dcrat | 936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\odbcint\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\license\\taskhost.exe\", \"C:\\Windows\\System32\\SetIEInstalledDate\\sppsvc.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\odbcint\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\license\\taskhost.exe\", \"C:\\Windows\\System32\\SetIEInstalledDate\\sppsvc.exe\", \"C:\\Program Files\\Windows Defender\\de-DE\\smss.exe\", \"C:\\Program Files\\Google\\services.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\odbcint\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\license\\taskhost.exe\", \"C:\\Windows\\System32\\SetIEInstalledDate\\sppsvc.exe\", \"C:\\Program Files\\Windows Defender\\de-DE\\smss.exe\", \"C:\\Program Files\\Google\\services.exe\", \"C:\\Windows\\System32\\shimeng\\taskhost.exe\", \"C:\\Documents and Settings\\csrss.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\odbcint\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\license\\taskhost.exe\", \"C:\\Windows\\System32\\SetIEInstalledDate\\sppsvc.exe\", \"C:\\Program Files\\Windows Defender\\de-DE\\smss.exe\", \"C:\\Program Files\\Google\\services.exe\", \"C:\\Windows\\System32\\shimeng\\taskhost.exe\", \"C:\\Documents and Settings\\csrss.exe\", \"C:\\Windows\\System32\\RMActivate_ssp\\csrss.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\odbcint\\wininit.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\odbcint\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\WmiPrvSE.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\odbcint\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\license\\taskhost.exe\", \"C:\\Windows\\System32\\SetIEInstalledDate\\sppsvc.exe\", \"C:\\Program Files\\Windows Defender\\de-DE\\smss.exe\", \"C:\\Program Files\\Google\\services.exe\", \"C:\\Windows\\System32\\shimeng\\taskhost.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\odbcint\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\license\\taskhost.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\odbcint\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\license\\taskhost.exe\", \"C:\\Windows\\System32\\SetIEInstalledDate\\sppsvc.exe\", \"C:\\Program Files\\Windows Defender\\de-DE\\smss.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2940	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2940	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2940	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2940	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2940	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2940	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1020	2940	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	2940	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	2940	schtasks.exe	29

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2496-1-0x0000000001090000-0x0000000001184000-memory.dmp	dcrat
behavioral1/files/0x000500000001a46f-20.dat	dcrat
behavioral1/files/0x000800000001a49e-67.dat	dcrat
behavioral1/files/0x000600000001a46b-89.dat	dcrat
behavioral1/files/0x000700000001a46f-100.dat	dcrat
behavioral1/memory/1968-145-0x00000000000B0000-0x00000000001A4000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
1968	smss.exe

Adds Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\license\\taskhost.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Google\\services.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Documents and Settings\\csrss.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Documents and Settings\\csrss.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\RMActivate_ssp\\csrss.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Windows Defender\\de-DE\\smss.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Google\\services.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\shimeng\\taskhost.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\shimeng\\taskhost.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Windows Defender\\de-DE\\smss.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\System32\\odbcint\\wininit.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\WmiPrvSE.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\license\\taskhost.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\SetIEInstalledDate\\sppsvc.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\System32\\odbcint\\wininit.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\WmiPrvSE.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\SetIEInstalledDate\\sppsvc.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\RMActivate_ssp\\csrss.exe\""	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File created	C:\Windows\System32\odbcint\wininit.exe	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File created	C:\Windows\System32\RMActivate_ssp\csrss.exe	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Windows\System32\license\RCX5C1.tmp	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Windows\System32\license\RCX62F.tmp	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Windows\System32\SetIEInstalledDate\sppsvc.exe	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File created	C:\Windows\System32\license\b75386f1303e64d8139363b71e44ac16341adf4e	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File created	C:\Windows\System32\SetIEInstalledDate\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File created	C:\Windows\System32\shimeng\taskhost.exe	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Windows\System32\odbcint\RCX1A9.tmp	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Windows\System32\license\taskhost.exe	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Windows\System32\shimeng\RCXFB9.tmp	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Windows\System32\RMActivate_ssp\RCX143F.tmp	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Windows\System32\odbcint\wininit.exe	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File created	C:\Windows\System32\odbcint\560854153607923c4c5f107085a7db67be01f252	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File created	C:\Windows\System32\SetIEInstalledDate\sppsvc.exe	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File created	C:\Windows\System32\shimeng\b75386f1303e64d8139363b71e44ac16341adf4e	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Windows\System32\odbcint\RCX1A8.tmp	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Windows\System32\shimeng\RCXFA8.tmp	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File created	C:\Windows\System32\license\taskhost.exe	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File created	C:\Windows\System32\RMActivate_ssp\886983d96e3d3e31032c679b2d4ea91b6c05afef	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Windows\System32\SetIEInstalledDate\RCX833.tmp	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Windows\System32\SetIEInstalledDate\RCX844.tmp	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Windows\System32\shimeng\taskhost.exe	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Windows\System32\RMActivate_ssp\RCX143E.tmp	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Windows\System32\RMActivate_ssp\csrss.exe	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender\de-DE\69ddcba757bf72f7d36c464c71f42baab150b2b9	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File created	C:\Program Files\Google\services.exe	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File created	C:\Program Files\Google\c5b4cb5e9653cce737f29f72ba880dd4c4bab27d	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\RCXB23.tmp	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Program Files\Google\RCXD27.tmp	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Program Files\Google\RCXD95.tmp	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Program Files\Google\services.exe	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File created	C:\Program Files\Windows Defender\de-DE\smss.exe	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\RCXAB5.tmp	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\smss.exe	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3052	schtasks.exe
2564	schtasks.exe
1020	schtasks.exe
2968	schtasks.exe
2960	schtasks.exe
940	schtasks.exe
3068	schtasks.exe
2788	schtasks.exe
2760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2496	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2496	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Token: SeDebugPrivilege	1968	smss.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 1968	2496	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe	39
PID 2496 wrote to memory of 1968	2496	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe	39
PID 2496 wrote to memory of 1968	2496	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe	39

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe
"C:\Users\Admin\AppData\Local\Temp\936fd703d9cf5a02721ef6c3ca0f4f147c0de02580213152b3bdd86ba1a581cd.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2496
- C:\Program Files\Windows Defender\de-DE\smss.exe
  "C:\Program Files\Windows Defender\de-DE\smss.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\odbcint\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\license\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\SetIEInstalledDate\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Google\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\shimeng\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Documents and Settings\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\RMActivate_ssp\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry