dcrat | 73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\drvsetup\\dllhost.exe\", \"C:\\PerfLogs\\sppsvc.exe\", \"C:\\PerfLogs\\System.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\drvsetup\\dllhost.exe\", \"C:\\PerfLogs\\sppsvc.exe\", \"C:\\PerfLogs\\System.exe\", \"C:\\Windows\\System32\\KBDINPUN\\winlogon.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\drvsetup\\dllhost.exe\", \"C:\\PerfLogs\\sppsvc.exe\", \"C:\\PerfLogs\\System.exe\", \"C:\\Windows\\System32\\KBDINPUN\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\drvsetup\\dllhost.exe\", \"C:\\PerfLogs\\sppsvc.exe\", \"C:\\PerfLogs\\System.exe\", \"C:\\Windows\\System32\\KBDINPUN\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Users\\Admin\\Local Settings\\73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\drvsetup\\dllhost.exe\", \"C:\\PerfLogs\\sppsvc.exe\", \"C:\\PerfLogs\\System.exe\", \"C:\\Windows\\System32\\KBDINPUN\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Users\\Admin\\Local Settings\\73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\resources\\StartMenuExperienceHost.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\drvsetup\\dllhost.exe\", \"C:\\PerfLogs\\sppsvc.exe\", \"C:\\PerfLogs\\System.exe\", \"C:\\Windows\\System32\\KBDINPUN\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Users\\Admin\\Local Settings\\73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\resources\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\My Documents\\Registry.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\drvsetup\\dllhost.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\drvsetup\\dllhost.exe\", \"C:\\PerfLogs\\sppsvc.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	4876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	4876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	4876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	4876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	4876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	4876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	4876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	4876	schtasks.exe	82

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2600-1-0x0000000000D60000-0x0000000000E54000-memory.dmp	dcrat
behavioral2/files/0x0008000000023c0a-20.dat	dcrat
behavioral2/files/0x000a000000023c4e-41.dat	dcrat
behavioral2/files/0x000b000000023bca-52.dat	dcrat
behavioral2/files/0x000a000000023bd0-63.dat	dcrat
behavioral2/files/0x000a000000023bd5-74.dat	dcrat
behavioral2/memory/2384-135-0x0000000000E50000-0x0000000000F44000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe

Executes dropped EXE 1 IoCs

pid	Process
2384	dllhost.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\resources\\StartMenuExperienceHost.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Default\\My Documents\\Registry.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\drvsetup\\dllhost.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\KBDINPUN\\winlogon.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\KBDINPUN\\winlogon.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\PerfLogs\\sppsvc.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\PerfLogs\\System.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15 = "\"C:\\Users\\Admin\\Local Settings\\73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\resources\\StartMenuExperienceHost.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\PerfLogs\\sppsvc.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\PerfLogs\\System.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15 = "\"C:\\Users\\Admin\\Local Settings\\73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\drvsetup\\dllhost.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Default\\My Documents\\Registry.exe\""	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drvsetup\dllhost.exe	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
File created	C:\Windows\System32\KBDINPUN\winlogon.exe	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
File opened for modification	C:\Windows\System32\drvsetup\RCX903C.tmp	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
File opened for modification	C:\Windows\System32\drvsetup\RCX90BA.tmp	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
File opened for modification	C:\Windows\System32\KBDINPUN\RCX97F2.tmp	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
File opened for modification	C:\Windows\System32\KBDINPUN\RCX9861.tmp	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
File opened for modification	C:\Windows\System32\KBDINPUN\winlogon.exe	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
File created	C:\Windows\System32\drvsetup\dllhost.exe	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
File created	C:\Windows\System32\drvsetup\5940a34987c99120d96dace90a3f93f329dcad63	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
File created	C:\Windows\System32\KBDINPUN\cc11b995f2a76da408ea6a601e682e64743153ad	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\resources\StartMenuExperienceHost.exe	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\resources\55b276f4edf653fe07efe8f1ecc32d3d195abd16	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\resources\RCX9EFD.tmp	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\resources\RCX9F0E.tmp	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\resources\StartMenuExperienceHost.exe	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4992	schtasks.exe
3024	schtasks.exe
1896	schtasks.exe
4880	schtasks.exe
316	schtasks.exe
4460	schtasks.exe
4024	schtasks.exe
2312	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2600	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
2600	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
2600	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
2600	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
2600	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
2600	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
2600	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
2600	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
2600	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
2600	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
2600	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Token: SeDebugPrivilege	2384	dllhost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2384	2600	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe	91
PID 2600 wrote to memory of 2384	2600	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe	91

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe
"C:\Users\Admin\AppData\Local\Temp\73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2600
- C:\Windows\System32\drvsetup\dllhost.exe
  "C:\Windows\System32\drvsetup\dllhost.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\drvsetup\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\PerfLogs\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\PerfLogs\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\KBDINPUN\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\73eaa2708311d2ac31d2a440146fccf8c44d4cf3f2413620aaad7ff096a8fe15.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\resources\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default\My Documents\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses