dcrat | 8e7147a2aaffb6632052f190dad38b7d945ae42f1c4e21307f6d9079afb76372

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

E96B9E17DA08C5A64C26DC666402C64F.exe
Size

1.2MB
MD5

e96b9e17da08c5a64c26dc666402c64f
SHA1

cceec5c7f6f4bbf08c63153a0dea8b5834ed38ee
SHA256

8e7147a2aaffb6632052f190dad38b7d945ae42f1c4e21307f6d9079afb76372
SHA512

dd71101f1b6b0dcd545bec2e448c6368a8653b599a5b0de3287ac50126b0c380a325e92fa201bdd869d97cf18e63d0795879923e9364abb92adfc57af02d5040
SSDEEP

24576:QGZn/lA+WQi7Tw3d3pI0eqZb/bte1aMiL/8LLKwi/TIRk:QGzAy1Sob6CsL8

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

E96B9E17DA08C5A64C26DC666402C64F.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:/Users/Admin/AppData/Local/\\winlogon.exe\""	E96B9E17DA08C5A64C26DC666402C64F.exe

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2768	schtasks.exe	30

UAC bypass 3 TTPs 45 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exeE96B9E17DA08C5A64C26DC666402C64F.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	E96B9E17DA08C5A64C26DC666402C64F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	E96B9E17DA08C5A64C26DC666402C64F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	E96B9E17DA08C5A64C26DC666402C64F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/2640-1-0x0000000001190000-0x00000000012D4000-memory.dmp	dcrat
behavioral1/files/0x00090000000120f9-15.dat	dcrat
behavioral1/memory/2548-17-0x0000000000270000-0x00000000003B4000-memory.dmp	dcrat
behavioral1/memory/2952-29-0x0000000000DD0000-0x0000000000F14000-memory.dmp	dcrat
behavioral1/memory/2336-52-0x0000000000E70000-0x0000000000FB4000-memory.dmp	dcrat
behavioral1/memory/1948-75-0x0000000000AA0000-0x0000000000BE4000-memory.dmp	dcrat
behavioral1/memory/2292-87-0x0000000000130000-0x0000000000274000-memory.dmp	dcrat
behavioral1/memory/2372-99-0x0000000000AE0000-0x0000000000C24000-memory.dmp	dcrat
behavioral1/memory/264-111-0x0000000000FA0000-0x00000000010E4000-memory.dmp	dcrat

Executes dropped EXE 14 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

pid	Process
2548	winlogon.exe
2952	winlogon.exe
1684	winlogon.exe
2336	winlogon.exe
2208	winlogon.exe
1948	winlogon.exe
2292	winlogon.exe
2372	winlogon.exe
264	winlogon.exe
1692	winlogon.exe
2752	winlogon.exe
2548	winlogon.exe
1220	winlogon.exe
2000	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

E96B9E17DA08C5A64C26DC666402C64F.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:/Users/Admin/AppData/Local/\\winlogon.exe\""	E96B9E17DA08C5A64C26DC666402C64F.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:/Users/Admin/AppData/Local/\\winlogon.exe\""	E96B9E17DA08C5A64C26DC666402C64F.exe

Checks whether UAC is enabled 1 TTPs 30 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exeE96B9E17DA08C5A64C26DC666402C64F.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	E96B9E17DA08C5A64C26DC666402C64F.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	E96B9E17DA08C5A64C26DC666402C64F.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid	Process
2296	schtasks.exe
2744	schtasks.exe
2764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

E96B9E17DA08C5A64C26DC666402C64F.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

pid	Process
2640	E96B9E17DA08C5A64C26DC666402C64F.exe
2548	winlogon.exe
2952	winlogon.exe
1684	winlogon.exe
2336	winlogon.exe
2208	winlogon.exe
1948	winlogon.exe
2292	winlogon.exe
2372	winlogon.exe
264	winlogon.exe
1692	winlogon.exe
2752	winlogon.exe
2548	winlogon.exe
1220	winlogon.exe
2000	winlogon.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

description	pid	Process
Token: SeDebugPrivilege	2640	E96B9E17DA08C5A64C26DC666402C64F.exe
Token: SeDebugPrivilege	2548	winlogon.exe
Token: SeDebugPrivilege	2952	winlogon.exe
Token: SeDebugPrivilege	1684	winlogon.exe
Token: SeDebugPrivilege	2336	winlogon.exe
Token: SeDebugPrivilege	2208	winlogon.exe
Token: SeDebugPrivilege	1948	winlogon.exe
Token: SeDebugPrivilege	2292	winlogon.exe
Token: SeDebugPrivilege	2372	winlogon.exe
Token: SeDebugPrivilege	264	winlogon.exe
Token: SeDebugPrivilege	1692	winlogon.exe
Token: SeDebugPrivilege	2752	winlogon.exe
Token: SeDebugPrivilege	2548	winlogon.exe
Token: SeDebugPrivilege	1220	winlogon.exe
Token: SeDebugPrivilege	2000	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

E96B9E17DA08C5A64C26DC666402C64F.exewinlogon.exeWScript.exewinlogon.exeWScript.exewinlogon.exeWScript.exewinlogon.exeWScript.exewinlogon.exeWScript.exewinlogon.exeWScript.exewinlogon.exeWScript.exe

description	pid	Process	procid_target
PID 2640 wrote to memory of 2548	2640	E96B9E17DA08C5A64C26DC666402C64F.exe	34
PID 2640 wrote to memory of 2548	2640	E96B9E17DA08C5A64C26DC666402C64F.exe	34
PID 2640 wrote to memory of 2548	2640	E96B9E17DA08C5A64C26DC666402C64F.exe	34
PID 2548 wrote to memory of 1392	2548	winlogon.exe	35
PID 2548 wrote to memory of 1392	2548	winlogon.exe	35
PID 2548 wrote to memory of 1392	2548	winlogon.exe	35
PID 2548 wrote to memory of 1764	2548	winlogon.exe	36
PID 2548 wrote to memory of 1764	2548	winlogon.exe	36
PID 2548 wrote to memory of 1764	2548	winlogon.exe	36
PID 1392 wrote to memory of 2952	1392	WScript.exe	37
PID 1392 wrote to memory of 2952	1392	WScript.exe	37
PID 1392 wrote to memory of 2952	1392	WScript.exe	37
PID 2952 wrote to memory of 2924	2952	winlogon.exe	38
PID 2952 wrote to memory of 2924	2952	winlogon.exe	38
PID 2952 wrote to memory of 2924	2952	winlogon.exe	38
PID 2952 wrote to memory of 1704	2952	winlogon.exe	39
PID 2952 wrote to memory of 1704	2952	winlogon.exe	39
PID 2952 wrote to memory of 1704	2952	winlogon.exe	39
PID 2924 wrote to memory of 1684	2924	WScript.exe	40
PID 2924 wrote to memory of 1684	2924	WScript.exe	40
PID 2924 wrote to memory of 1684	2924	WScript.exe	40
PID 1684 wrote to memory of 2172	1684	winlogon.exe	41
PID 1684 wrote to memory of 2172	1684	winlogon.exe	41
PID 1684 wrote to memory of 2172	1684	winlogon.exe	41
PID 1684 wrote to memory of 2188	1684	winlogon.exe	42
PID 1684 wrote to memory of 2188	1684	winlogon.exe	42
PID 1684 wrote to memory of 2188	1684	winlogon.exe	42
PID 2172 wrote to memory of 2336	2172	WScript.exe	43
PID 2172 wrote to memory of 2336	2172	WScript.exe	43
PID 2172 wrote to memory of 2336	2172	WScript.exe	43
PID 2336 wrote to memory of 1040	2336	winlogon.exe	44
PID 2336 wrote to memory of 1040	2336	winlogon.exe	44
PID 2336 wrote to memory of 1040	2336	winlogon.exe	44
PID 2336 wrote to memory of 968	2336	winlogon.exe	45
PID 2336 wrote to memory of 968	2336	winlogon.exe	45
PID 2336 wrote to memory of 968	2336	winlogon.exe	45
PID 1040 wrote to memory of 2208	1040	WScript.exe	46
PID 1040 wrote to memory of 2208	1040	WScript.exe	46
PID 1040 wrote to memory of 2208	1040	WScript.exe	46
PID 2208 wrote to memory of 3040	2208	winlogon.exe	47
PID 2208 wrote to memory of 3040	2208	winlogon.exe	47
PID 2208 wrote to memory of 3040	2208	winlogon.exe	47
PID 2208 wrote to memory of 1004	2208	winlogon.exe	48
PID 2208 wrote to memory of 1004	2208	winlogon.exe	48
PID 2208 wrote to memory of 1004	2208	winlogon.exe	48
PID 3040 wrote to memory of 1948	3040	WScript.exe	49
PID 3040 wrote to memory of 1948	3040	WScript.exe	49
PID 3040 wrote to memory of 1948	3040	WScript.exe	49
PID 1948 wrote to memory of 2688	1948	winlogon.exe	50
PID 1948 wrote to memory of 2688	1948	winlogon.exe	50
PID 1948 wrote to memory of 2688	1948	winlogon.exe	50
PID 1948 wrote to memory of 2720	1948	winlogon.exe	51
PID 1948 wrote to memory of 2720	1948	winlogon.exe	51
PID 1948 wrote to memory of 2720	1948	winlogon.exe	51
PID 2688 wrote to memory of 2292	2688	WScript.exe	52
PID 2688 wrote to memory of 2292	2688	WScript.exe	52
PID 2688 wrote to memory of 2292	2688	WScript.exe	52
PID 2292 wrote to memory of 1020	2292	winlogon.exe	53
PID 2292 wrote to memory of 1020	2292	winlogon.exe	53
PID 2292 wrote to memory of 1020	2292	winlogon.exe	53
PID 2292 wrote to memory of 2116	2292	winlogon.exe	54
PID 2292 wrote to memory of 2116	2292	winlogon.exe	54
PID 2292 wrote to memory of 2116	2292	winlogon.exe	54
PID 1020 wrote to memory of 2372	1020	WScript.exe	55

System policy modification 1 TTPs 45 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exeE96B9E17DA08C5A64C26DC666402C64F.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	E96B9E17DA08C5A64C26DC666402C64F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	E96B9E17DA08C5A64C26DC666402C64F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	E96B9E17DA08C5A64C26DC666402C64F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\E96B9E17DA08C5A64C26DC666402C64F.exe
"C:\Users\Admin\AppData\Local\Temp\E96B9E17DA08C5A64C26DC666402C64F.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2640
- C:\Users\Admin\AppData\Local\winlogon.exe
  "C:\Users\Admin\AppData\Local\winlogon.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2548
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d30d445a-5ca8-4177-8d97-ca212341f963.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Users\Admin\AppData\Local\winlogon.exe
      C:\Users\Admin\AppData\Local\winlogon.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2952
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ab7527a-3437-47b2-b555-b0245e1673ce.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2924
      - C:\Users\Admin\AppData\Local\winlogon.exe
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1684
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78c7678c-a8dc-47ce-9bf0-935e722ceadd.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2336
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\95af63b7-08e2-4537-84c1-324dced931af.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2208
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aca8cabf-22b5-4eab-958d-178b77d0cb84.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ef68173-21be-47b5-a84a-c5184c097c24.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2292
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\68e7b3da-d081-4c64-ae62-316360bd6a11.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2372
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\612998fa-8937-4d67-be02-e0c8c66c9823.vbs"
        17⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:264
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\74b3ae9b-72e1-4256-af00-83c4e475f230.vbs"
        19⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\065a821d-6fe7-4f24-a13b-be4739af0135.vbs"
        21⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2752
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ed2c11f-b74b-41d6-b272-cc6b472cf831.vbs"
        23⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        24⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28fa5b40-507e-425b-a3a6-281b38141741.vbs"
        25⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        26⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1220
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\693f7e15-f419-4972-8dc6-5a2fd90bfab4.vbs"
        27⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        
        C:\Users\Admin\AppData\Local\winlogon.exe
        28⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2000
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed6099e7-4130-4411-a91c-b531233540c4.vbs"
        29⤵
        
        PID:1368
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a2f665c9-0b3f-48f2-9894-b52e1064b097.vbs"
        29⤵
        
        PID:2360
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5ffc820f-db7a-4d36-b83d-86ff4f5c9ff4.vbs"
        27⤵
        
        PID:1200
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8cd7e117-f86b-4ba9-af15-55337068477a.vbs"
        25⤵
        
        PID:2204
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e6c01b82-6266-4d79-b35b-5e58b962e5e3.vbs"
        23⤵
        
        PID:3012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f6e6c1be-c612-44bc-b26a-cbca1f224519.vbs"
        21⤵
        
        PID:2816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4aaab3b6-5cfa-4641-a016-bc6ee22c42e4.vbs"
        19⤵
        
        PID:2392
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a827f0af-4811-4ce9-9814-e36199c4019a.vbs"
        17⤵
        
        PID:2192
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df57d2af-954f-4b8b-bdc2-6a23389a43b4.vbs"
        15⤵
        
        PID:2116
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\601512ff-8433-42c7-86a1-d5cf886665ec.vbs"
        13⤵
        
        PID:2720
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20fa76fe-67ab-4687-85f2-8c66fa6f4ec6.vbs"
        11⤵
        
        PID:1004
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36c240ba-4bd7-46de-80d6-cee93602c9a4.vbs"
        9⤵
        
        PID:968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2129de3d-f238-47b0-9315-64c1b234c95f.vbs"
        7⤵
        
        PID:2188
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\394ead9b-1a81-4215-bcd0-ae6ac42d9ce6.vbs"
        5⤵
        
        PID:1704
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fbbafde1-0e2d-4162-ad42-a1886839441f.vbs"
    3⤵
    PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:/Users/Admin/AppData/Local/\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:/Users/Admin/AppData/Local/\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\065a821d-6fe7-4f24-a13b-be4739af0135.vbs

Filesize
717B

MD5
0f4fae324ae68c10bd25437eb5da2207

SHA1
8eefb4c3a1b49528cab2675a74c791df07c2b01c

SHA256
46693fdea27db74662aadf1a4b3900435b23e38604ce96ca334e95a80d91a0bc

SHA512
916d031132f6ae0e59423b69e641afdf168fd8f9234e1868e77bd7384833953773cacf2df8ed3b9d0003ca211a170e9523f65a6ab4aeca830fe147abc3b3d555

Download Submit
C:\Users\Admin\AppData\Local\Temp\1ab7527a-3437-47b2-b555-b0245e1673ce.vbs

Filesize
717B

MD5
f8c9373e26e297d276ea7be3cd966186

SHA1
ed3eadfde77779838121ae0d084205fbaf4393e6

SHA256
a934b41e393ad76623d5e80b740e8bc88580cb69e71d102ae2f7c24e5fc97357

SHA512
7d5f60e8e288eefc9c0d22d0d49bbf74417083a05289cac08de129abd3560ad7c03b2c8636f5b21d65992144a0cbd2f6370ecd6486a78b47d12a57a0021e42ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ed2c11f-b74b-41d6-b272-cc6b472cf831.vbs

Filesize
717B

MD5
98b93e771741847e1bb03a20e797113e

SHA1
db8c700365f09d3a858ae2552722029571025b75

SHA256
8e201b5a5a600c010cf40dce84a014277b3a0417756364679798c60103ad6211

SHA512
55ec8ca8631b62d7b41a2591d22cd44fb28c1bc5ba590593d79bc99203713caf1fd2bb02fdd2dd227c473b40d1108ebafcf6f88958f7bb861cac9dc44b6eae33

Download Submit
C:\Users\Admin\AppData\Local\Temp\612998fa-8937-4d67-be02-e0c8c66c9823.vbs

Filesize
717B

MD5
bcab15468eb39276497c4d6484d3125c

SHA1
ab26ba0b46e99f29a800f6124ba97a6b4b300840

SHA256
15ec85f8a9d381dd24c299dfb3f29b11f65e7ff6cd16687e87959df666374b99

SHA512
1ca9a4b5000ec85fce2398a69a02eb483f90021c3170b51150d4bc5a12315ca25237c1a15dce307ed67a64153dccb7af4c5396525f8d06736c3f1f34bfcefbd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\68e7b3da-d081-4c64-ae62-316360bd6a11.vbs

Filesize
717B

MD5
e22446e5edd288c35248f1adccbcf264

SHA1
bb2d32fa2bcf6b79a9cb641fc9807d94cde3b0bc

SHA256
e2f99cc755dbb04904c0848876955659cf0b81c6cc81b5a7603722d958934610

SHA512
e69bf6ba8aac46c8d1e66bc08c539f647f765f04df5ac856016bb33509b49db2f55c3cde0b41f3851f41328b0f0bc6ca9ef9e3a41def8f3387a65659a51d21bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\693f7e15-f419-4972-8dc6-5a2fd90bfab4.vbs

Filesize
717B

MD5
c8def7a6d129f2d19f2a63864e169bdb

SHA1
0e0c6667f18e33f9794b29a0d75b0c7a69528fdf

SHA256
fd98f6e3d4bf7312d4eae16122e97841f656caacd8c9235c33e053175fe3ed98

SHA512
92d4f297d4e80b6bd85f7dfaa9a56734e9c01930c02bc253af48406dd701ad91ed39bb942ab50c659b3e502231b53adf2450138a1825728542f8b448d99903fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\74b3ae9b-72e1-4256-af00-83c4e475f230.vbs

Filesize
716B

MD5
cf7f1c288cf9e3ef5067c1e54ff34477

SHA1
e4dd649a816c46e075ac76977bd30f9f6c72a681

SHA256
5292be5486aea7d29418aca6402cee84e88f49de8973e1ce0527d8d917cc5659

SHA512
e4e87a71b5fe6602ab455eb79a8f99339b8ac6753f766deac1179f51f8a08b4dc5ba0af54e8fcf362a407a16a2f8074ef74e12614dbd73b8f2bee1b1a019f250

Download Submit
C:\Users\Admin\AppData\Local\Temp\78c7678c-a8dc-47ce-9bf0-935e722ceadd.vbs

Filesize
717B

MD5
2e04a376576c0dc82e62dddba7970f2b

SHA1
e6eb4857f389861bf126b2645c84313a77c641b0

SHA256
f37099aa0add533982880f172d54ad2833afd985fb64faa1d2d73ff270b4dcb2

SHA512
075de8cdb5092764ec5998834cd62f209e1f99fb9beb2a3145f87819fc01a4821494fd0889ecf23f0659ac2a63ba1a405e39e4fe72258da92f13af4b1dda9fff

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ef68173-21be-47b5-a84a-c5184c097c24.vbs

Filesize
717B

MD5
41fe4ae24e327279b730459c427df83f

SHA1
80a70807cd62afe3945f9e69e22eec370de88461

SHA256
5cffb0553d5896c64bf8dcbf433d161b886286f354b334f69214d78dbe5b7b78

SHA512
5e6382f6c688d57717a26b6a81c563b4f428b1009c0ee025db0a997ee6e70060a45f7e25e5283a48259911f20828a59d979c858dd105cb7780d38d7b4b3d9fe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\95af63b7-08e2-4537-84c1-324dced931af.vbs

Filesize
717B

MD5
fbc0e3d328718907fd445f2229e90ec2

SHA1
c7299f331b4167a4a34b5570c2f618e27e69daea

SHA256
ca263f2639cdb6daca321e0cbeaf14448cd142c8959fc3dfe3848b89e500f587

SHA512
4e6d8f535f25979d47a508686f7805df00a81660b717c8dc9a847023bc9c653ee2c3b4cb644e00ef4d7e7ef531e74134a871394dc0d6f62c89557b0e6b5fd351

Download Submit
C:\Users\Admin\AppData\Local\Temp\aca8cabf-22b5-4eab-958d-178b77d0cb84.vbs

Filesize
717B

MD5
6dfca22795f93a64f33739ca2f4b9a7b

SHA1
8cdc79ac9f774905f820d7ac42a8e078f1eff82a

SHA256
183a122c026fd8845ceff5c3db40ca86599ab519854f6d05b81700db570efeaa

SHA512
13abc1afc00e6670a6e188ba953e30d7d4bc1052f58777243cadb6400021b0901990bd6d1accbc583df6fb297c83134e6f78a2997fa73bf3429f48fc95d3aea1

Download Submit
C:\Users\Admin\AppData\Local\Temp\d30d445a-5ca8-4177-8d97-ca212341f963.vbs

Filesize
717B

MD5
4c5b08f7fa05c9f560e3f6cee65f196e

SHA1
37fe1b83e39a5ef38b31c805f19329ecc92372dc

SHA256
95ba608bcc575f94693c0656083630108efcfe5c78bf30e1e80a85ac38eda055

SHA512
4ff129d89b348416e04453311ab5e8f91d7fdb6405e7fdda5428dd634f8cf56c2c5985a589e3d71d0b051ed681d1ac46e48ded742cc3165048b4904618405ecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ed6099e7-4130-4411-a91c-b531233540c4.vbs

Filesize
717B

MD5
f6b2991058ad60375980f624ba731663

SHA1
87765e4db8f98fe7afafd9acfa4f24743493a993

SHA256
03674df5c3f49490827e547642458aeb70f56e7aa96a25dcf4a9473a4994eaac

SHA512
b8f018dda6db9c6fad62b1f84e161f204d271bca6ca90f4bc6b775ec8978496df07224426937a4258702aaafbcaf45dcfd84f0233cbb9f46fdfb82f15bf9ccaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\fbbafde1-0e2d-4162-ad42-a1886839441f.vbs

Filesize
493B

MD5
982a80b4cc3cea44c6aae5b359087ece

SHA1
4148ae1ccead774fd3b4d2a45a6efbf97276cf1e

SHA256
c7ee8921ea5aed2448830eccdde160b47295e169592f8d0bf4182d2199491891

SHA512
47f1f8fe86900cf95b36591bbb2522844465f0f4bd39de6db5a8a6ba3ca151e4986ed8e68f673f7a54949c5a77d7d3eec4a5d5c7b234f851974e144f8559d13e

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
1.2MB

MD5
e96b9e17da08c5a64c26dc666402c64f

SHA1
cceec5c7f6f4bbf08c63153a0dea8b5834ed38ee

SHA256
8e7147a2aaffb6632052f190dad38b7d945ae42f1c4e21307f6d9079afb76372

SHA512
dd71101f1b6b0dcd545bec2e448c6368a8653b599a5b0de3287ac50126b0c380a325e92fa201bdd869d97cf18e63d0795879923e9364abb92adfc57af02d5040

Download Submit
memory/264-111-0x0000000000FA0000-0x00000000010E4000-memory.dmp

Filesize
1.3MB

Download
memory/1948-75-0x0000000000AA0000-0x0000000000BE4000-memory.dmp

Filesize
1.3MB

Download
memory/2292-87-0x0000000000130000-0x0000000000274000-memory.dmp

Filesize
1.3MB

Download
memory/2336-52-0x0000000000E70000-0x0000000000FB4000-memory.dmp

Filesize
1.3MB

Download
memory/2372-99-0x0000000000AE0000-0x0000000000C24000-memory.dmp

Filesize
1.3MB

Download
memory/2548-17-0x0000000000270000-0x00000000003B4000-memory.dmp

Filesize
1.3MB

Download
memory/2640-7-0x0000000000BE0000-0x0000000000BEC000-memory.dmp

Filesize
48KB

Download
memory/2640-0-0x000007FEF5DF3000-0x000007FEF5DF4000-memory.dmp

Filesize
4KB

Download
memory/2640-18-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

Filesize
9.9MB

Download
memory/2640-6-0x0000000000BD0000-0x0000000000BDA000-memory.dmp

Filesize
40KB

Download
memory/2640-5-0x0000000000BC0000-0x0000000000BCA000-memory.dmp

Filesize
40KB

Download
memory/2640-4-0x0000000000BA0000-0x0000000000BB6000-memory.dmp

Filesize
88KB

Download
memory/2640-3-0x0000000000B80000-0x0000000000B9C000-memory.dmp

Filesize
112KB

Download
memory/2640-2-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

Filesize
9.9MB

Download
memory/2640-1-0x0000000001190000-0x00000000012D4000-memory.dmp

Filesize
1.3MB

Download
memory/2952-29-0x0000000000DD0000-0x0000000000F14000-memory.dmp

Filesize
1.3MB

Download