dcrat | 43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-12-2024 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Size

4.9MB
MD5

583b26ac46872fddf808789e82a9f2af
SHA1

9546b2719df0b0cb760440605dc5b2cf8d7a45e5
SHA256

43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a
SHA512

2a31ee6d45fc58c8162d62add81a7c53282e33034cfd5eadcc0b5db7e12003aad7575a4c9683ad3384fc18e44224e331ad5b7b2ac0365841d0b0176e37a0e78f
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	792	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	332	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	2484	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2484	schtasks.exe	30

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2380-3-0x00000000010D0000-0x00000000011FE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2332	powershell.exe
1408	powershell.exe
2496	powershell.exe
2872	powershell.exe
1852	powershell.exe
2688	powershell.exe
2028	powershell.exe
732	powershell.exe
676	powershell.exe
2828	powershell.exe
1888	powershell.exe
700	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
1628	dllhost.exe
2404	dllhost.exe
2640	dllhost.exe
2968	dllhost.exe
1564	dllhost.exe
2588	dllhost.exe
2432	dllhost.exe
2272	dllhost.exe
2908	dllhost.exe
2340	dllhost.exe
1988	dllhost.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Journal\OSPPSVC.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Program Files (x86)\Common Files\System.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Program Files (x86)\Common Files\27d1bcfc3c54e0	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Program Files\Internet Explorer\fr-FR\43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Program Files\Windows Journal\OSPPSVC.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Program Files\Windows Journal\1610b97d3ab4a7	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Program Files (x86)\Common Files\RCX991C.tmp	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Program Files\Internet Explorer\fr-FR\a58523b445ce9b	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Program Files (x86)\Common Files\System.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Program Files\Internet Explorer\fr-FR\RCXA12B.tmp	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Program Files\Internet Explorer\fr-FR\43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Program Files\Windows Journal\RCXA7A3.tmp	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\PLA\Templates\Idle.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Windows\ja-JP\RCX9033.tmp	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\RCXA39C.tmp	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\csrss.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Windows\PLA\Templates\RCXAA14.tmp	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Windows\PLA\Templates\Idle.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Windows\ja-JP\6cb0b6c459d5d3	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Windows\Prefetch\ReadyBoot\csrss.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Windows\PLA\Templates\6ccacd8608530f	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Windows\ja-JP\dwm.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Windows\ja-JP\dwm.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Windows\Prefetch\ReadyBoot\886983d96e3d3e	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2576	schtasks.exe
2948	schtasks.exe
2972	schtasks.exe
2460	schtasks.exe
2748	schtasks.exe
2840	schtasks.exe
2000	schtasks.exe
2068	schtasks.exe
3068	schtasks.exe
2044	schtasks.exe
2792	schtasks.exe
1796	schtasks.exe
1520	schtasks.exe
1272	schtasks.exe
2572	schtasks.exe
1104	schtasks.exe
1376	schtasks.exe
2944	schtasks.exe
2676	schtasks.exe
2232	schtasks.exe
2212	schtasks.exe
1844	schtasks.exe
2736	schtasks.exe
1836	schtasks.exe
3052	schtasks.exe
1360	schtasks.exe
916	schtasks.exe
844	schtasks.exe
2332	schtasks.exe
2620	schtasks.exe
1920	schtasks.exe
1324	schtasks.exe
1064	schtasks.exe
332	schtasks.exe
972	schtasks.exe
2708	schtasks.exe
1116	schtasks.exe
3036	schtasks.exe
2916	schtasks.exe
1296	schtasks.exe
2828	schtasks.exe
792	schtasks.exe
2328	schtasks.exe
2408	schtasks.exe
320	schtasks.exe
1292	schtasks.exe
1744	schtasks.exe
1052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
1888	powershell.exe
676	powershell.exe
2872	powershell.exe
2828	powershell.exe
2496	powershell.exe
732	powershell.exe
2028	powershell.exe
700	powershell.exe
1408	powershell.exe
1852	powershell.exe
2332	powershell.exe
2688	powershell.exe
1628	dllhost.exe
2404	dllhost.exe
2640	dllhost.exe
2968	dllhost.exe
1564	dllhost.exe
2588	dllhost.exe
2432	dllhost.exe
2272	dllhost.exe
2908	dllhost.exe
2340	dllhost.exe
1988	dllhost.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeDebugPrivilege	676	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	732	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	700	powershell.exe
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	1628	dllhost.exe
Token: SeDebugPrivilege	2404	dllhost.exe
Token: SeDebugPrivilege	2640	dllhost.exe
Token: SeDebugPrivilege	2968	dllhost.exe
Token: SeDebugPrivilege	1564	dllhost.exe
Token: SeDebugPrivilege	2588	dllhost.exe
Token: SeDebugPrivilege	2432	dllhost.exe
Token: SeDebugPrivilege	2272	dllhost.exe
Token: SeDebugPrivilege	2908	dllhost.exe
Token: SeDebugPrivilege	2340	dllhost.exe
Token: SeDebugPrivilege	1988	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 732	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	79
PID 2380 wrote to memory of 732	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	79
PID 2380 wrote to memory of 732	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	79
PID 2380 wrote to memory of 676	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	80
PID 2380 wrote to memory of 676	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	80
PID 2380 wrote to memory of 676	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	80
PID 2380 wrote to memory of 1408	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	81
PID 2380 wrote to memory of 1408	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	81
PID 2380 wrote to memory of 1408	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	81
PID 2380 wrote to memory of 2332	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	83
PID 2380 wrote to memory of 2332	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	83
PID 2380 wrote to memory of 2332	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	83
PID 2380 wrote to memory of 2028	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	85
PID 2380 wrote to memory of 2028	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	85
PID 2380 wrote to memory of 2028	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	85
PID 2380 wrote to memory of 2688	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	86
PID 2380 wrote to memory of 2688	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	86
PID 2380 wrote to memory of 2688	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	86
PID 2380 wrote to memory of 1852	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	87
PID 2380 wrote to memory of 1852	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	87
PID 2380 wrote to memory of 1852	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	87
PID 2380 wrote to memory of 2872	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	88
PID 2380 wrote to memory of 2872	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	88
PID 2380 wrote to memory of 2872	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	88
PID 2380 wrote to memory of 700	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	89
PID 2380 wrote to memory of 700	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	89
PID 2380 wrote to memory of 700	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	89
PID 2380 wrote to memory of 1888	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	90
PID 2380 wrote to memory of 1888	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	90
PID 2380 wrote to memory of 1888	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	90
PID 2380 wrote to memory of 2496	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	91
PID 2380 wrote to memory of 2496	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	91
PID 2380 wrote to memory of 2496	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	91
PID 2380 wrote to memory of 2828	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	92
PID 2380 wrote to memory of 2828	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	92
PID 2380 wrote to memory of 2828	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	92
PID 2380 wrote to memory of 824	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	103
PID 2380 wrote to memory of 824	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	103
PID 2380 wrote to memory of 824	2380	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	103
PID 824 wrote to memory of 572	824	cmd.exe	105
PID 824 wrote to memory of 572	824	cmd.exe	105
PID 824 wrote to memory of 572	824	cmd.exe	105
PID 824 wrote to memory of 1628	824	cmd.exe	106
PID 824 wrote to memory of 1628	824	cmd.exe	106
PID 824 wrote to memory of 1628	824	cmd.exe	106
PID 1628 wrote to memory of 1540	1628	dllhost.exe	108
PID 1628 wrote to memory of 1540	1628	dllhost.exe	108
PID 1628 wrote to memory of 1540	1628	dllhost.exe	108
PID 1628 wrote to memory of 2748	1628	dllhost.exe	109
PID 1628 wrote to memory of 2748	1628	dllhost.exe	109
PID 1628 wrote to memory of 2748	1628	dllhost.exe	109
PID 1540 wrote to memory of 2404	1540	WScript.exe	110
PID 1540 wrote to memory of 2404	1540	WScript.exe	110
PID 1540 wrote to memory of 2404	1540	WScript.exe	110
PID 2404 wrote to memory of 3056	2404	dllhost.exe	111
PID 2404 wrote to memory of 3056	2404	dllhost.exe	111
PID 2404 wrote to memory of 3056	2404	dllhost.exe	111
PID 2404 wrote to memory of 468	2404	dllhost.exe	112
PID 2404 wrote to memory of 468	2404	dllhost.exe	112
PID 2404 wrote to memory of 468	2404	dllhost.exe	112
PID 3056 wrote to memory of 2640	3056	WScript.exe	113
PID 3056 wrote to memory of 2640	3056	WScript.exe	113
PID 3056 wrote to memory of 2640	3056	WScript.exe	113
PID 2640 wrote to memory of 3028	2640	dllhost.exe	114

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
"C:\Users\Admin\AppData\Local\Temp\43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ua07L9pKQl.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:572
- - C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe
    "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1628
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a4c92e70-0d7f-4d9a-9c6f-b32692579de3.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1540
    - - C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2404
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\607a4457-a00e-499a-b90d-8d080814bb64.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c22c8cb-f190-482b-a7ce-1008039efe9a.vbs"
        8⤵
        
        PID:3028
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe"
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28aab653-88cf-4f2f-8552-a75806ce22f2.vbs"
        10⤵
        
        PID:2760
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe"
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1564
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8da70b89-9867-4930-ad98-07aedf40d2f7.vbs"
        12⤵
        
        PID:2604
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe"
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2588
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4e623c02-11ff-4fe5-9938-0e330504f0bc.vbs"
        14⤵
        
        PID:784
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe"
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0085a4af-c359-4c4e-80ef-6ef97b4cc803.vbs"
        16⤵
        
        PID:1520
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe"
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76679da2-54bf-44e1-8b71-917557ff5eee.vbs"
        18⤵
        
        PID:1852
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe"
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2908
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a49f32b-43b4-4b68-a761-a14c4c7df46b.vbs"
        20⤵
        
        PID:2804
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe"
        21⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\142e8bfb-4651-49cd-8194-2ced6b41e162.vbs"
        22⤵
        
        PID:1616
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe"
        23⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\481207d2-dce9-42eb-aef5-947544187d4e.vbs"
        24⤵
        
        PID:972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97251bb4-b429-4a13-a3bc-1408822d034d.vbs"
        24⤵
        
        PID:1888
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\07ed06ef-7e2a-44d8-af57-007d4e1352d6.vbs"
        22⤵
        
        PID:2232
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\65dcbded-6ac0-41cc-8f55-965690a2d0e9.vbs"
        20⤵
        
        PID:1288
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d38dda6d-0736-416b-b49e-0d99cf7eda7a.vbs"
        18⤵
        
        PID:2856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e4e48a2a-6de1-49ec-96e5-c7b977a17928.vbs"
        16⤵
        
        PID:2552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d1f0fae9-72b8-439d-a9b7-6add2ec4a364.vbs"
        14⤵
        
        PID:816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7035e1da-3bf0-42dc-a455-06c29ced63ae.vbs"
        12⤵
        
        PID:2548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7557a1b5-fa4d-4d14-8100-b62d88ed7825.vbs"
        10⤵
        
        PID:3036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\879b8ced-cd62-44c6-ab2f-98267b01dfac.vbs"
        8⤵
        
        PID:300
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52feb1b9-935c-43f2-9daa-0be320977550.vbs"
        6⤵
        
        PID:468
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6d6b932d-72ab-4cb2-83c9-5f6a0d49bdfb.vbs"
      4⤵
      PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\ja-JP\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\ja-JP\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\ja-JP\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a4" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\fr-FR\43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\fr-FR\43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a4" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\fr-FR\43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\Prefetch\ReadyBoot\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\Prefetch\ReadyBoot\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Journal\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Windows\PLA\Templates\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\PLA\Templates\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Windows\PLA\Templates\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Music\Sample Music\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Music\Sample Music\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Music\Sample Music\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe

Filesize
4.9MB

MD5
10300fadeace850bde9b78c6e6c43a23

SHA1
4aa334e987c2fb79a82b491ce2c06af5938e295e

SHA256
97d7f84dd1115b7b2fc13446c9f6d0060e9ab6bccca2257f96b2c877f8624e6c

SHA512
9d0791313127440d5b6534069cf17b6e6acaf1ac43cd6ca4d06367ef21b18ce220096d46acd9f9cb96feeb604665265d41acce2211b6c524e2ef78f12075f6e2

Download Submit
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\OSPPSVC.exe

Filesize
4.9MB

MD5
583b26ac46872fddf808789e82a9f2af

SHA1
9546b2719df0b0cb760440605dc5b2cf8d7a45e5

SHA256
43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a

SHA512
2a31ee6d45fc58c8162d62add81a7c53282e33034cfd5eadcc0b5db7e12003aad7575a4c9683ad3384fc18e44224e331ad5b7b2ac0365841d0b0176e37a0e78f

Download Submit
C:\Users\Admin\AppData\Local\Temp\0085a4af-c359-4c4e-80ef-6ef97b4cc803.vbs

Filesize
750B

MD5
da64cd49576f9d9710a5ec59de7d7e10

SHA1
2d2d680d4648396c447cf7b55f11172c3e2711af

SHA256
14164318f73135754642cc14414d45574ac26f97c2344f7fbe1ba30730e16759

SHA512
444aaae535ddf6c2dc530eaa38d1595824228831f22e1c2cda91ad965cc13bd4f568c9d757862488d21ae14559bd6997890a9bdc8e34cdd2c44a6ed4db22c7f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\142e8bfb-4651-49cd-8194-2ced6b41e162.vbs

Filesize
750B

MD5
87dd94a65f9d938348cc45e2c829bdc1

SHA1
17ceeeaee876428f9ef046b64b1d7d441865418f

SHA256
b542bf576e4cd10592e7403c13180c6a24b01c4832ba996e207aeda30a820866

SHA512
137a404a99c6ba5426e3cd64a770c2ab3f447748c44eece4822ef579c85cc1aa10d288b4aedc791728838f5892d1333bd952d0fd403745dd87fea40d0d080601

Download Submit
C:\Users\Admin\AppData\Local\Temp\1a49f32b-43b4-4b68-a761-a14c4c7df46b.vbs

Filesize
750B

MD5
82dda28d56b59b3799ee6a795ecd3e93

SHA1
54da515ab813f120ab8a07f0c2628ded5a5043cd

SHA256
516468999b9914c9d67f5ded75358593309f101c48aca6caf903cd91c381288f

SHA512
0d278e3bb5d51c04d3b8808c24a1dfee72ce6a88bf3fe6bae5a06d8d39f84699bc3dbbf15e81e19b23f6b0d05c22bc8dd19dd582618fadef92c91dc25fe11eb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\28aab653-88cf-4f2f-8552-a75806ce22f2.vbs

Filesize
750B

MD5
66e76207c402829427fd0e25c4c6f464

SHA1
82cbb929a1a5dd3e70d2320cb9fab898eef35793

SHA256
b3f1d80f06f0558700909502f5c4d63ba02eb5ec03e564fcddaac00396fc63ef

SHA512
40e18f9e22d205af2ab1765803f2d1d25740894821f44c1071e21e4bde7081fc4b0bc88928e9ba6cec157f74a917289be6579bb90bed190ef249752df4b3fe14

Download Submit
C:\Users\Admin\AppData\Local\Temp\481207d2-dce9-42eb-aef5-947544187d4e.vbs

Filesize
750B

MD5
aefa69a645b7f3be0b3101e32ec34675

SHA1
055576cd3f5ebcb68149938c62a9dbec87e0ec43

SHA256
1835df2d8de33f0798a723fefd875a2f4fcd2969a5b80e8ff950f1af461aaec5

SHA512
1c8d43d674c0366f94160ffa49537991b57771257d384d21b5f932d05cba4a44704d8b676ca929e7739fefa2bc60a2536da38ca31e2edd73636b742eef6eacd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\4e623c02-11ff-4fe5-9938-0e330504f0bc.vbs

Filesize
750B

MD5
32e11fec76e01f2af4cd4e788740e694

SHA1
bc9fb200774019827083efc4515ba387e9948acd

SHA256
cd933c98441f6946e14a7c8b8c53eb32acf646f5df5dcc04a4289a9cccd41d2f

SHA512
b36d26de845a134d37634a4d9244579ae7620e81ef3c144ccefe749d56f3b8bb9bb26e6ae3ba779ebadd74a8a28a0b8cdaf1d7a920ce6c092e1fce3d5cf0ae8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\5c22c8cb-f190-482b-a7ce-1008039efe9a.vbs

Filesize
750B

MD5
0ee161bf4e5a13415a09f114dcb918c8

SHA1
c41bf481df661f88f8f21dd0785d4182824aa78e

SHA256
7892779110ee05d9aa9bce99f6fa90cab9afb3cdc99cb2d891a9d2394d696dca

SHA512
18c2353847678d71f07a2926ff0d078a4f4fb477f8035bf2853a20632420e0db8025b6335d8f0558c583ae1395610898dadfe739f84ee883623e9c33bff4a022

Download Submit
C:\Users\Admin\AppData\Local\Temp\607a4457-a00e-499a-b90d-8d080814bb64.vbs

Filesize
750B

MD5
7365f38859846a0c5977eee1a171cccd

SHA1
67d61988163171a93ef0ba4dd56fc9656f405494

SHA256
786d35a20dfdac6e4319a93cb33f3a4d426767ead0a9808151b0b22ffd16e101

SHA512
cac2588e8e44c718fcf0c4823b6be90afa79a1253239de11cbc50eb170b9dee7524d24fecd97c620d3e0b6ee5fbd3233669f25d6d60a74bd36aa412cd915f5f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\6d6b932d-72ab-4cb2-83c9-5f6a0d49bdfb.vbs

Filesize
526B

MD5
6665bce3a9f02820d26a0a93721538e6

SHA1
19c20eecd9a5ef175ecd376df2ee81a5f379f89a

SHA256
e5773fdfde4ee7c2f7c968c569f5f63b1043268b0558b50b5a40de13cd8cdfb5

SHA512
f1761f4c451b56e8b066060575bd568b7d630a9b43c3aad614d1be6f53d58a4c9e098a0211ed786d59567527556c8cc59a31d1f69f2adb1b97305bea6c3984ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\76679da2-54bf-44e1-8b71-917557ff5eee.vbs

Filesize
750B

MD5
4bf9306c61d67406cfb59afb98f7c096

SHA1
bfeea2afbbe61c4ba34c6f88c768bec5c4430142

SHA256
0e92e2dfa2f0094631bcdf8f96f1d4396c6f23d599f4dee9e487e652350444b6

SHA512
03e62cd6a5dc323d18d5c087358f59431c5d70248919ba351c5bd8da36016a8f797c424b8cb7928401628284ebc5fd5315d9832d5686b3b92872b50fbffc6398

Download Submit
C:\Users\Admin\AppData\Local\Temp\8da70b89-9867-4930-ad98-07aedf40d2f7.vbs

Filesize
750B

MD5
24e28562bcd4d893e98c5723a7ec906d

SHA1
a4e0238d2321020dfa05afbdf827ba938b4b765a

SHA256
037f71176b22069e34b99dad488b57e9b5b41deacf1a7db81c45a2938e917580

SHA512
6ee332c09211c16a2c779b721c8343835e42057bc386baaaad086ae350c87d0842432185f7d10fc068c329b0a82c4b9e9587e640ecd5ec49c0198bfa87e91c50

Download Submit
C:\Users\Admin\AppData\Local\Temp\a4c92e70-0d7f-4d9a-9c6f-b32692579de3.vbs

Filesize
750B

MD5
6907e7d36e055767d64d022cabc2a1f6

SHA1
da9c921e89d77b7f288c14db1c88530f33cf9dd5

SHA256
ec686773614f656bc9865e6b1f4790ac9ff12395cf02713404b559ad1dc41688

SHA512
d4214e4b509c0e5334fd9908d8ab1bd87eea32510612f9c76e81f5fcaf40d554611aea5d6dcfa4cc5054bfe1945b5b06f333751e187881fe999e13f755607fc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD3D3.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ua07L9pKQl.bat

Filesize
239B

MD5
b06c69510655849c22227883b7798c80

SHA1
95752f75d14e2340fc3b18d6a6ccfd7b95d2fb2b

SHA256
92c5baa2d783dd76e0713ae5220332016d94358a6ff678a073aa2b3bc60bc65f

SHA512
6378c0d728ed14ae6297d010e402f412a6f4087c6cdaeff3f78b5f973a7efad72ed913107681880830ad00c870d8276efb2dbac8d4c4623c6967de5f3cd790bf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
62058d99c1a6b84709fdd8171c9b93b3

SHA1
81f11af1f04b4992b416896d68b09f02be3e78bc

SHA256
584f93d58e467c7f48cab65e0b2bf29b0b1531a90878e41477a297ee632e1369

SHA512
c9eef3c43f3414685a14603fa8a3dc0ea1f4d13b3983f4a401c4e9b130c916310056dca85f7c7257d8f7b450821b50840056b5ab423a932bfcc964212b656063

Download Submit
C:\Windows\PLA\Templates\Idle.exe

Filesize
4.9MB

MD5
af26e97126b9ad4407b667a108242576

SHA1
f8badb393cdb03b6711e3b311aee0df5c0da4bfb

SHA256
77340f1cdf6902cd22bcd60ac51404550c37abc94e0432ebc26c47b0605fde89

SHA512
3e732fe4fb0f889781b429e4018c8ea12c058664e326081cd541456ecca6d32c92924e7915ace57d24a9327c51aa915284069374adb80b8e7bd6af7055156bdb

Download Submit
memory/1564-285-0x00000000012A0000-0x0000000001794000-memory.dmp

Filesize
5.0MB

Download
memory/1628-226-0x0000000000010000-0x0000000000504000-memory.dmp

Filesize
5.0MB

Download
memory/1888-213-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/2340-359-0x00000000011E0000-0x00000000016D4000-memory.dmp

Filesize
5.0MB

Download
memory/2380-12-0x0000000000F10000-0x0000000000F1E000-memory.dmp

Filesize
56KB

Download
memory/2380-2-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2380-1-0x0000000001280000-0x0000000001774000-memory.dmp

Filesize
5.0MB

Download
memory/2380-142-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2380-135-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmp

Filesize
4KB

Download
memory/2380-16-0x0000000001200000-0x000000000120C000-memory.dmp

Filesize
48KB

Download
memory/2380-15-0x0000000000FC0000-0x0000000000FC8000-memory.dmp

Filesize
32KB

Download
memory/2380-14-0x0000000000FB0000-0x0000000000FB8000-memory.dmp

Filesize
32KB

Download
memory/2380-13-0x0000000000F20000-0x0000000000F2E000-memory.dmp

Filesize
56KB

Download
memory/2380-6-0x0000000000690000-0x00000000006A0000-memory.dmp

Filesize
64KB

Download
memory/2380-0-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmp

Filesize
4KB

Download
memory/2380-5-0x00000000004C0000-0x00000000004C8000-memory.dmp

Filesize
32KB

Download
memory/2380-11-0x0000000000F00000-0x0000000000F0A000-memory.dmp

Filesize
40KB

Download
memory/2380-3-0x00000000010D0000-0x00000000011FE000-memory.dmp

Filesize
1.2MB

Download
memory/2380-10-0x0000000000EF0000-0x0000000000F02000-memory.dmp

Filesize
72KB

Download
memory/2380-9-0x0000000000EE0000-0x0000000000EEA000-memory.dmp

Filesize
40KB

Download
memory/2380-7-0x0000000000EC0000-0x0000000000ED6000-memory.dmp

Filesize
88KB

Download
memory/2380-8-0x00000000006A0000-0x00000000006B0000-memory.dmp

Filesize
64KB

Download
memory/2380-4-0x00000000004A0000-0x00000000004BC000-memory.dmp

Filesize
112KB

Download
memory/2380-165-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2404-240-0x0000000000960000-0x0000000000E54000-memory.dmp

Filesize
5.0MB

Download
memory/2432-315-0x00000000009A0000-0x00000000009B2000-memory.dmp

Filesize
72KB

Download
memory/2432-314-0x0000000000240000-0x0000000000734000-memory.dmp

Filesize
5.0MB

Download
memory/2640-255-0x00000000001D0000-0x00000000006C4000-memory.dmp

Filesize
5.0MB

Download
memory/2828-207-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2908-344-0x0000000001000000-0x00000000014F4000-memory.dmp

Filesize
5.0MB

Download
memory/2968-270-0x0000000000A20000-0x0000000000F14000-memory.dmp

Filesize
5.0MB

Download