dcrat | 7362f82084bcdf47b0927674ad678f66214e8d4f2783a0b9338ee4eb773c3474

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/12/2024, 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Size

2.2MB
MD5

3aa1bbd17d68b0b67b7423f1fe09b05b
SHA1

61c43b8f31a51d772fd39d5caa87699d74971a43
SHA256

7362f82084bcdf47b0927674ad678f66214e8d4f2783a0b9338ee4eb773c3474
SHA512

7ae82411565104b15cc0de4cc8315d93301befbb28b1e36e3c50d46c8ba9fb1ff8eb361e12cd9d32771e2a5ecbee9b026aca0105473a9fe5a877fc2744b32014
SSDEEP

49152:mx4QdTmxnMJUh+pDY92IXc3Mx+HqXQJc2cv1TDlH:QdPpDYbNiIP2cvxZH

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 31 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		3aa1bbd17d68b0b67b7423f1fe09b05b.exe
		2512	schtasks.exe
		1936	schtasks.exe
		2068	schtasks.exe
		1572	schtasks.exe
		1508	schtasks.exe
		1872	schtasks.exe
		2988	schtasks.exe
		2700	schtasks.exe
		628	schtasks.exe
		2460	schtasks.exe
		2916	schtasks.exe
		792	schtasks.exe
		1712	schtasks.exe
		1992	schtasks.exe
		1972	schtasks.exe
		596	schtasks.exe
		2548	schtasks.exe
		2808	schtasks.exe
		2992	schtasks.exe
		584	schtasks.exe
		1868	schtasks.exe
		1080	schtasks.exe
		1336	schtasks.exe
		2032	schtasks.exe
		2796	schtasks.exe
		1932	schtasks.exe
		2076	schtasks.exe
		292	schtasks.exe
		2844	schtasks.exe
		1740	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\services.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\lsass.exe\", \"C:\\Windows\\Registration\\CRMLog\\lsass.exe\", \"C:\\Users\\Admin\\SendTo\\taskhost.exe\", \"C:\\Users\\Admin\\3aa1bbd17d68b0b67b7423f1fe09b05b.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\services.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\lsass.exe\", \"C:\\Windows\\Registration\\CRMLog\\lsass.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\services.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\lsass.exe\", \"C:\\Windows\\Registration\\CRMLog\\lsass.exe\", \"C:\\Users\\Admin\\SendTo\\taskhost.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\services.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\lsass.exe\", \"C:\\Windows\\Registration\\CRMLog\\lsass.exe\", \"C:\\Users\\Admin\\SendTo\\taskhost.exe\", \"C:\\Users\\Admin\\3aa1bbd17d68b0b67b7423f1fe09b05b.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\dwm.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\services.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\services.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\lsass.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	596	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	792	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2856	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2856	schtasks.exe	28

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1860-1-0x0000000000360000-0x000000000059E000-memory.dmp	dcrat
behavioral1/files/0x0006000000016d11-42.dat	dcrat
behavioral1/memory/772-60-0x00000000011C0000-0x00000000013FE000-memory.dmp	dcrat
behavioral1/memory/444-105-0x0000000000310000-0x000000000054E000-memory.dmp	dcrat
behavioral1/memory/2904-118-0x0000000000F30000-0x000000000116E000-memory.dmp	dcrat
behavioral1/memory/2068-143-0x0000000000370000-0x00000000005AE000-memory.dmp	dcrat
behavioral1/memory/2520-155-0x00000000013C0000-0x00000000015FE000-memory.dmp	dcrat
behavioral1/memory/1012-167-0x0000000000050000-0x000000000028E000-memory.dmp	dcrat
behavioral1/memory/2428-180-0x00000000001E0000-0x000000000041E000-memory.dmp	dcrat

Executes dropped EXE 11 IoCs

pid	Process
772	taskhost.exe
2256	taskhost.exe
2560	taskhost.exe
2880	taskhost.exe
444	taskhost.exe
2904	taskhost.exe
2532	taskhost.exe
2068	taskhost.exe
2520	taskhost.exe
1012	taskhost.exe
2428	taskhost.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\Registration\\CRMLog\\lsass.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\Registration\\CRMLog\\lsass.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\3aa1bbd17d68b0b67b7423f1fe09b05b = "\"C:\\Users\\Admin\\3aa1bbd17d68b0b67b7423f1fe09b05b.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\dwm.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\dllhost.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Admin\\SendTo\\taskhost.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Admin\\SendTo\\taskhost.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3aa1bbd17d68b0b67b7423f1fe09b05b = "\"C:\\Users\\Admin\\3aa1bbd17d68b0b67b7423f1fe09b05b.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\lsass.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\dwm.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\sppsvc.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\services.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\services.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\lsass.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\sppsvc.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Windows Journal\\es-ES\\Idle.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\services.exe	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\c5b4cb5e9653cc	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\lsass.exe	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\6203df4a6bafc7	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\dwm.exe	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\6cb0b6c459d5d3	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files\Windows Journal\es-ES\Idle.exe	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\dllhost.exe	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files\Windows Journal\es-ES\6ccacd8608530f	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\5940a34987c991	3aa1bbd17d68b0b67b7423f1fe09b05b.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Registration\CRMLog\lsass.exe	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Windows\Registration\CRMLog\6203df4a6bafc7	3aa1bbd17d68b0b67b7423f1fe09b05b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
596	schtasks.exe
1936	schtasks.exe
2988	schtasks.exe
792	schtasks.exe
2808	schtasks.exe
2032	schtasks.exe
2068	schtasks.exe
2700	schtasks.exe
2548	schtasks.exe
1712	schtasks.exe
1508	schtasks.exe
1872	schtasks.exe
2512	schtasks.exe
584	schtasks.exe
1992	schtasks.exe
2992	schtasks.exe
628	schtasks.exe
1932	schtasks.exe
1740	schtasks.exe
1572	schtasks.exe
2844	schtasks.exe
1336	schtasks.exe
2076	schtasks.exe
2460	schtasks.exe
1080	schtasks.exe
1972	schtasks.exe
292	schtasks.exe
1868	schtasks.exe
2796	schtasks.exe
2916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1860	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
1860	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
1860	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
1860	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
1860	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
1860	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
1860	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
772	taskhost.exe
2256	taskhost.exe
2256	taskhost.exe
2256	taskhost.exe
2256	taskhost.exe
2256	taskhost.exe
2256	taskhost.exe
2256	taskhost.exe
2256	taskhost.exe
2256	taskhost.exe
2256	taskhost.exe
2256	taskhost.exe
2256	taskhost.exe
2256	taskhost.exe
2256	taskhost.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1860	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Token: SeDebugPrivilege	772	taskhost.exe
Token: SeDebugPrivilege	2256	taskhost.exe
Token: SeDebugPrivilege	2560	taskhost.exe
Token: SeDebugPrivilege	2880	taskhost.exe
Token: SeDebugPrivilege	444	taskhost.exe
Token: SeDebugPrivilege	2904	taskhost.exe
Token: SeDebugPrivilege	2532	taskhost.exe
Token: SeDebugPrivilege	2068	taskhost.exe
Token: SeDebugPrivilege	2520	taskhost.exe
Token: SeDebugPrivilege	1012	taskhost.exe
Token: SeDebugPrivilege	2428	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 772	1860	3aa1bbd17d68b0b67b7423f1fe09b05b.exe	59
PID 1860 wrote to memory of 772	1860	3aa1bbd17d68b0b67b7423f1fe09b05b.exe	59
PID 1860 wrote to memory of 772	1860	3aa1bbd17d68b0b67b7423f1fe09b05b.exe	59
PID 772 wrote to memory of 2268	772	taskhost.exe	60
PID 772 wrote to memory of 2268	772	taskhost.exe	60
PID 772 wrote to memory of 2268	772	taskhost.exe	60
PID 772 wrote to memory of 1228	772	taskhost.exe	61
PID 772 wrote to memory of 1228	772	taskhost.exe	61
PID 772 wrote to memory of 1228	772	taskhost.exe	61
PID 2268 wrote to memory of 2256	2268	WScript.exe	62
PID 2268 wrote to memory of 2256	2268	WScript.exe	62
PID 2268 wrote to memory of 2256	2268	WScript.exe	62
PID 2256 wrote to memory of 1668	2256	taskhost.exe	63
PID 2256 wrote to memory of 1668	2256	taskhost.exe	63
PID 2256 wrote to memory of 1668	2256	taskhost.exe	63
PID 2256 wrote to memory of 2760	2256	taskhost.exe	64
PID 2256 wrote to memory of 2760	2256	taskhost.exe	64
PID 2256 wrote to memory of 2760	2256	taskhost.exe	64
PID 1668 wrote to memory of 2560	1668	WScript.exe	67
PID 1668 wrote to memory of 2560	1668	WScript.exe	67
PID 1668 wrote to memory of 2560	1668	WScript.exe	67
PID 2560 wrote to memory of 1540	2560	taskhost.exe	68
PID 2560 wrote to memory of 1540	2560	taskhost.exe	68
PID 2560 wrote to memory of 1540	2560	taskhost.exe	68
PID 2560 wrote to memory of 2648	2560	taskhost.exe	69
PID 2560 wrote to memory of 2648	2560	taskhost.exe	69
PID 2560 wrote to memory of 2648	2560	taskhost.exe	69
PID 1540 wrote to memory of 2880	1540	WScript.exe	70
PID 1540 wrote to memory of 2880	1540	WScript.exe	70
PID 1540 wrote to memory of 2880	1540	WScript.exe	70
PID 2880 wrote to memory of 1128	2880	taskhost.exe	71
PID 2880 wrote to memory of 1128	2880	taskhost.exe	71
PID 2880 wrote to memory of 1128	2880	taskhost.exe	71
PID 2880 wrote to memory of 1572	2880	taskhost.exe	72
PID 2880 wrote to memory of 1572	2880	taskhost.exe	72
PID 2880 wrote to memory of 1572	2880	taskhost.exe	72
PID 1128 wrote to memory of 444	1128	WScript.exe	73
PID 1128 wrote to memory of 444	1128	WScript.exe	73
PID 1128 wrote to memory of 444	1128	WScript.exe	73
PID 444 wrote to memory of 2140	444	taskhost.exe	74
PID 444 wrote to memory of 2140	444	taskhost.exe	74
PID 444 wrote to memory of 2140	444	taskhost.exe	74
PID 444 wrote to memory of 568	444	taskhost.exe	75
PID 444 wrote to memory of 568	444	taskhost.exe	75
PID 444 wrote to memory of 568	444	taskhost.exe	75
PID 2140 wrote to memory of 2904	2140	WScript.exe	76
PID 2140 wrote to memory of 2904	2140	WScript.exe	76
PID 2140 wrote to memory of 2904	2140	WScript.exe	76
PID 2904 wrote to memory of 2660	2904	taskhost.exe	77
PID 2904 wrote to memory of 2660	2904	taskhost.exe	77
PID 2904 wrote to memory of 2660	2904	taskhost.exe	77
PID 2904 wrote to memory of 852	2904	taskhost.exe	78
PID 2904 wrote to memory of 852	2904	taskhost.exe	78
PID 2904 wrote to memory of 852	2904	taskhost.exe	78
PID 2660 wrote to memory of 2532	2660	WScript.exe	79
PID 2660 wrote to memory of 2532	2660	WScript.exe	79
PID 2660 wrote to memory of 2532	2660	WScript.exe	79
PID 2532 wrote to memory of 1484	2532	taskhost.exe	80
PID 2532 wrote to memory of 1484	2532	taskhost.exe	80
PID 2532 wrote to memory of 1484	2532	taskhost.exe	80
PID 2532 wrote to memory of 548	2532	taskhost.exe	81
PID 2532 wrote to memory of 548	2532	taskhost.exe	81
PID 2532 wrote to memory of 548	2532	taskhost.exe	81
PID 1484 wrote to memory of 2068	1484	WScript.exe	82

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3aa1bbd17d68b0b67b7423f1fe09b05b.exe
"C:\Users\Admin\AppData\Local\Temp\3aa1bbd17d68b0b67b7423f1fe09b05b.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1860
- C:\Users\Admin\SendTo\taskhost.exe
  "C:\Users\Admin\SendTo\taskhost.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:772
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8ab35106-d5ad-4530-a266-844e3b61f400.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Users\Admin\SendTo\taskhost.exe
      C:\Users\Admin\SendTo\taskhost.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2256
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\288c35ac-6528-45ae-b3a3-9763afdbbf7e.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1668
      - C:\Users\Admin\SendTo\taskhost.exe
        
        C:\Users\Admin\SendTo\taskhost.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2560
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e67915fe-449f-4872-8923-aa3b3f9cf47e.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Users\Admin\SendTo\taskhost.exe
        
        C:\Users\Admin\SendTo\taskhost.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2880
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\399e6311-c3dc-4f52-8ca2-48a7577ca435.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Users\Admin\SendTo\taskhost.exe
        
        C:\Users\Admin\SendTo\taskhost.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\60f65f81-f80e-4171-9877-0553e5244e97.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2140
        
        C:\Users\Admin\SendTo\taskhost.exe
        
        C:\Users\Admin\SendTo\taskhost.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2904
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\093d96e2-81e4-4481-8787-fac5205801c5.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Users\Admin\SendTo\taskhost.exe
        
        C:\Users\Admin\SendTo\taskhost.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2532
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9573d2f6-b1d9-4ca2-ad4f-d6444cd4f169.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:1484
        
        C:\Users\Admin\SendTo\taskhost.exe
        
        C:\Users\Admin\SendTo\taskhost.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b0cab5dd-4707-43ca-97ca-fbd88e1bf727.vbs"
        17⤵
        
        PID:1324
        
        C:\Users\Admin\SendTo\taskhost.exe
        
        C:\Users\Admin\SendTo\taskhost.exe
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2520
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e08352f-9ab0-49df-b095-8a40ae794573.vbs"
        19⤵
        
        PID:2272
        
        C:\Users\Admin\SendTo\taskhost.exe
        
        C:\Users\Admin\SendTo\taskhost.exe
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4595f9d1-b66f-4e01-abd1-d66335f79030.vbs"
        21⤵
        
        PID:1076
        
        C:\Users\Admin\SendTo\taskhost.exe
        
        C:\Users\Admin\SendTo\taskhost.exe
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2428
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a40a1bb-dd23-4aae-8896-7517cd25ee8c.vbs"
        23⤵
        
        PID:1980
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aa7a4ff3-2da1-42a5-8ab8-18d8b53e083e.vbs"
        23⤵
        
        PID:2908
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7e51393-9a85-465d-b9f9-1e9ebd8afea2.vbs"
        21⤵
        
        PID:1876
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f050ff08-8aa0-4d4b-bdea-eb5aef56d205.vbs"
        19⤵
        
        PID:2280
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6017b138-fb0e-4e0e-8a9a-b046801c57a7.vbs"
        17⤵
        
        PID:2484
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a90ab2c1-b83c-4473-bb00-9b053beacf5f.vbs"
        15⤵
        
        PID:548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\98861ff0-3354-4063-9999-1bcf1cf53a30.vbs"
        13⤵
        
        PID:852
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5b41d2b-920b-4916-b4a8-5e5a7219b8d7.vbs"
        11⤵
        
        PID:568
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20f91dd3-0f3c-47e5-b7a1-6350280b8d1a.vbs"
        9⤵
        
        PID:1572
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0907e37f-5aa1-4a7d-93d9-90470d2bbe1d.vbs"
        7⤵
        
        PID:2648
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4876a9fd-0ae8-4def-86cb-b3948aff9bd7.vbs"
        5⤵
        
        PID:2760
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b2bea1de-d169-4d4d-9c80-b5ba15dd4501.vbs"
    3⤵
    PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\es-ES\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\es-ES\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\es-ES\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\Registration\CRMLog\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\Registration\CRMLog\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\SendTo\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\SendTo\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3aa1bbd17d68b0b67b7423f1fe09b05b3" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\3aa1bbd17d68b0b67b7423f1fe09b05b.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3aa1bbd17d68b0b67b7423f1fe09b05b" /sc ONLOGON /tr "'C:\Users\Admin\3aa1bbd17d68b0b67b7423f1fe09b05b.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3aa1bbd17d68b0b67b7423f1fe09b05b3" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\3aa1bbd17d68b0b67b7423f1fe09b05b.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Photo Viewer\es-ES\services.exe

Filesize
2.2MB

MD5
3aa1bbd17d68b0b67b7423f1fe09b05b

SHA1
61c43b8f31a51d772fd39d5caa87699d74971a43

SHA256
7362f82084bcdf47b0927674ad678f66214e8d4f2783a0b9338ee4eb773c3474

SHA512
7ae82411565104b15cc0de4cc8315d93301befbb28b1e36e3c50d46c8ba9fb1ff8eb361e12cd9d32771e2a5ecbee9b026aca0105473a9fe5a877fc2744b32014

Download Submit
C:\Users\Admin\AppData\Local\Temp\093d96e2-81e4-4481-8787-fac5205801c5.vbs

Filesize
710B

MD5
43fdf458ca2299bb2814c9cdd13638f0

SHA1
bd50ec589d9e3878962f4a111794bdb7a086c368

SHA256
a2936914865e43dbebdc3a0bc542e879a1d7210aa8ab025cad222d76c6af333a

SHA512
3d23fe1b0ccd5f157e215b0c9415ab8477c5c7e617428bba71a12e254fc3d08e70279bbe089c6d7aacda1c9f1c6fcfdfa7dd241f0ac34503cf2f53037973e771

Download Submit
C:\Users\Admin\AppData\Local\Temp\288c35ac-6528-45ae-b3a3-9763afdbbf7e.vbs

Filesize
710B

MD5
c37d4cb478604890deafd59115e8a3a1

SHA1
9f05cf9ef45d0a4d17932c1183480ace90753443

SHA256
5623f5b6aa2faebc19514a1b7891d5ed89fb8331cda4f1635829a7ce1cbdd0df

SHA512
d08774eac87ee44d47566aced47be33e66e0cb4a9b70c4794a54cea10803b2fae538801821efd521d66fc7ca1e6db65e4b4570dce9137bf6a6cf9cf7c8ce5ac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\399e6311-c3dc-4f52-8ca2-48a7577ca435.vbs

Filesize
710B

MD5
b92f6ca6e485df15c39e835f3266abfd

SHA1
63e70e54cb2bb7df395fa9c0412a7e52ccc76811

SHA256
48fb22ca258e77480b1a98a7ff2e29ba69a95e9b19f61245629da5590f8f4aab

SHA512
f718768886071fa5eafbd99df7350e48505de23e46b85c14c17ed11d645e59f4e61a76568af7b69000b2bda5991b36b97dbd951ac460c71220a9ef33161e4dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\4595f9d1-b66f-4e01-abd1-d66335f79030.vbs

Filesize
710B

MD5
0428b772990c38b2b6689443dd6592b8

SHA1
9af3a340492b12866ff184a2ab6540d2a38fb9b5

SHA256
b7d824abce0dcfeb3b710d5fb4972e5eb06940edd282b9b41344d07b6836d226

SHA512
f39125484f9cfa27aab1e2cf2fb7d2371f4ec795c0ac080b5d29152045e364fb3cee4550a38ec17c138e7a046e15cf03ebf90b0777c88647c4f46e0da8d13e31

Download Submit
C:\Users\Admin\AppData\Local\Temp\60f65f81-f80e-4171-9877-0553e5244e97.vbs

Filesize
709B

MD5
6d0a920f6ba1c14baa7d191a0d3a388c

SHA1
af26b6027e2c0c501129d44d94c6d200b42de998

SHA256
9088f7e0ac4bfe7db889923ad011fdc0a905b300372fb0973632877deaea5de8

SHA512
fdaba7a177d4714ebd5619e04e0bc7cc8d5d45821aa82c3348cd6654ee9246508e2b8b630f8590fd3d207ddd4921db9d7f17495c5bdbf60563a67bfbeee0fa94

Download Submit
C:\Users\Admin\AppData\Local\Temp\7a40a1bb-dd23-4aae-8896-7517cd25ee8c.vbs

Filesize
710B

MD5
8747493d21ab2f0ece118b33d66e9398

SHA1
40ccb5c6f14ac08754528e471e0812d4925979e7

SHA256
dfa09444abfd46dc4c9d2c02ab006d7c762150701227413d3e1b0ab8e413d13f

SHA512
80c042eb505c38db33ce75850a6080560bc7c7bcae216b9ee83397f87a0b3e6e7cc5a711c4d8ce65d83d3b1a62dbb6580a3da4feb7436e75792d558194de75a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\8ab35106-d5ad-4530-a266-844e3b61f400.vbs

Filesize
709B

MD5
9a0a490d71f6983f53ecfe69f21430d5

SHA1
7ee71240aec4a76ba584a153245f170100b08a5a

SHA256
7b0ef9b5d6f9740489fcb889c4b2fe94f2bb9ada70d5066afd744bd11f3e7152

SHA512
e3d8ed4fd650f1be0542e63b3cf3ff34b7af6fd4dcbefd63c40f2a95f0e52406b4def01ffa38d1f5ea1da0bb8f6f1fc4f4de9351e3a45a08a1e2dae679818fde

Download Submit
C:\Users\Admin\AppData\Local\Temp\8e08352f-9ab0-49df-b095-8a40ae794573.vbs

Filesize
710B

MD5
c628042ebad85c9f5aa40bf924401558

SHA1
77073541745cdf589bcc5d9b676de10c6bf74dba

SHA256
a713cdf98570c85922792c7c1ead2c64576754453b9cbc42a9704118e3855f07

SHA512
970c30d4f03af332cf96937537207a1c1eb4af3d50b5d26ff7e47e06cf25c636a4217abb0405b97fa51faf9bf48c656b2844d11050f943c623885b202b322fec

Download Submit
C:\Users\Admin\AppData\Local\Temp\9573d2f6-b1d9-4ca2-ad4f-d6444cd4f169.vbs

Filesize
710B

MD5
44d0b2f115052772a832d891dbf29ffd

SHA1
c72d426840c5f8d98dc43144a6733b1db8f0e8ef

SHA256
b7c3a74abe9da54a0c52eb86264696925ed404d8455b9adedac626243abe4bc3

SHA512
2ffe9bfe2a3b3ffc9aef4d172ba2d29853e82e591ddf7473daa333ce00e684ab104a7cd002442fbe5d7881c8e9ff8c3ca81592ca8e35169bb2e70a7c3ff6f8df

Download Submit
C:\Users\Admin\AppData\Local\Temp\b0cab5dd-4707-43ca-97ca-fbd88e1bf727.vbs

Filesize
710B

MD5
43c41ff93a456d11df95fad22a6e01a1

SHA1
97bf955cf4d2ff011027c9ca79a2dfc6f077601f

SHA256
146e669e3ead8a81a6657160d603c8cb4576b5a802f8c08b009f0bbb57f1c408

SHA512
3817bccb9fb348ee05c5ee3769605ec657f9785bf76711a22cd36c3d0f200db98a3856ca5875414231d5e0f3add46678ce4a5a9c1c214ea0878776cee67879df

Download Submit
C:\Users\Admin\AppData\Local\Temp\b2bea1de-d169-4d4d-9c80-b5ba15dd4501.vbs

Filesize
486B

MD5
689c6c22afb8a95c726a859f4d580918

SHA1
07aebbefa5306cce0b862489317437b8952e5a48

SHA256
2927140e870240dc927bb498a8e27aff6cce73f68feefedbf37666e5a908e42d

SHA512
c36c9ccd120e543d776b6fcd834ca4a18ed3f597bbe4633ab4d2a707702c6f2334efa81ecff0ed803ad1b8f752b5f66e6973e234b9b28157b58f7caaa58a8101

Download Submit
C:\Users\Admin\AppData\Local\Temp\e67915fe-449f-4872-8923-aa3b3f9cf47e.vbs

Filesize
710B

MD5
c91b6b330d87176aa9e92a92658cd6fe

SHA1
db3dbeb0dd27b37cf3809343e3fe124c0046fffc

SHA256
47a5eb31446556bff6f2e187e337bf51022c85944af4191874b874c49ff5ef1e

SHA512
09259d591f7c811e2d8de52421965a8d4ca1152388334df94a4f091c378859f017f87fc1f6a8a8198b6e97595d8b79c3c8f143a6021aac1ed5019cffa1ac7223

Download Submit
memory/444-105-0x0000000000310000-0x000000000054E000-memory.dmp

Filesize
2.2MB

Download
memory/444-106-0x0000000002150000-0x0000000002162000-memory.dmp

Filesize
72KB

Download
memory/772-60-0x00000000011C0000-0x00000000013FE000-memory.dmp

Filesize
2.2MB

Download
memory/1012-167-0x0000000000050000-0x000000000028E000-memory.dmp

Filesize
2.2MB

Download
memory/1012-168-0x0000000002360000-0x0000000002372000-memory.dmp

Filesize
72KB

Download
memory/1860-24-0x000000001AAF0000-0x000000001AAF8000-memory.dmp

Filesize
32KB

Download
memory/1860-10-0x0000000002160000-0x0000000002172000-memory.dmp

Filesize
72KB

Download
memory/1860-15-0x0000000002290000-0x000000000229C000-memory.dmp

Filesize
48KB

Download
memory/1860-16-0x00000000022A0000-0x00000000022A8000-memory.dmp

Filesize
32KB

Download
memory/1860-17-0x00000000022B0000-0x00000000022BC000-memory.dmp

Filesize
48KB

Download
memory/1860-18-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/1860-19-0x00000000022D0000-0x00000000022E2000-memory.dmp

Filesize
72KB

Download
memory/1860-20-0x000000001AA70000-0x000000001AA7C000-memory.dmp

Filesize
48KB

Download
memory/1860-21-0x000000001AA80000-0x000000001AA88000-memory.dmp

Filesize
32KB

Download
memory/1860-22-0x000000001AA90000-0x000000001AA9C000-memory.dmp

Filesize
48KB

Download
memory/1860-23-0x000000001AAA0000-0x000000001AAAC000-memory.dmp

Filesize
48KB

Download
memory/1860-25-0x000000001AAB0000-0x000000001AABC000-memory.dmp

Filesize
48KB

Download
memory/1860-13-0x0000000002270000-0x0000000002280000-memory.dmp

Filesize
64KB

Download
memory/1860-27-0x000000001AAD0000-0x000000001AADE000-memory.dmp

Filesize
56KB

Download
memory/1860-26-0x000000001AAC0000-0x000000001AACA000-memory.dmp

Filesize
40KB

Download
memory/1860-28-0x000000001AAE0000-0x000000001AAE8000-memory.dmp

Filesize
32KB

Download
memory/1860-30-0x000000001AEE0000-0x000000001AEEC000-memory.dmp

Filesize
48KB

Download
memory/1860-29-0x000000001AED0000-0x000000001AED8000-memory.dmp

Filesize
32KB

Download
memory/1860-31-0x000000001AEF0000-0x000000001AEF8000-memory.dmp

Filesize
32KB

Download
memory/1860-12-0x0000000002150000-0x0000000002158000-memory.dmp

Filesize
32KB

Download
memory/1860-11-0x0000000000AA0000-0x0000000000AAC000-memory.dmp

Filesize
48KB

Download
memory/1860-14-0x0000000002280000-0x000000000228A000-memory.dmp

Filesize
40KB

Download
memory/1860-9-0x00000000008F0000-0x00000000008F8000-memory.dmp

Filesize
32KB

Download
memory/1860-8-0x00000000008D0000-0x00000000008E6000-memory.dmp

Filesize
88KB

Download
memory/1860-32-0x000000001AF00000-0x000000001AF0A000-memory.dmp

Filesize
40KB

Download
memory/1860-33-0x000000001AF10000-0x000000001AF1C000-memory.dmp

Filesize
48KB

Download
memory/1860-61-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Filesize
9.9MB

Download
memory/1860-0-0x000007FEF5233000-0x000007FEF5234000-memory.dmp

Filesize
4KB

Download
memory/1860-1-0x0000000000360000-0x000000000059E000-memory.dmp

Filesize
2.2MB

Download
memory/1860-7-0x00000000006D0000-0x00000000006E0000-memory.dmp

Filesize
64KB

Download
memory/1860-2-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Filesize
9.9MB

Download
memory/1860-6-0x00000000006C0000-0x00000000006C8000-memory.dmp

Filesize
32KB

Download
memory/1860-3-0x0000000000340000-0x000000000034E000-memory.dmp

Filesize
56KB

Download
memory/1860-5-0x00000000006A0000-0x00000000006BC000-memory.dmp

Filesize
112KB

Download
memory/1860-4-0x0000000000350000-0x0000000000358000-memory.dmp

Filesize
32KB

Download
memory/2068-143-0x0000000000370000-0x00000000005AE000-memory.dmp

Filesize
2.2MB

Download
memory/2428-180-0x00000000001E0000-0x000000000041E000-memory.dmp

Filesize
2.2MB

Download
memory/2428-181-0x0000000000920000-0x0000000000932000-memory.dmp

Filesize
72KB

Download
memory/2520-155-0x00000000013C0000-0x00000000015FE000-memory.dmp

Filesize
2.2MB

Download
memory/2532-131-0x0000000000480000-0x0000000000492000-memory.dmp

Filesize
72KB

Download
memory/2904-119-0x0000000000760000-0x0000000000772000-memory.dmp

Filesize
72KB

Download
memory/2904-118-0x0000000000F30000-0x000000000116E000-memory.dmp

Filesize
2.2MB

Download