dcrat | 4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28-11-2024 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Size

4.9MB
MD5

1942a319d1a63f4329b9a218916e7bb0
SHA1

67d8341f0b49c19debbfe1ad450464eca5c03eb5
SHA256

4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742
SHA512

9fda304f1093a8bc94d52133076b1b4321f9d99afc98c26670c22355b337c373a7d22a8ddf967d0d503e0cb42fb5efb36f81506ea7279b5377ec274562ce30c7
SSDEEP

49152:rl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2836	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2836	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2836	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	2836	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2836	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	2836	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	2836	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	2836	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2836	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2836	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2836	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2836	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	2836	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2836	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2836	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2836	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2836	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	2836	schtasks.exe	30

UAC bypass 3 TTPs 27 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

lsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exe4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/2900-2-0x000000001B580000-0x000000001B6AE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2600	powershell.exe
2348	powershell.exe
2220	powershell.exe
2444	powershell.exe
2440	powershell.exe
1544	powershell.exe
1264	powershell.exe
1624	powershell.exe
2116	powershell.exe
1956	powershell.exe
2184	powershell.exe
2464	powershell.exe

Executes dropped EXE 8 IoCs

Processes:

lsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exe

pid	Process
2604	lsass.exe
1252	lsass.exe
2200	lsass.exe
2352	lsass.exe
3044	lsass.exe
2376	lsass.exe
1744	lsass.exe
2264	lsass.exe

Checks whether UAC is enabled 1 TTPs 18 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

lsass.exe4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe

Drops file in Program Files directory 8 IoCs

Processes:

4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\6203df4a6bafc7	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\RCX8D44.tmp	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\fr-FR\RCX8F67.tmp	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Program Files (x86)\Google\Temp\winlogon.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\winlogon.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Program Files (x86)\Google\Temp\cc11b995f2a76d	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe

Drops file in Windows directory 5 IoCs

Processes:

4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe

description	ioc	Process
File created	C:\Windows\rescache\rc0000\wininit.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Windows\Migration\WTR\smss.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Windows\Migration\WTR\69ddcba757bf72	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Windows\Migration\WTR\RCX9979.tmp	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Windows\Migration\WTR\smss.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
2508	schtasks.exe
2608	schtasks.exe
1936	schtasks.exe
2736	schtasks.exe
2992	schtasks.exe
2428	schtasks.exe
2680	schtasks.exe
2656	schtasks.exe
2224	schtasks.exe
2700	schtasks.exe
2932	schtasks.exe
2588	schtasks.exe
1548	schtasks.exe
1652	schtasks.exe
1560	schtasks.exe
2716	schtasks.exe
2896	schtasks.exe
2436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exelsass.exe

pid	Process
2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2600	powershell.exe
2464	powershell.exe
2184	powershell.exe
2440	powershell.exe
1624	powershell.exe
2116	powershell.exe
2348	powershell.exe
1956	powershell.exe
2444	powershell.exe
2220	powershell.exe
1264	powershell.exe
1544	powershell.exe
2604	lsass.exe
1252	lsass.exe
2200	lsass.exe
2352	lsass.exe
3044	lsass.exe
2376	lsass.exe
1744	lsass.exe
2264	lsass.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

description	pid	Process
Token: SeDebugPrivilege	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	2604	lsass.exe
Token: SeDebugPrivilege	1252	lsass.exe
Token: SeDebugPrivilege	2200	lsass.exe
Token: SeDebugPrivilege	2352	lsass.exe
Token: SeDebugPrivilege	3044	lsass.exe
Token: SeDebugPrivilege	2376	lsass.exe
Token: SeDebugPrivilege	1744	lsass.exe
Token: SeDebugPrivilege	2264	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exelsass.exeWScript.exelsass.exeWScript.exelsass.exeWScript.exe

description	pid	Process	procid_target
PID 2900 wrote to memory of 2600	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	49
PID 2900 wrote to memory of 2600	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	49
PID 2900 wrote to memory of 2600	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	49
PID 2900 wrote to memory of 2440	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	50
PID 2900 wrote to memory of 2440	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	50
PID 2900 wrote to memory of 2440	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	50
PID 2900 wrote to memory of 2348	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	51
PID 2900 wrote to memory of 2348	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	51
PID 2900 wrote to memory of 2348	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	51
PID 2900 wrote to memory of 2464	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	52
PID 2900 wrote to memory of 2464	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	52
PID 2900 wrote to memory of 2464	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	52
PID 2900 wrote to memory of 2444	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	53
PID 2900 wrote to memory of 2444	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	53
PID 2900 wrote to memory of 2444	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	53
PID 2900 wrote to memory of 2184	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	54
PID 2900 wrote to memory of 2184	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	54
PID 2900 wrote to memory of 2184	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	54
PID 2900 wrote to memory of 1956	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	55
PID 2900 wrote to memory of 1956	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	55
PID 2900 wrote to memory of 1956	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	55
PID 2900 wrote to memory of 2116	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	58
PID 2900 wrote to memory of 2116	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	58
PID 2900 wrote to memory of 2116	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	58
PID 2900 wrote to memory of 1624	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	59
PID 2900 wrote to memory of 1624	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	59
PID 2900 wrote to memory of 1624	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	59
PID 2900 wrote to memory of 2220	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	60
PID 2900 wrote to memory of 2220	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	60
PID 2900 wrote to memory of 2220	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	60
PID 2900 wrote to memory of 1264	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	62
PID 2900 wrote to memory of 1264	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	62
PID 2900 wrote to memory of 1264	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	62
PID 2900 wrote to memory of 1544	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	63
PID 2900 wrote to memory of 1544	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	63
PID 2900 wrote to memory of 1544	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	63
PID 2900 wrote to memory of 2604	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	73
PID 2900 wrote to memory of 2604	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	73
PID 2900 wrote to memory of 2604	2900	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	73
PID 2604 wrote to memory of 780	2604	lsass.exe	74
PID 2604 wrote to memory of 780	2604	lsass.exe	74
PID 2604 wrote to memory of 780	2604	lsass.exe	74
PID 2604 wrote to memory of 560	2604	lsass.exe	75
PID 2604 wrote to memory of 560	2604	lsass.exe	75
PID 2604 wrote to memory of 560	2604	lsass.exe	75
PID 780 wrote to memory of 1252	780	WScript.exe	76
PID 780 wrote to memory of 1252	780	WScript.exe	76
PID 780 wrote to memory of 1252	780	WScript.exe	76
PID 1252 wrote to memory of 1440	1252	lsass.exe	77
PID 1252 wrote to memory of 1440	1252	lsass.exe	77
PID 1252 wrote to memory of 1440	1252	lsass.exe	77
PID 1252 wrote to memory of 2692	1252	lsass.exe	78
PID 1252 wrote to memory of 2692	1252	lsass.exe	78
PID 1252 wrote to memory of 2692	1252	lsass.exe	78
PID 1440 wrote to memory of 2200	1440	WScript.exe	79
PID 1440 wrote to memory of 2200	1440	WScript.exe	79
PID 1440 wrote to memory of 2200	1440	WScript.exe	79
PID 2200 wrote to memory of 840	2200	lsass.exe	80
PID 2200 wrote to memory of 840	2200	lsass.exe	80
PID 2200 wrote to memory of 840	2200	lsass.exe	80
PID 2200 wrote to memory of 2896	2200	lsass.exe	81
PID 2200 wrote to memory of 2896	2200	lsass.exe	81
PID 2200 wrote to memory of 2896	2200	lsass.exe	81
PID 840 wrote to memory of 2352	840	WScript.exe	82

System policy modification 1 TTPs 27 IoCs

evasion

Modify Registry

T1112

Processes:

lsass.exelsass.exelsass.exelsass.exe4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exelsass.exelsass.exelsass.exelsass.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
"C:\Users\Admin\AppData\Local\Temp\4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe
  "C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2604
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f407a0a7-133a-4089-8238-4d5277e217a9.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:780
  - - C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe
      "C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1252
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26bdce92-77ce-4cb4-98d1-463d95003710.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1440
      - C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe
        
        "C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2200
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e7a3ae43-0897-496c-80cf-a8006e2a6c31.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:840
        
        C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe
        
        "C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2352
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\961bcf26-ef4c-4d6e-9749-193c47e69e41.vbs"
        9⤵
        
        PID:1328
        
        C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe
        
        "C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\24a20186-8249-4103-9e78-522563d13b20.vbs"
        11⤵
        
        PID:2884
        
        C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe
        
        "C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2376
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\73aecbed-3951-4ad3-8d62-17dfd297c856.vbs"
        13⤵
        
        PID:1648
        
        C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe
        
        "C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1744
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6c92906f-b99b-4d10-bb73-0e30c1eedcd9.vbs"
        15⤵
        
        PID:1076
        
        C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe
        
        "C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2264
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\34562381-96a2-491f-96a9-5c958235a504.vbs"
        17⤵
        
        PID:1920
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1e347c2a-da89-4f12-a89a-fae60945612d.vbs"
        17⤵
        
        PID:3024
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9fcae1a7-8d53-4a7a-9239-77829334ebe3.vbs"
        15⤵
        
        PID:1540
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3b6e2b08-c9ff-4e68-9faf-ce87e9f2bca8.vbs"
        13⤵
        
        PID:2516
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\24d5d571-a029-447e-b344-b6c4891e990e.vbs"
        11⤵
        
        PID:1688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20e8e706-f458-4315-8e2e-f0b1921b4aa5.vbs"
        9⤵
        
        PID:2288
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f26c27f6-d97f-467a-8f81-7834d26ca19d.vbs"
        7⤵
        
        PID:2896
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6be870b3-0283-463e-ae43-3047b64aee1f.vbs"
        5⤵
        
        PID:2692
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42a72f92-376b-4b9e-9ca3-5998dc9cfbe5.vbs"
    3⤵
    PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Temp\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Temp\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Desktop\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default\Desktop\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Desktop\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\Migration\WTR\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\Migration\WTR\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe

Filesize
4.9MB

MD5
1814e2c8ffe130058b9bf66d15d40f6a

SHA1
c1c0b993794cee591846a5f58e8801268425edca

SHA256
bd176152296f79ae575854e333f23ad18165813bd938c0fdd0bdb5b0913623dd

SHA512
6dd17174bf925f982101b784e944afa4566386374b34c2d358b8c2030734cefc11fd48d3a3191f33c89e167a05380067eeabd9838e0f0fcc2471151bc364bee0

Download Submit
C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe

Filesize
4.9MB

MD5
1942a319d1a63f4329b9a218916e7bb0

SHA1
67d8341f0b49c19debbfe1ad450464eca5c03eb5

SHA256
4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742

SHA512
9fda304f1093a8bc94d52133076b1b4321f9d99afc98c26670c22355b337c373a7d22a8ddf967d0d503e0cb42fb5efb36f81506ea7279b5377ec274562ce30c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\24a20186-8249-4103-9e78-522563d13b20.vbs

Filesize
732B

MD5
e7668d0f4cbffb56bcff5eca81923644

SHA1
3ed417cc7ec7e92da3956738bf561e1e1e2e95ad

SHA256
2e04b0196faa068ce33aae416238174b198a7b188e1434459d8fd1ea98f94fbf

SHA512
a2a46b87b3e72b083511ee988099598901fea250d5726b2f36c93a0bd3634057d564bad6f3d915989c478f07c07938e3f82d74c824f85c5d26187170dc7b9cc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\26bdce92-77ce-4cb4-98d1-463d95003710.vbs

Filesize
732B

MD5
f90742dd581d09fd1799ff94a6121d8b

SHA1
dae24d69ec6e627df57e2cbe83271ffcb1f8cdfa

SHA256
75a20ee1650423a335b8323b8f424f4d998ae30ab571ddf5f97c0f6a7dc6053a

SHA512
a05bde9261f90b9f8ae39a31ef1e1a5286be215c11c9c2ae8307a6b2fe47ea3f3a97da28de47b2aedc50b1aa6cbcf2ab4e22688eb8389b614acbaef34285b1d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\34562381-96a2-491f-96a9-5c958235a504.vbs

Filesize
732B

MD5
2dfa8e6afcdc83dfcd4f5b49cbf902af

SHA1
f7e661a37f288c6c11003aa5ae0bd81c1669a613

SHA256
3bdce31ca7e1176dbd1b9388334899a422b9d7129c63ff39f14bd6e91d4fb3cd

SHA512
95c38930d58a5af6527f1060073a47910ad4d184635d5832b3d35a826d948677ba86b17104c66cf0ac28356eed50cfbfb892cbb45652452eb9b054939a1c5e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\42a72f92-376b-4b9e-9ca3-5998dc9cfbe5.vbs

Filesize
508B

MD5
3cdb8997f805a75694b96c3b446f9029

SHA1
61ae21e5bd8701dcfbe03818aeb8428702acb7fb

SHA256
75838996f66acdfd1e5e0327318c8cd77652566d71bdc2f08be94f5284650979

SHA512
02c4da9e2af265e8790ac9e02a4c57d0af085a60bde86fd1b4b637f2ce5686bacff622468a95b717ff8f2ca6414dc756c0c2a3ed0ac23a4ab9caba419f0eb838

Download Submit
C:\Users\Admin\AppData\Local\Temp\6c92906f-b99b-4d10-bb73-0e30c1eedcd9.vbs

Filesize
732B

MD5
5a8c06ee6ea810f86c949edb4378edec

SHA1
0581be2c0fd5a65c07f1e11e2ca21abed9136157

SHA256
f918deedc7c6a67cafda55557d217475c8489f2ced5068e40eaad76f1a5e5413

SHA512
bd794f954fc293ec9da417ab8e7137e18ead6f1520b4b33fea8b24c5d054c75029985630bba9b4bc5e791f1d6f9b84832411f23ceffe176d003693854846fe71

Download Submit
C:\Users\Admin\AppData\Local\Temp\73aecbed-3951-4ad3-8d62-17dfd297c856.vbs

Filesize
732B

MD5
5f77f7cc07f79c8c5250433d56723ffb

SHA1
9bcae9c42134bbf4d61c713787e9bf956a1d2359

SHA256
e7cc085ca9ddd26ec7c71911279d8d67f756aaa3d841373608d2ca957412a393

SHA512
dadc5fcabb7ffb3845103735884cf560e1a2c8796d07122b2fc3479ebafdf50806dec7a4a24b8c374973b8e72836e9774ccfb1cbd26a1ccb8607729d569b8f81

Download Submit
C:\Users\Admin\AppData\Local\Temp\961bcf26-ef4c-4d6e-9749-193c47e69e41.vbs

Filesize
732B

MD5
7d035320fe9bd58bfe1fdd5397c3c8c7

SHA1
f73ceadcdef962fbb67cb4ddbab110791129b7f6

SHA256
b08d5ec43998ce6e135ea47e71d3be2800a7aa4bb8f9632b33538cba1f95af71

SHA512
ce6f9566c6762ed6046df4e4f70c479225a4a60cba728c836c7da3d21732d117dd997a5c227b8ff14396261b4f2b093efd6b8b39245f7ba6deae8a84cd89e93f

Download Submit
C:\Users\Admin\AppData\Local\Temp\e7a3ae43-0897-496c-80cf-a8006e2a6c31.vbs

Filesize
732B

MD5
4810884a52782a41613e5e85de452b09

SHA1
4fdd3aef1d68febd3d26e3c2cae5338eac9fba8b

SHA256
8020b022d25b00c723ab77a22c98b84d5d346c24d1cb89d59a9d6fd9d2a53f0a

SHA512
685ebb489d4c4ba74c559854abd87ef456d86f3a962ffe10ecdd46abc3f15b49be453d3988e056d34a4147111067559b01a4f7772314b3baed71de2d10f33f90

Download Submit
C:\Users\Admin\AppData\Local\Temp\f407a0a7-133a-4089-8238-4d5277e217a9.vbs

Filesize
732B

MD5
756e16129ad5b170dc0e44eead9dae4f

SHA1
495b880f66160a31219bade988e096bcfd56205a

SHA256
890cdcd93e897761396e8d2a019bb46eee57a701a0419d37652ef546458413da

SHA512
cad2359cbcb5f74be98f80db79ff8bc86ab39b2c3dc467b4f419d4e23eec95a010227dc3f1ce55db52155849c8121aa743e6461cb121081052f2046cebd3c5bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC062.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S43WCBEBDSP9OOZBWDNC.temp

Filesize
7KB

MD5
f16be4805b1785883ee40495d0d84815

SHA1
9688dd26d55746f3ab794ca778a938441ed21aaa

SHA256
b6b65d795806d34274ee66fb43e0d96bcc7d19a547e628c7043e582881a59e8f

SHA512
db243e2af9ddca8496dadeec3e33ccac9018185b7939b086d5926e520d05bc94eb5c8224541f2952fc60266df3384e19782c8cb8fa1ae85f2291ef594a5491ce

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1252-157-0x00000000013D0000-0x00000000018C4000-memory.dmp

Filesize
5.0MB

Download
memory/1252-158-0x0000000000500000-0x0000000000512000-memory.dmp

Filesize
72KB

Download
memory/1744-234-0x0000000000340000-0x0000000000834000-memory.dmp

Filesize
5.0MB

Download
memory/2184-88-0x000000001B380000-0x000000001B662000-memory.dmp

Filesize
2.9MB

Download
memory/2264-249-0x0000000000360000-0x0000000000854000-memory.dmp

Filesize
5.0MB

Download
memory/2352-187-0x0000000000100000-0x00000000005F4000-memory.dmp

Filesize
5.0MB

Download
memory/2352-188-0x0000000000D00000-0x0000000000D12000-memory.dmp

Filesize
72KB

Download
memory/2376-218-0x0000000000C30000-0x0000000001124000-memory.dmp

Filesize
5.0MB

Download
memory/2376-219-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/2464-90-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Filesize
32KB

Download
memory/2604-143-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/2604-130-0x0000000000810000-0x0000000000D04000-memory.dmp

Filesize
5.0MB

Download
memory/2900-14-0x00000000024A0000-0x00000000024A8000-memory.dmp

Filesize
32KB

Download
memory/2900-118-0x000007FEF6BB0000-0x000007FEF759C000-memory.dmp

Filesize
9.9MB

Download
memory/2900-15-0x00000000024B0000-0x00000000024B8000-memory.dmp

Filesize
32KB

Download
memory/2900-6-0x0000000000A70000-0x0000000000A80000-memory.dmp

Filesize
64KB

Download
memory/2900-13-0x0000000002490000-0x000000000249E000-memory.dmp

Filesize
56KB

Download
memory/2900-2-0x000000001B580000-0x000000001B6AE000-memory.dmp

Filesize
1.2MB

Download
memory/2900-101-0x000007FEF6BB3000-0x000007FEF6BB4000-memory.dmp

Filesize
4KB

Download
memory/2900-0-0x000007FEF6BB3000-0x000007FEF6BB4000-memory.dmp

Filesize
4KB

Download
memory/2900-3-0x000007FEF6BB0000-0x000007FEF759C000-memory.dmp

Filesize
9.9MB

Download
memory/2900-16-0x00000000024C0000-0x00000000024CC000-memory.dmp

Filesize
48KB

Download
memory/2900-4-0x00000000009F0000-0x0000000000A0C000-memory.dmp

Filesize
112KB

Download
memory/2900-142-0x000007FEF6BB0000-0x000007FEF759C000-memory.dmp

Filesize
9.9MB

Download
memory/2900-5-0x0000000000A10000-0x0000000000A18000-memory.dmp

Filesize
32KB

Download
memory/2900-1-0x0000000000050000-0x0000000000544000-memory.dmp

Filesize
5.0MB

Download
memory/2900-12-0x0000000002480000-0x000000000248E000-memory.dmp

Filesize
56KB

Download
memory/2900-11-0x0000000002470000-0x000000000247A000-memory.dmp

Filesize
40KB

Download
memory/2900-10-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Filesize
72KB

Download
memory/2900-9-0x0000000000AB0000-0x0000000000ABA000-memory.dmp

Filesize
40KB

Download
memory/2900-8-0x0000000000AA0000-0x0000000000AB0000-memory.dmp

Filesize
64KB

Download
memory/2900-7-0x0000000000A80000-0x0000000000A96000-memory.dmp

Filesize
88KB

Download
memory/3044-203-0x0000000000260000-0x0000000000754000-memory.dmp

Filesize
5.0MB

Download