dcrat | 2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/12/2024, 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
Size

4.9MB
MD5

d35291f4c04427508ab9cb6be8eeb39f
SHA1

1bcf8448820f26174b1a547247fdfc960059a70c
SHA256

2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808
SHA512

adf26805866dd0cd5f1e921dcd02cac9a98a9c9f6e3bfd3e21084e8707ad0081196434f3c75ffe558573faca64ec0884559362e0ac0fffa7ef905b93e6fd1b83
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8f:n

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	476	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	716	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	340	1236	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	564	1236	schtasks.exe	30

UAC bypass 3 TTPs 27 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2776-2-0x000000001B640000-0x000000001B76E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1548	powershell.exe
2592	powershell.exe
2876	powershell.exe
2932	powershell.exe
2608	powershell.exe
2924	powershell.exe
2072	powershell.exe
1504	powershell.exe
1036	powershell.exe
3068	powershell.exe
2544	powershell.exe
1760	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
2228	dllhost.exe
916	dllhost.exe
1352	dllhost.exe
1872	dllhost.exe
3052	dllhost.exe
3000	dllhost.exe
2672	dllhost.exe
2452	dllhost.exe

Checks whether UAC is enabled 1 TTPs 18 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Mail\fr-FR\lsm.exe	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\RCXE4E.tmp	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File created	C:\Program Files\Windows Defender\de-DE\winlogon.exe	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File created	C:\Program Files (x86)\Windows Mail\fr-FR\lsm.exe	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\RCX7D6.tmp	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WmiPrvSE.exe	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File created	C:\Program Files (x86)\Windows Mail\fr-FR\101b941d020240	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6203df4a6bafc7	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\lsass.exe	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\cc11b995f2a76d	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\wininit.exe	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\56085415360792	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File created	C:\Program Files\Windows Defender\de-DE\cc11b995f2a76d	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCX15D.tmp	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\fr-FR\RCX361.tmp	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\RCX145A.tmp	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\24dbde2999530e	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\sppsvc.exe	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\0a1fd5f707cd16	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WmiPrvSE.exe	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\lsass.exe	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCXC4A.tmp	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\wininit.exe	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RCX1256.tmp	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\sppsvc.exe	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\winlogon.exe	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ja-JP\RCXFAE3.tmp	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File created	C:\Windows\ja-JP\2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File opened for modification	C:\Windows\ja-JP\2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
File created	C:\Windows\ja-JP\1fdb0b2ddd43ab	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2212	schtasks.exe
2884	schtasks.exe
2620	schtasks.exe
1796	schtasks.exe
1940	schtasks.exe
2056	schtasks.exe
2448	schtasks.exe
340	schtasks.exe
1352	schtasks.exe
2176	schtasks.exe
2352	schtasks.exe
2076	schtasks.exe
1800	schtasks.exe
1308	schtasks.exe
2580	schtasks.exe
2044	schtasks.exe
2396	schtasks.exe
1444	schtasks.exe
1584	schtasks.exe
2544	schtasks.exe
1456	schtasks.exe
1736	schtasks.exe
584	schtasks.exe
2888	schtasks.exe
2964	schtasks.exe
2440	schtasks.exe
2164	schtasks.exe
2340	schtasks.exe
2224	schtasks.exe
3008	schtasks.exe
564	schtasks.exe
2872	schtasks.exe
476	schtasks.exe
2124	schtasks.exe
1756	schtasks.exe
1928	schtasks.exe
2944	schtasks.exe
320	schtasks.exe
716	schtasks.exe
1884	schtasks.exe
1000	schtasks.exe
1520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
2932	powershell.exe
1504	powershell.exe
2876	powershell.exe
1036	powershell.exe
2592	powershell.exe
3068	powershell.exe
1760	powershell.exe
2072	powershell.exe
2608	powershell.exe
2924	powershell.exe
2544	powershell.exe
1548	powershell.exe
2228	dllhost.exe
916	dllhost.exe
1352	dllhost.exe
1872	dllhost.exe
3052	dllhost.exe
3000	dllhost.exe
2672	dllhost.exe
2452	dllhost.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	2072	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	1760	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	2228	dllhost.exe
Token: SeDebugPrivilege	916	dllhost.exe
Token: SeDebugPrivilege	1352	dllhost.exe
Token: SeDebugPrivilege	1872	dllhost.exe
Token: SeDebugPrivilege	3052	dllhost.exe
Token: SeDebugPrivilege	3000	dllhost.exe
Token: SeDebugPrivilege	2672	dllhost.exe
Token: SeDebugPrivilege	2452	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 1504	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	73
PID 2776 wrote to memory of 1504	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	73
PID 2776 wrote to memory of 1504	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	73
PID 2776 wrote to memory of 1036	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	74
PID 2776 wrote to memory of 1036	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	74
PID 2776 wrote to memory of 1036	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	74
PID 2776 wrote to memory of 2592	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	75
PID 2776 wrote to memory of 2592	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	75
PID 2776 wrote to memory of 2592	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	75
PID 2776 wrote to memory of 2876	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	77
PID 2776 wrote to memory of 2876	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	77
PID 2776 wrote to memory of 2876	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	77
PID 2776 wrote to memory of 2932	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	78
PID 2776 wrote to memory of 2932	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	78
PID 2776 wrote to memory of 2932	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	78
PID 2776 wrote to memory of 2608	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	80
PID 2776 wrote to memory of 2608	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	80
PID 2776 wrote to memory of 2608	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	80
PID 2776 wrote to memory of 2924	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	82
PID 2776 wrote to memory of 2924	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	82
PID 2776 wrote to memory of 2924	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	82
PID 2776 wrote to memory of 3068	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	83
PID 2776 wrote to memory of 3068	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	83
PID 2776 wrote to memory of 3068	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	83
PID 2776 wrote to memory of 2072	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	84
PID 2776 wrote to memory of 2072	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	84
PID 2776 wrote to memory of 2072	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	84
PID 2776 wrote to memory of 1548	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	85
PID 2776 wrote to memory of 1548	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	85
PID 2776 wrote to memory of 1548	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	85
PID 2776 wrote to memory of 2544	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	86
PID 2776 wrote to memory of 2544	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	86
PID 2776 wrote to memory of 2544	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	86
PID 2776 wrote to memory of 1760	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	87
PID 2776 wrote to memory of 1760	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	87
PID 2776 wrote to memory of 1760	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	87
PID 2776 wrote to memory of 2228	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	97
PID 2776 wrote to memory of 2228	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	97
PID 2776 wrote to memory of 2228	2776	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe	97
PID 2228 wrote to memory of 2720	2228	dllhost.exe	98
PID 2228 wrote to memory of 2720	2228	dllhost.exe	98
PID 2228 wrote to memory of 2720	2228	dllhost.exe	98
PID 2228 wrote to memory of 1240	2228	dllhost.exe	99
PID 2228 wrote to memory of 1240	2228	dllhost.exe	99
PID 2228 wrote to memory of 1240	2228	dllhost.exe	99
PID 2720 wrote to memory of 916	2720	WScript.exe	100
PID 2720 wrote to memory of 916	2720	WScript.exe	100
PID 2720 wrote to memory of 916	2720	WScript.exe	100
PID 916 wrote to memory of 2836	916	dllhost.exe	101
PID 916 wrote to memory of 2836	916	dllhost.exe	101
PID 916 wrote to memory of 2836	916	dllhost.exe	101
PID 916 wrote to memory of 1744	916	dllhost.exe	102
PID 916 wrote to memory of 1744	916	dllhost.exe	102
PID 916 wrote to memory of 1744	916	dllhost.exe	102
PID 2836 wrote to memory of 1352	2836	WScript.exe	103
PID 2836 wrote to memory of 1352	2836	WScript.exe	103
PID 2836 wrote to memory of 1352	2836	WScript.exe	103
PID 1352 wrote to memory of 2428	1352	dllhost.exe	104
PID 1352 wrote to memory of 2428	1352	dllhost.exe	104
PID 1352 wrote to memory of 2428	1352	dllhost.exe	104
PID 1352 wrote to memory of 2424	1352	dllhost.exe	105
PID 1352 wrote to memory of 2424	1352	dllhost.exe	105
PID 1352 wrote to memory of 2424	1352	dllhost.exe	105
PID 2428 wrote to memory of 1872	2428	WScript.exe	106

System policy modification 1 TTPs 27 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe
"C:\Users\Admin\AppData\Local\Temp\2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1760
- C:\Users\Public\Music\dllhost.exe
  "C:\Users\Public\Music\dllhost.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2228
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\87b8342f-3666-44a4-b5af-9513e91e9d86.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Users\Public\Music\dllhost.exe
      C:\Users\Public\Music\dllhost.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:916
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\534e4703-317a-4272-853d-c7b80c940b44.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2836
      - C:\Users\Public\Music\dllhost.exe
        
        C:\Users\Public\Music\dllhost.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1352
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a16a4ba-5363-4a46-885a-40f093bf0647.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Users\Public\Music\dllhost.exe
        
        C:\Users\Public\Music\dllhost.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1872
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\57c62344-30a3-4eec-904e-580064c3eb34.vbs"
        9⤵
        
        PID:1676
        
        C:\Users\Public\Music\dllhost.exe
        
        C:\Users\Public\Music\dllhost.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3052
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\37ee03e4-5e82-48be-8cdb-300404035263.vbs"
        11⤵
        
        PID:2864
        
        C:\Users\Public\Music\dllhost.exe
        
        C:\Users\Public\Music\dllhost.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3000
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\383eaf04-5d51-4ace-8ce8-58eb5c6c8b2a.vbs"
        13⤵
        
        PID:2720
        
        C:\Users\Public\Music\dllhost.exe
        
        C:\Users\Public\Music\dllhost.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2672
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eb8cf923-ab14-4ec0-a4cf-15df02b92a09.vbs"
        15⤵
        
        PID:1812
        
        C:\Users\Public\Music\dllhost.exe
        
        C:\Users\Public\Music\dllhost.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2452
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\030223db-b94b-4d05-9aa5-49c895df32d9.vbs"
        17⤵
        
        PID:1360
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\50447097-7c45-4387-b55e-81d24571e32c.vbs"
        17⤵
        
        PID:2880
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\24b99e44-278d-4b9c-a223-d86a4f4b0dd8.vbs"
        15⤵
        
        PID:2200
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a3919ac0-4c97-45f2-9001-fd1dcc70e5d5.vbs"
        13⤵
        
        PID:540
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d531494-93d9-41dd-8967-91baf32727f3.vbs"
        11⤵
        
        PID:332
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f812b08-7639-4964-a23d-e907783fe093.vbs"
        9⤵
        
        PID:1540
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a32d61d5-c0fb-40c7-b671-05ae4fd77b52.vbs"
        7⤵
        
        PID:2424
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc436656-17a5-4686-b1d0-0b50693f5c1a.vbs"
        5⤵
        
        PID:1744
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28c004f3-187a-4d25-8002-597cd9622ad5.vbs"
    3⤵
    PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc59028082" /sc MINUTE /mo 12 /tr "'C:\Windows\ja-JP\2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808" /sc ONLOGON /tr "'C:\Windows\ja-JP\2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc59028082" /sc MINUTE /mo 8 /tr "'C:\Windows\ja-JP\2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\fr-FR\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\fr-FR\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\fr-FR\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\de-DE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\de-DE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Music\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Music\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Music\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Mail\fr-FR\lsm.exe

Filesize
4.9MB

MD5
d35291f4c04427508ab9cb6be8eeb39f

SHA1
1bcf8448820f26174b1a547247fdfc960059a70c

SHA256
2c6a98964579835577ce965c9b8b66bf1148cceba9dbb0ce710e74ecc5902808

SHA512
adf26805866dd0cd5f1e921dcd02cac9a98a9c9f6e3bfd3e21084e8707ad0081196434f3c75ffe558573faca64ec0884559362e0ac0fffa7ef905b93e6fd1b83

Download Submit
C:\Users\Admin\AppData\Local\Temp\030223db-b94b-4d05-9aa5-49c895df32d9.vbs

Filesize
709B

MD5
b2e04123b47e9fdf89eed52f2d54a7f7

SHA1
83e253ff77d03eb24b65069a219e7322bfadb9b0

SHA256
7147dc0c99181129cdcc213ac7f6fbc3edf9b193d5cc5bf6fe8adad56978c647

SHA512
77b703863e7b6481ff00518111026c2292def3a61be0c24c58391ce3ab85ae82aa368fad1a50e6ec980b4e8a2fc1b0ecbffd444687423c096c8bef9dc5ac88d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\28c004f3-187a-4d25-8002-597cd9622ad5.vbs

Filesize
485B

MD5
164fa9265311e54eb0b763cb36625138

SHA1
76a22cd01f2b6f610ba01eda1414cb068f7c685e

SHA256
06c93c726083b562d8faf921acd9e9908b98ed58d7eb3caa019e279eba72350e

SHA512
46804d45e0813752c1a218418ed1db15cc9f3e70ebdc50ffbd930b9f26533146725dfc610798906248ae2bd1b3e64204b86bfe4ed2669416dc9442620ae41c62

Download Submit
C:\Users\Admin\AppData\Local\Temp\37ee03e4-5e82-48be-8cdb-300404035263.vbs

Filesize
709B

MD5
ef05ca6ec7cf037b505f2eca91acb8e8

SHA1
b504df3d99d7641c3740fde32cc5bdf999b854ac

SHA256
e9312fa4c2e96f4282f4a84a120617ddfebabab525a01b247524c22d123d144f

SHA512
0488601a75504b58695676ed498bacb8d583a8e7fdcd55a3c201d75df971d6289a5ec0a680fdd63a2efa08c73b76c419151a29306f14885bd8fc21e95b531035

Download Submit
C:\Users\Admin\AppData\Local\Temp\383eaf04-5d51-4ace-8ce8-58eb5c6c8b2a.vbs

Filesize
709B

MD5
4dae1bccf4d16f04d762f585bc8d79d3

SHA1
563033fdfdd743af9576525d3db8dd7440cb49b4

SHA256
99678b1c8f5fe0f823567adeb248815d7ad3cbf8aa18ca8efd27b116413e46ab

SHA512
b129fa255d1ece453465bdf4461d21aea72cdd689ea8e2b858fabaf17007cc6e0e6728b5cf249ac1bdf43c0ad90ba18418051dbfa13fb766b2aef6b7c734466c

Download Submit
C:\Users\Admin\AppData\Local\Temp\534e4703-317a-4272-853d-c7b80c940b44.vbs

Filesize
708B

MD5
1a7b8af41075b150c66b875283e30f52

SHA1
60fc6337b8f74fd01a46860b4f1342c431ddbbf4

SHA256
a93ca851e100dc8ecfbe1d1434ffb8d31ad96e02fdd4b84acb71c810bc1c6eb5

SHA512
8d3999cb18f60a999062b393bc3da545292d8efc4f34e406492428d78866b09d9ffcf89b8eeab7c4ab1b3463d0083693ee8d32b463f30354fbc636d4d0060f85

Download Submit
C:\Users\Admin\AppData\Local\Temp\57c62344-30a3-4eec-904e-580064c3eb34.vbs

Filesize
709B

MD5
f49fc9160238053a18e74419f47d1107

SHA1
e7e99e3f014b8b1cd98305d9d5ba99c06fba7810

SHA256
de231a43bca55562a5694c9e0f3bf74c59838d59f642940aa705dfd7efb34dec

SHA512
621527610380f01bdf477ca375d96802a3cecaa39312a7f9cadd73c652d728392a52eb2eba2555407749c49169e32a1fd8359634f82b4feda191434283c98003

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a16a4ba-5363-4a46-885a-40f093bf0647.vbs

Filesize
709B

MD5
f5c0780cbe0c800b8e6a4941d652d4a1

SHA1
f40b20f95a126bc0eaaa3d02d315811d3b0773de

SHA256
0041df88dbbac81e5bfe5ad7d1958c18f00a856f2aa4d9724757f7ff38fbe5f2

SHA512
f110fd219ba1eba86527d344aba2004c77f08592be2ab57fb088e4afdd472ceef34d7508d3b34de911d34699b8e06623e2d4213a3999d48906731d5c4c449cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\87b8342f-3666-44a4-b5af-9513e91e9d86.vbs

Filesize
709B

MD5
3b07cbb484f0a5137dde7c4021849561

SHA1
bc6a17e4f9ba8589f05d7f95b483db61576fa168

SHA256
0cc27333a37d1e95d1895e9064ddde71b4bf40bbb2ac9a5452fb309b740fadba

SHA512
6536dbed21a0c433abea27dbf3d006f7f04ba5671cc69c6af4d79a440a8616311ec825678b96be70fb9ea77c17673e605a4d8db477773b4142914a58a673cc2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\eb8cf923-ab14-4ec0-a4cf-15df02b92a09.vbs

Filesize
709B

MD5
0dd46c09d7141aa9e76269a519de1524

SHA1
32d0a01e89bd6b50f5c60d744d30fbcaecafa143

SHA256
9f4cdf59b5687cd85b3d004cca48c9d9bf1c196a47ffe462151633e9ae25ee67

SHA512
cc85b89954c3460c12e5ea428394bcc4eadbc317c5d4c0e560dfc8419021371d7681442a04bbbad616afcd38ce9d9f09c505727203062d398aa29c985a478f08

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp275E.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2c6cf064113981887fea9368439e8d55

SHA1
8e159773714189152536a972bafbdd415f18a73b

SHA256
1ffbc9ad98d20a04a16fa725c8785b0654ef2c3fe5f28dd3c13dbe027af7e101

SHA512
cea2f26b7b301d1c78d4aa02b59da8a2513097bafeabe9d521712597d87bcf8717ad476ded36bd6b8dab46d17cbd035ff059b80c19eef3966df21faaa6f1b1f0

Download Submit
memory/916-227-0x00000000003E0000-0x00000000008D4000-memory.dmp

Filesize
5.0MB

Download
memory/1352-242-0x00000000012F0000-0x00000000017E4000-memory.dmp

Filesize
5.0MB

Download
memory/2228-151-0x0000000000310000-0x0000000000804000-memory.dmp

Filesize
5.0MB

Download
memory/2672-300-0x0000000000F20000-0x0000000001414000-memory.dmp

Filesize
5.0MB

Download
memory/2776-9-0x0000000000700000-0x000000000070A000-memory.dmp

Filesize
40KB

Download
memory/2776-13-0x0000000000B70000-0x0000000000B7E000-memory.dmp

Filesize
56KB

Download
memory/2776-145-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

Filesize
4KB

Download
memory/2776-15-0x0000000000C90000-0x0000000000C98000-memory.dmp

Filesize
32KB

Download
memory/2776-16-0x0000000000CA0000-0x0000000000CAC000-memory.dmp

Filesize
48KB

Download
memory/2776-193-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/2776-14-0x0000000000B80000-0x0000000000B88000-memory.dmp

Filesize
32KB

Download
memory/2776-1-0x0000000000DF0000-0x00000000012E4000-memory.dmp

Filesize
5.0MB

Download
memory/2776-11-0x0000000000720000-0x000000000072A000-memory.dmp

Filesize
40KB

Download
memory/2776-3-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/2776-12-0x0000000000730000-0x000000000073E000-memory.dmp

Filesize
56KB

Download
memory/2776-10-0x0000000000710000-0x0000000000722000-memory.dmp

Filesize
72KB

Download
memory/2776-0-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

Filesize
4KB

Download
memory/2776-6-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/2776-8-0x00000000006F0000-0x0000000000700000-memory.dmp

Filesize
64KB

Download
memory/2776-7-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2776-2-0x000000001B640000-0x000000001B76E000-memory.dmp

Filesize
1.2MB

Download
memory/2776-5-0x00000000004C0000-0x00000000004C8000-memory.dmp

Filesize
32KB

Download
memory/2776-4-0x00000000004A0000-0x00000000004BC000-memory.dmp

Filesize
112KB

Download
memory/2932-178-0x0000000001DD0000-0x0000000001DD8000-memory.dmp

Filesize
32KB

Download
memory/2932-176-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/3052-271-0x0000000000CA0000-0x0000000001194000-memory.dmp

Filesize
5.0MB

Download