dcdaba7644a989ce27c58f959be82cdfebe4f388ddada1b6b4de

Download Submit
C:\Users\Admin\AppData\Local\Temp\3feaf566-e357-4373-a1f4-ceded6941c55.vbs

Filesize
729B

MD5
a9e5f547555a995e43bf7acd83202e61

SHA1
ce24f1bde04d7138b611cc38254e05368a5f6dd0

SHA256
48601e35c3d0818d489da8dc7c87b2bfa4c4e70d9c9589f47685684e968d1069

SHA512
64ce25b05d10626ab9f0e2afc57bf0205a9a65a3a76e39ccd3e08c4e44e1380874e6e3c6ee21f2edf807ce1410569c72eb5f84920f2ed748ef927046e3966b79

Download Submit
C:\Users\Admin\AppData\Local\Temp\41b83793-e2ad-41a5-b47d-8feff72ce335.vbs

Filesize
729B

MD5
285215e59487b14e22a8406eba5e5e6c

SHA1
3063d592130ce863c2497fb06ce227bbb88daa1e

SHA256
66891b6a6811d69c82577e2dacf75dde5b6bdb0715e5eac0f5c9393206eb5e33

SHA512
832eb437adf340a2f6620fe78dd98bc39e5868dd4bd393d50e6e6c42536251f99b47abd1c89e47944c302fa31b327c07b411474a38add28a8d5444e762953b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\43c651b8-d140-4465-9e2e-f3b49ff86023.vbs

Filesize
729B

MD5
d91859b5e30ff41dc1d90dc2988c3c25

SHA1
e20b0a8bc04d292085b32249b0bff135e428faa5

SHA256
45312d8a4ae52a4636c1e861cadfae1799cf9269da1314f7631be5ea334d1c7a

SHA512
b605d16d6ff8bc38981e4da2c09d0c87f6e6213eaa8c2ecb6cc0559cc7283ace535c272bad5ccccc69a7139ee2aa7c0b7bb4d950653e9d398f75b7bec8732484

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b11b54f-24f1-4282-82fc-353f362403ec.vbs

Filesize
505B

MD5
1932cb4abd3130b26bc7d2f83472d3e6

SHA1
f1ca36ceb66cb71583d1f5be7c0141d656b94df9

SHA256
46bc53e59dca154d74e61282fb8f8bc41855ada0c705f1ca6bea39e0425e1159

SHA512
4807b9e2db3335364d8f589fb716d604b7ec4c8a36173d4bd57a0c65ce209b2bd1eafe4644ff6963c9fcec3e58842c42ccafdfa149b7dea412d2f25d2a3c4451

Download Submit
C:\Users\Admin\AppData\Local\Temp\89ab88bf-3e5c-4e3c-ac4e-0c190f655a3e.vbs

Filesize
729B

MD5
55a670ce61a6a7c086289d592f8beda7

SHA1
72c5f18cf23230370eb13db0981ae81472fc3e1c

SHA256
071d60cbdde9bf54e59f4a5e0a989251da7f0fd0e12024433504f8fc62434260

SHA512
770a18226a77b50cabf57a4e3595947dbc3db52132ded50f5e75012c400a236fbdceace91a58b7412fde4a1285b791ab1850da616b3261deedd74acb5a995ec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\8c651c68-7154-4278-bc16-c1aa362a98d4.vbs

Filesize
729B

MD5
5e8e874cffdbb3d0c798cf377ac03120

SHA1
f1297689f1c550fd972f6d8903e33c20f4b1641d

SHA256
3ea65b8e53fdb452b262c33501b070e45b2662e7f3e582ef33cd97a6ea75f278

SHA512
2e225b990d059e1837ff5710d8bd91ade7a5c21b90cb38219381b9c6e5022105d6f67ece3376919d0d451b8da06b9d66deb9691f6c2e22aac5cd360c36d02a2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\922471fe-b2e1-4a93-8568-bee17d50e264.vbs

Filesize
729B

MD5
9f7f8830475e57050c6b03513929cc95

SHA1
b602e3ebac72d80f17cd416f198828fec1640453

SHA256
35f0f5a6a2bce9892e25a38219992c6db9393a576ce64e6618a39398eb170cb5

SHA512
d69c5d8fac5ecbf35f411d0c1d52f5ce3c71746302831b4b1e43d812445753aa2847a965ae9d3e1227689bb2894bbc10b06d8ef08c135da9ec9423b0e732e10a

Download Submit
C:\Users\Admin\AppData\Local\Temp\b3795f7a-b10a-44d2-8885-e0ff6e0f8222.vbs

Filesize
729B

MD5
ddd1c9776c2199c2b9fb3950de9f3c01

SHA1
7004cc4b9e5450557d9cdef5e7dab34f1b743dcc

SHA256
b6557377059b349acdc7bec2d99b05f9c54658bb8bba2152de7f57faa941e8dd

SHA512
14caf2290ff49e06319246cfe112477520444474a17b4399b43293240e516f148801eeea7663b54754fdf01ae376495760dbd08eba2656903d04f2f8d1790394

Download Submit
C:\Users\Admin\AppData\Local\Temp\d2ebf27d-5255-48a3-ad2d-b04b33a0bfb6.vbs

Filesize
729B

MD5
d3bcaa0adcf46b4bbb00483e3960b11e

SHA1
f3b32c7f7617d2e239ec3f3637efb4b5c018fa64

SHA256
985b6cac46813f419cbc6213977230066289d053f3a3a295f99b49e8d424ae56

SHA512
11e352966cfbf2830cc95db0f0addf24a780cbd4352f0de7d51ecd8f36fca7fab07e4b593656ae23531700fe75d1390c55a4e30353c99842568bc64f1c0f3bef

Download Submit
C:\Users\Admin\AppData\Local\Temp\hN7lqUtaMK.bat

Filesize
218B

MD5
988d3eb27217c8ece56ffba4fac08028

SHA1
e8de626c98a8ebb2b60cd9a9c3941454a3a731b1

SHA256
7fb43f99ca3a61f0c0117c37de778854af20a6aaf055a4c588bcc70192c923e1

SHA512
cccda8d8561254e7a03e8315d2509fe26f46177be0be619b83539feea645e3a97663685124758c3d00bc8d80582b9a89d36f2656ada6dcd5eb924a73087f5e75

Download Submit
C:\fontMonitor\B6f2SnQ47.bat

Filesize
31B

MD5
d919292d76ba6af3f0a7c88b2d07c4fa

SHA1
0fa76a1456603b525f53d9e787d1a800172afdf8

SHA256
52bde46534a8a1ea436617040c311631ce470e0e60875585921e2b3fbde3809c

SHA512
3a39f5a6a544634841f20d26dcbc3b2f875639e38eb1f5db1d243517ed87e8df542459e3b65d3336c69293a37e8f3ac03fd4a11330163fbf9eb8bc2218e7a9b5

Download Submit
C:\fontMonitor\GFcBidplGj1mDhuTvzK8nh.vbe

Filesize
197B

MD5
692908a9fe7461b9736233b4b217f221

SHA1
b3bb8803bba51dd7c622d2a1e4f2c8e4b1c4184d

SHA256
d3be77c2e695644f8dfbc8342c806f5f48c3074f5ea1000aa300b6c7061e591f

SHA512
f38138284e905c6c877dd67de0858ce6d80403c712249b6e353c51389aa86c67ca29ba4f455d4ab4f1b5f5c6e3c8e1fccbdf01b8d0766aa93b35fb8da5230788

Download Submit
C:\fontMonitor\chainagent.exe

Filesize
3.3MB

MD5
e74be6bbac3ea0713506397d5d6ef541

SHA1
dc4c91d512cb544c5c458e1aecc6bd8a7fab61f9

SHA256
58440f3b4db0b30ffa0001857bd2cf329d470c518895ac668ab2eb25a10499f7

SHA512
09f31ce980869b6e2d53ee391a62150fdec456ceafa22879f4268094eec03614e77def0dc1adea064e59982838286020e6af45e78c7db3c4cdc1da965c1cd185

Download Submit
memory/1864-176-0x000000001B170000-0x000000001B182000-memory.dmp

Filesize
72KB

Download
memory/1928-24-0x000000001C130000-0x000000001C13C000-memory.dmp

Filesize
48KB

Download
memory/1928-28-0x000000001C2C0000-0x000000001C316000-memory.dmp

Filesize
344KB

Download
memory/1928-30-0x000000001C320000-0x000000001C328000-memory.dmp

Filesize
32KB

Download
memory/1928-31-0x000000001C330000-0x000000001C33C000-memory.dmp

Filesize
48KB

Download
memory/1928-32-0x000000001C340000-0x000000001C348000-memory.dmp

Filesize
32KB

Download
memory/1928-33-0x000000001C350000-0x000000001C362000-memory.dmp

Filesize
72KB

Download
memory/1928-34-0x000000001C8B0000-0x000000001CDD8000-memory.dmp

Filesize
5.2MB

Download
memory/1928-35-0x000000001C380000-0x000000001C38C000-memory.dmp

Filesize
48KB

Download
memory/1928-36-0x000000001C390000-0x000000001C398000-memory.dmp

Filesize
32KB

Download
memory/1928-37-0x000000001C3A0000-0x000000001C3AC000-memory.dmp

Filesize
48KB

Download
memory/1928-38-0x000000001C3B0000-0x000000001C3BC000-memory.dmp

Filesize
48KB

Download
memory/1928-39-0x000000001C630000-0x000000001C638000-memory.dmp

Filesize
32KB

Download
memory/1928-40-0x000000001C5C0000-0x000000001C5CC000-memory.dmp

Filesize
48KB

Download
memory/1928-41-0x000000001C5D0000-0x000000001C5DA000-memory.dmp

Filesize
40KB

Download
memory/1928-44-0x000000001C600000-0x000000001C60E000-memory.dmp

Filesize
56KB

Download
memory/1928-43-0x000000001C5F0000-0x000000001C5F8000-memory.dmp

Filesize
32KB

Download
memory/1928-42-0x000000001C5E0000-0x000000001C5EE000-memory.dmp

Filesize
56KB

Download
memory/1928-45-0x000000001C610000-0x000000001C61C000-memory.dmp

Filesize
48KB

Download
memory/1928-47-0x000000001C740000-0x000000001C74A000-memory.dmp

Filesize
40KB

Download
memory/1928-46-0x000000001C620000-0x000000001C628000-memory.dmp

Filesize
32KB

Download
memory/1928-48-0x000000001C640000-0x000000001C64C000-memory.dmp

Filesize
48KB

Download
memory/1928-29-0x000000001C310000-0x000000001C31C000-memory.dmp

Filesize
48KB

Download
memory/1928-27-0x000000001C2B0000-0x000000001C2BA000-memory.dmp

Filesize
40KB

Download
memory/1928-26-0x000000001C2A0000-0x000000001C2B0000-memory.dmp

Filesize
64KB

Download
memory/1928-25-0x000000001C120000-0x000000001C128000-memory.dmp

Filesize
32KB

Download
memory/1928-23-0x000000001C290000-0x000000001C2A2000-memory.dmp

Filesize
72KB

Download
memory/1928-12-0x00007FF99C983000-0x00007FF99C985000-memory.dmp

Filesize
8KB

Download
memory/1928-22-0x000000001C110000-0x000000001C118000-memory.dmp

Filesize
32KB

Download
memory/1928-21-0x000000001C0F0000-0x000000001C106000-memory.dmp

Filesize
88KB

Download
memory/1928-20-0x000000001BAD0000-0x000000001BAE0000-memory.dmp

Filesize
64KB

Download
memory/1928-19-0x000000001BAC0000-0x000000001BAC8000-memory.dmp

Filesize
32KB

Download
memory/1928-18-0x000000001C140000-0x000000001C190000-memory.dmp

Filesize
320KB

Download
memory/1928-17-0x000000001BAA0000-0x000000001BABC000-memory.dmp

Filesize
112KB

Download
memory/1928-13-0x0000000000B10000-0x0000000000E6C000-memory.dmp

Filesize
3.4MB

Download
memory/1928-16-0x000000001BA90000-0x000000001BA98000-memory.dmp

Filesize
32KB

Download
memory/1928-15-0x000000001BA80000-0x000000001BA8E000-memory.dmp

Filesize
56KB

Download
memory/1928-14-0x000000001BA70000-0x000000001BA7E000-memory.dmp

Filesize
56KB

Download
memory/2660-164-0x0000000002BB0000-0x0000000002BC2000-memory.dmp

Filesize
72KB

Download
memory/4196-188-0x000000001BED0000-0x000000001BEE2000-memory.dmp

Filesize
72KB

Download
memory/4196-189-0x000000001C0B0000-0x000000001C0C2000-memory.dmp

Filesize
72KB

Download
memory/5064-119-0x00000000033B0000-0x00000000033C2000-memory.dmp

Filesize
72KB

Download