dcrat | 7362f82084bcdf47b0927674ad678f66214e8d4f2783a0b9338ee4eb773c3474

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/12/2024, 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Size

2.2MB
MD5

3aa1bbd17d68b0b67b7423f1fe09b05b
SHA1

61c43b8f31a51d772fd39d5caa87699d74971a43
SHA256

7362f82084bcdf47b0927674ad678f66214e8d4f2783a0b9338ee4eb773c3474
SHA512

7ae82411565104b15cc0de4cc8315d93301befbb28b1e36e3c50d46c8ba9fb1ff8eb361e12cd9d32771e2a5ecbee9b026aca0105473a9fe5a877fc2744b32014
SSDEEP

49152:mx4QdTmxnMJUh+pDY92IXc3Mx+HqXQJc2cv1TDlH:QdPpDYbNiIP2cvxZH

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 35 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		5016	schtasks.exe
		3080	schtasks.exe
		3620	schtasks.exe
		3060	schtasks.exe
		1184	schtasks.exe
		2696	schtasks.exe
		4376	schtasks.exe
		1936	schtasks.exe
		2232	schtasks.exe
		232	schtasks.exe
		5024	schtasks.exe
		4324	schtasks.exe
File created	C:\Program Files\Windows NT\Accessories\55b276f4edf653		3aa1bbd17d68b0b67b7423f1fe09b05b.exe
		4860	schtasks.exe
		3880	schtasks.exe
		2292	schtasks.exe
		4984	schtasks.exe
		2708	schtasks.exe
		364	schtasks.exe
		3064	schtasks.exe
		4920	schtasks.exe
		2032	schtasks.exe
		1008	schtasks.exe
		3028	schtasks.exe
		4836	schtasks.exe
		972	schtasks.exe
		3164	schtasks.exe
		3680	schtasks.exe
		1488	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		3aa1bbd17d68b0b67b7423f1fe09b05b.exe
		3436	schtasks.exe
		4536	schtasks.exe
		1876	schtasks.exe
		1116	schtasks.exe
		3560	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 11 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\services.exe\", \"C:\\Windows\\SKB\\LanguageModels\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\uk-UA\\spoolsv.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-3442511616-637977696-3186306149-1000\\SearchApp.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\services.exe\", \"C:\\Windows\\SKB\\LanguageModels\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\uk-UA\\spoolsv.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-3442511616-637977696-3186306149-1000\\SearchApp.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\StartMenuExperienceHost.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\StartMenuExperienceHost.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\services.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\services.exe\", \"C:\\Windows\\SKB\\LanguageModels\\explorer.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\services.exe\", \"C:\\Windows\\SKB\\LanguageModels\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\RuntimeBroker.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\services.exe\", \"C:\\Windows\\SKB\\LanguageModels\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\uk-UA\\spoolsv.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\services.exe\", \"C:\\Windows\\SKB\\LanguageModels\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\uk-UA\\spoolsv.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-3442511616-637977696-3186306149-1000\\SearchApp.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Users\\Default\\Templates\\sihost.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\services.exe\", \"C:\\Windows\\SKB\\LanguageModels\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\services.exe\", \"C:\\Windows\\SKB\\LanguageModels\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\uk-UA\\spoolsv.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-3442511616-637977696-3186306149-1000\\SearchApp.exe\", \"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\csrss.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	364	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	232	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3880	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3080	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3436	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	2228	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2228	schtasks.exe	82

UAC bypass 3 TTPs 45 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/404-1-0x0000000000760000-0x000000000099E000-memory.dmp	dcrat
behavioral2/files/0x000a000000023b90-44.dat	dcrat

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe

Executes dropped EXE 14 IoCs

pid	Process
2020	Registry.exe
3668	Registry.exe
4920	Registry.exe
2704	Registry.exe
1020	Registry.exe
4240	Registry.exe
1204	Registry.exe
956	Registry.exe
392	Registry.exe
1224	Registry.exe
4384	Registry.exe
3888	Registry.exe
2540	Registry.exe
4988	Registry.exe

Adds Run key to start application 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Windows NT\\Accessories\\StartMenuExperienceHost.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\StartMenuExperienceHost.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-3442511616-637977696-3186306149-1000\\SearchApp.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Windows NT\\Accessories\\StartMenuExperienceHost.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\StartMenuExperienceHost.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\SKB\\LanguageModels\\explorer.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\csrss.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\dotnet\\host\\fxr\\7.0.16\\csrss.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\services.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\SKB\\LanguageModels\\explorer.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\RuntimeBroker.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Internet Explorer\\uk-UA\\spoolsv.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Internet Explorer\\uk-UA\\spoolsv.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\services.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\RuntimeBroker.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\All Users\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\S-1-5-21-3442511616-637977696-3186306149-1000\\SearchApp.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Default\\Templates\\sihost.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Default\\Templates\\sihost.exe\""	3aa1bbd17d68b0b67b7423f1fe09b05b.exe

Checks whether UAC is enabled 1 TTPs 30 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\services.exe	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\886983d96e3d3e	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\StartMenuExperienceHost.exe	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\55b276f4edf653	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\StartMenuExperienceHost.exe	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files\Windows NT\Accessories\55b276f4edf653	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files (x86)\Internet Explorer\uk-UA\spoolsv.exe	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\RuntimeBroker.exe	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\9e8d7a4ca61bd9	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files\Windows Multimedia Platform\9e8d7a4ca61bd9	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files (x86)\Internet Explorer\uk-UA\f3b6ecef712a24	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\csrss.exe	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files\Windows NT\Accessories\StartMenuExperienceHost.exe	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\c5b4cb5e9653cc	3aa1bbd17d68b0b67b7423f1fe09b05b.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SKB\LanguageModels\explorer.exe	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
File created	C:\Windows\SKB\LanguageModels\7a0fd90576e088	3aa1bbd17d68b0b67b7423f1fe09b05b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4836	schtasks.exe
1008	schtasks.exe
232	schtasks.exe
5024	schtasks.exe
2292	schtasks.exe
4324	schtasks.exe
5016	schtasks.exe
972	schtasks.exe
2708	schtasks.exe
4376	schtasks.exe
1876	schtasks.exe
4860	schtasks.exe
3164	schtasks.exe
3680	schtasks.exe
3620	schtasks.exe
1184	schtasks.exe
2232	schtasks.exe
4536	schtasks.exe
3560	schtasks.exe
2032	schtasks.exe
2696	schtasks.exe
4984	schtasks.exe
3060	schtasks.exe
3080	schtasks.exe
3436	schtasks.exe
1116	schtasks.exe
3880	schtasks.exe
4920	schtasks.exe
1488	schtasks.exe
3028	schtasks.exe
1936	schtasks.exe
3064	schtasks.exe
364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
2020	Registry.exe
3668	Registry.exe
3668	Registry.exe
3668	Registry.exe
3668	Registry.exe
3668	Registry.exe
3668	Registry.exe
3668	Registry.exe
3668	Registry.exe
3668	Registry.exe
3668	Registry.exe
3668	Registry.exe
3668	Registry.exe
3668	Registry.exe
3668	Registry.exe
3668	Registry.exe
3668	Registry.exe
3668	Registry.exe
3668	Registry.exe
3668	Registry.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Token: SeDebugPrivilege	2020	Registry.exe
Token: SeDebugPrivilege	3668	Registry.exe
Token: SeDebugPrivilege	4920	Registry.exe
Token: SeDebugPrivilege	2704	Registry.exe
Token: SeDebugPrivilege	1020	Registry.exe
Token: SeDebugPrivilege	4240	Registry.exe
Token: SeDebugPrivilege	1204	Registry.exe
Token: SeDebugPrivilege	956	Registry.exe
Token: SeDebugPrivilege	392	Registry.exe
Token: SeDebugPrivilege	1224	Registry.exe
Token: SeDebugPrivilege	4384	Registry.exe
Token: SeDebugPrivilege	3888	Registry.exe
Token: SeDebugPrivilege	2540	Registry.exe
Token: SeDebugPrivilege	4988	Registry.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 2020	404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe	116
PID 404 wrote to memory of 2020	404	3aa1bbd17d68b0b67b7423f1fe09b05b.exe	116
PID 2020 wrote to memory of 1224	2020	Registry.exe	117
PID 2020 wrote to memory of 1224	2020	Registry.exe	117
PID 2020 wrote to memory of 4604	2020	Registry.exe	118
PID 2020 wrote to memory of 4604	2020	Registry.exe	118
PID 1224 wrote to memory of 3668	1224	WScript.exe	119
PID 1224 wrote to memory of 3668	1224	WScript.exe	119
PID 3668 wrote to memory of 3000	3668	Registry.exe	120
PID 3668 wrote to memory of 3000	3668	Registry.exe	120
PID 3668 wrote to memory of 60	3668	Registry.exe	121
PID 3668 wrote to memory of 60	3668	Registry.exe	121
PID 3000 wrote to memory of 4920	3000	WScript.exe	126
PID 3000 wrote to memory of 4920	3000	WScript.exe	126
PID 4920 wrote to memory of 5072	4920	Registry.exe	129
PID 4920 wrote to memory of 5072	4920	Registry.exe	129
PID 4920 wrote to memory of 1444	4920	Registry.exe	130
PID 4920 wrote to memory of 1444	4920	Registry.exe	130
PID 5072 wrote to memory of 2704	5072	WScript.exe	131
PID 5072 wrote to memory of 2704	5072	WScript.exe	131
PID 2704 wrote to memory of 3764	2704	Registry.exe	132
PID 2704 wrote to memory of 3764	2704	Registry.exe	132
PID 2704 wrote to memory of 3664	2704	Registry.exe	133
PID 2704 wrote to memory of 3664	2704	Registry.exe	133
PID 3764 wrote to memory of 1020	3764	WScript.exe	136
PID 3764 wrote to memory of 1020	3764	WScript.exe	136
PID 1020 wrote to memory of 4004	1020	Registry.exe	137
PID 1020 wrote to memory of 4004	1020	Registry.exe	137
PID 1020 wrote to memory of 4456	1020	Registry.exe	138
PID 1020 wrote to memory of 4456	1020	Registry.exe	138
PID 4004 wrote to memory of 4240	4004	WScript.exe	139
PID 4004 wrote to memory of 4240	4004	WScript.exe	139
PID 4240 wrote to memory of 2468	4240	Registry.exe	140
PID 4240 wrote to memory of 2468	4240	Registry.exe	140
PID 4240 wrote to memory of 1040	4240	Registry.exe	141
PID 4240 wrote to memory of 1040	4240	Registry.exe	141
PID 2468 wrote to memory of 1204	2468	WScript.exe	142
PID 2468 wrote to memory of 1204	2468	WScript.exe	142
PID 1204 wrote to memory of 4192	1204	Registry.exe	143
PID 1204 wrote to memory of 4192	1204	Registry.exe	143
PID 1204 wrote to memory of 1188	1204	Registry.exe	144
PID 1204 wrote to memory of 1188	1204	Registry.exe	144
PID 4192 wrote to memory of 956	4192	WScript.exe	145
PID 4192 wrote to memory of 956	4192	WScript.exe	145
PID 956 wrote to memory of 3972	956	Registry.exe	146
PID 956 wrote to memory of 3972	956	Registry.exe	146
PID 956 wrote to memory of 3080	956	Registry.exe	147
PID 956 wrote to memory of 3080	956	Registry.exe	147
PID 3972 wrote to memory of 392	3972	WScript.exe	148
PID 3972 wrote to memory of 392	3972	WScript.exe	148
PID 392 wrote to memory of 1992	392	Registry.exe	149
PID 392 wrote to memory of 1992	392	Registry.exe	149
PID 392 wrote to memory of 4620	392	Registry.exe	150
PID 392 wrote to memory of 4620	392	Registry.exe	150
PID 1992 wrote to memory of 1224	1992	WScript.exe	151
PID 1992 wrote to memory of 1224	1992	WScript.exe	151
PID 1224 wrote to memory of 4692	1224	Registry.exe	152
PID 1224 wrote to memory of 4692	1224	Registry.exe	152
PID 1224 wrote to memory of 3736	1224	Registry.exe	153
PID 1224 wrote to memory of 3736	1224	Registry.exe	153
PID 4692 wrote to memory of 4384	4692	WScript.exe	154
PID 4692 wrote to memory of 4384	4692	WScript.exe	154
PID 4384 wrote to memory of 372	4384	Registry.exe	155
PID 4384 wrote to memory of 372	4384	Registry.exe	155

System policy modification 1 TTPs 45 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3aa1bbd17d68b0b67b7423f1fe09b05b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3aa1bbd17d68b0b67b7423f1fe09b05b.exe
"C:\Users\Admin\AppData\Local\Temp\3aa1bbd17d68b0b67b7423f1fe09b05b.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:404
- C:\Recovery\WindowsRE\Registry.exe
  "C:\Recovery\WindowsRE\Registry.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2020
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5232662f-518d-448c-be32-5639c3579356.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1224
  - - C:\Recovery\WindowsRE\Registry.exe
      C:\Recovery\WindowsRE\Registry.exe
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3668
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\600ecb4b-5e36-47a4-b903-68022daaf2de.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3000
      - C:\Recovery\WindowsRE\Registry.exe
        
        C:\Recovery\WindowsRE\Registry.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4920
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02c8a49a-8e39-453d-840b-19e68a8fff61.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Recovery\WindowsRE\Registry.exe
        
        C:\Recovery\WindowsRE\Registry.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2704
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe2a95b1-7461-4539-82a9-30678ac7ece0.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\Recovery\WindowsRE\Registry.exe
        
        C:\Recovery\WindowsRE\Registry.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\46c6ef8a-a494-4c78-b54d-dea411e88c13.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Recovery\WindowsRE\Registry.exe
        
        C:\Recovery\WindowsRE\Registry.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4240
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1278a3b9-f60b-4f73-9fcf-718ef065399c.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Recovery\WindowsRE\Registry.exe
        
        C:\Recovery\WindowsRE\Registry.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1204
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04f5945d-baaf-4d56-bc59-c347ff87828e.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Recovery\WindowsRE\Registry.exe
        
        C:\Recovery\WindowsRE\Registry.exe
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:956
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d002079-1d5a-4279-8f68-2f759e7d559d.vbs"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Recovery\WindowsRE\Registry.exe
        
        C:\Recovery\WindowsRE\Registry.exe
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:392
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1b168fc8-bdec-48fb-9b25-5b81eda6b726.vbs"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:1992
        
        C:\Recovery\WindowsRE\Registry.exe
        
        C:\Recovery\WindowsRE\Registry.exe
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1224
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2bb328c0-c539-4e81-9e11-31dd79f6454c.vbs"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Recovery\WindowsRE\Registry.exe
        
        C:\Recovery\WindowsRE\Registry.exe
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4384
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d8192f27-8fec-4b8c-beaf-6a2f36b0854b.vbs"
        23⤵
        
        PID:372
        
        C:\Recovery\WindowsRE\Registry.exe
        
        C:\Recovery\WindowsRE\Registry.exe
        24⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3888
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d84d4d28-45f5-4a6e-b63a-cf8fb1e4956a.vbs"
        25⤵
        
        PID:3872
        
        C:\Recovery\WindowsRE\Registry.exe
        
        C:\Recovery\WindowsRE\Registry.exe
        26⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2540
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\33311d75-efa4-4092-91d1-64e034bb5d82.vbs"
        27⤵
        
        PID:4168
        
        C:\Recovery\WindowsRE\Registry.exe
        
        C:\Recovery\WindowsRE\Registry.exe
        28⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b76c223-9704-43ce-9cf0-ce8c87e38a9c.vbs"
        29⤵
        
        PID:3956
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\88301ed2-88ac-4c80-a63c-cdcd81535908.vbs"
        29⤵
        
        PID:4996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80a37e79-2560-482d-bc99-3de8e66dde8c.vbs"
        27⤵
        
        PID:1304
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a73212e-3a27-4221-98c6-bcfa215fca33.vbs"
        25⤵
        
        PID:2088
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b841718b-c799-4f58-a00b-a0cb2176246c.vbs"
        23⤵
        
        PID:4172
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9cb5eac4-37bb-4a91-9f2d-f20843a79e33.vbs"
        21⤵
        
        PID:3736
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e1a22eca-4163-495c-a812-7c66702b3a81.vbs"
        19⤵
        
        PID:4620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fc380726-a9b9-453e-8fcd-61a580e0d8f5.vbs"
        17⤵
        
        PID:3080
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a5f3a7fe-41e7-49d2-bfe6-0c7d11198323.vbs"
        15⤵
        
        PID:1188
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\134bc14e-e2d5-479e-a10f-534918a2012d.vbs"
        13⤵
        
        PID:1040
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5e181cc6-714c-4a85-a830-3a877c1146f9.vbs"
        11⤵
        
        PID:4456
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb3c5331-fea2-4a72-9bff-749e18519b43.vbs"
        9⤵
        
        PID:3664
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\39395f90-5dd1-4514-a06b-4e96e75b5481.vbs"
        7⤵
        
        PID:1444
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\56c18243-f0b3-456c-998c-b81cb35d664f.vbs"
        5⤵
        
        PID:60
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc17cdb1-bc37-4b79-af5b-d24c612ffcbf.vbs"
    3⤵
    PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\Accessories\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\Accessories\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\SKB\LanguageModels\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\SKB\LanguageModels\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-3442511616-637977696-3186306149-1000\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\All Users\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-3442511616-637977696-3186306149-1000\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-3442511616-637977696-3186306149-1000\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\dotnet\host\fxr\7.0.16\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\dotnet\host\fxr\7.0.16\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\dotnet\host\fxr\7.0.16\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Templates\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default\Templates\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Templates\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Photo Viewer\es-ES\RuntimeBroker.exe

Filesize
2.2MB

MD5
3aa1bbd17d68b0b67b7423f1fe09b05b

SHA1
61c43b8f31a51d772fd39d5caa87699d74971a43

SHA256
7362f82084bcdf47b0927674ad678f66214e8d4f2783a0b9338ee4eb773c3474

SHA512
7ae82411565104b15cc0de4cc8315d93301befbb28b1e36e3c50d46c8ba9fb1ff8eb361e12cd9d32771e2a5ecbee9b026aca0105473a9fe5a877fc2744b32014

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log

Filesize
1KB

MD5
49b64127208271d8f797256057d0b006

SHA1
b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

SHA256
2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

SHA512
f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\02c8a49a-8e39-453d-840b-19e68a8fff61.vbs

Filesize
710B

MD5
c17b5b1f2d7155b353b24290773f7f4d

SHA1
b448433b44c4827db69f7ded98f93a0d0f8a563f

SHA256
db65401df2291987b1c3329bd2ba16854912e929b56d3ce61f901715183efd4c

SHA512
9d7714c4ef4e4465c0ab62a11ad13764fe8a8ea3857481fe8279e0d72f6d5b70dc2cd87858e8f9538aea1e251990426dfabc5c0a0a7f83eda30a90d064c5824e

Download Submit
C:\Users\Admin\AppData\Local\Temp\04f5945d-baaf-4d56-bc59-c347ff87828e.vbs

Filesize
710B

MD5
978c44ce2c83bd0d23808f8472a75220

SHA1
173f9818c44ac50041d9c76354618252685f1425

SHA256
cf07d3dcad95f68cca29366f9c3d83ff3ec74d88e6d1e71560beec251a41664c

SHA512
02f0422dddf5bb959179f6cbd5167adcf3ea9900a981dd76f30551ec449a8141e3a1e577485009f7265727a3bf2d2b0d4cb541f1299c336033467d06fd0c0d26

Download Submit
C:\Users\Admin\AppData\Local\Temp\0b76c223-9704-43ce-9cf0-ce8c87e38a9c.vbs

Filesize
710B

MD5
7c3bad4179ad8164559137b8369b26c5

SHA1
d7d153cdc51b35deccba9c52146b376bd12c2bcf

SHA256
77b74be2e6547281c5023e02c0b170e39da02077e349f2352b19566df95521c8

SHA512
4283459ab993c87d79ff1aa617f0174d065c0529406ee4b2d1164df827efb51153cad91ec3d6788ee26cf9ec774c279ded52f4313c283f6ffe298d13f2477979

Download Submit
C:\Users\Admin\AppData\Local\Temp\1278a3b9-f60b-4f73-9fcf-718ef065399c.vbs

Filesize
710B

MD5
0ba16df4c7f9dfcfda7b28448152812f

SHA1
664a5571ef2fb9d02133548ed17f938c54d42081

SHA256
798feac188d1d7d51f96de546f885c1b53b86a71c9d4f178a7d23dab425345b5

SHA512
4573bac08ad65bcda987a00aba2d761cc0ac14971b91fb2afb2da2a2f730b76256195df21cecefc97f4e17a0ca805d7f08ee4bdc21adc007716e9db2735fa532

Download Submit
C:\Users\Admin\AppData\Local\Temp\1b168fc8-bdec-48fb-9b25-5b81eda6b726.vbs

Filesize
709B

MD5
7b3c7d979c7ebea016ffbc10eff3aa0b

SHA1
babe14918027592c03f30776d78960bf7484e57c

SHA256
9b1c8dc0a6dc11e3f8baf9f6dbfd65b9fb51601927d74f7742960b56fd8dd7b8

SHA512
b3e48a2a03a21c982f10288e1c985a3bb3a263c456c891a4892dcd49afe31b44d545431c2b42c72514f9c2f9e1aaa0c9d500d7f6ef0057eebcb9ebe833526fa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2bb328c0-c539-4e81-9e11-31dd79f6454c.vbs

Filesize
710B

MD5
946a76f717d19753816c554c966e47c0

SHA1
8585f22ad29df70f2e4e837feb004706789ffebd

SHA256
0577632316bf85ee7e9c8876e0b8ec6c2a7da91f4f831d61a44a466d4ed3371e

SHA512
28fd0da94d8bcdb37769bae453a58b155eef9ad8547d95715d94575f12db6a49c584300506c6195ef595befc7b6c1f1d4ffcb513928d9d1f35956ddd4033d55c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2d002079-1d5a-4279-8f68-2f759e7d559d.vbs

Filesize
709B

MD5
72be82c9076291b0d12520634c67751d

SHA1
024c665c730a8c31d78ca140a8dcd0b9cb58b75b

SHA256
a5a626ac00291c5c164e56855f06bf073b7f8d092b01190ffcdfdedbfec8ad3f

SHA512
4fcc920f3724040a21ae2a74d3b7ad073fcdf8ddc4925bee0e35d384d6069d81c552a274390fbe24af60e7d8f23496c85c8672f7cc0ac125508dc049251797ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\33311d75-efa4-4092-91d1-64e034bb5d82.vbs

Filesize
710B

MD5
e08a9df1a0a3bb3070fa9502177bd9f9

SHA1
5fb6540ac31cb4b28be32da117235e0cbf8cbc07

SHA256
8ef97783cadc5ae53af219b2157a1e52569579041062cfe27a9e3618235bd02a

SHA512
057a0afb8e7f8fbfd8ac3e894565aca73034cdd3d42fa492334c90693482d1bd45125690b57d3b144394132979d4f4ee5e79bacff976b6884b8fd8f9af6cab50

Download Submit
C:\Users\Admin\AppData\Local\Temp\46c6ef8a-a494-4c78-b54d-dea411e88c13.vbs

Filesize
710B

MD5
b98da492531a95686a3745ee86e8f9b5

SHA1
e7c8f2d80350165ac1698e0bf54224c0c5288ead

SHA256
85f2c94e5c9e6bac1539abcfe2fea60e69805df239035979cf560dd4c07599c7

SHA512
68bc09b0254ed5da806a035faea79c3b959f0c78a5faa19438238602290435b157015b1bee1401916f8d89c158492f95c9f7571720589ba92c30988bb2480f5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\5232662f-518d-448c-be32-5639c3579356.vbs

Filesize
710B

MD5
4cc1e3fa5d0a81b7d7dabad03c2f1cc3

SHA1
23633c566c38b07a39441197d0aa864be2b7b641

SHA256
814b160891416886ad49aece0f9c9b5a82ee395a2884b45ae2e1337ddad5c1e2

SHA512
7289f7bbae1f6f5e281a34e9c91d27091ce2911214eb77e5cd4703d02e1dc139936e6440d019850ddc68f0459827b012629244fa0971df7d3ddddf94f61c22b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\600ecb4b-5e36-47a4-b903-68022daaf2de.vbs

Filesize
710B

MD5
0ab286619def7e361787f46a0a7484af

SHA1
3868b01fd6cf0f56c63b7f156e22ac046f839ff5

SHA256
3bbb628e0f911e3cc586545e3e06fb67115923c43823c59049a156829fb5eb4c

SHA512
5aed9f11de65405c4c45b6033893c929f0c5184955000cc2bc241933eaeabc95b07b2c4f13cd32c6c378083c3237b81f644fa72e5a74e6474dddacf1d9b79b05

Download Submit
C:\Users\Admin\AppData\Local\Temp\bc17cdb1-bc37-4b79-af5b-d24c612ffcbf.vbs

Filesize
486B

MD5
9c1e5230f1860c59d3d11618e5584d01

SHA1
5ae203f3694660ebf00c8527b84585a4f69d43bc

SHA256
9c6aeaccf33e3644aea6dce49eee5d9958671c3b68f905c39159f4113f7ef256

SHA512
68fe748c74a6f3f64370029af3af88a46db188b96a8c93c144fe8fd3cd73da1f5c77f8aa108a25daf565c01bc8b334e06bf805220fdea31d0d5315d25a0fae51

Download Submit
C:\Users\Admin\AppData\Local\Temp\d8192f27-8fec-4b8c-beaf-6a2f36b0854b.vbs

Filesize
710B

MD5
d22a9d1c3d8ff7fd0da808fd61af2837

SHA1
8b87ba58842e4bee64402859f1e15f8197de37fc

SHA256
dd3e5c48ad86fa270cabae06966e0e6bb4b1b7c37095bc32ba00001bce35b060

SHA512
7b40562a2e844860f78ca6534ac5f1d19dce5e6258e8445ed4202d0f3bc4baaf3bcdabd4ac6caec387edfd64cf19d8db57727ee623d9069cc6287e9a741c7506

Download Submit
C:\Users\Admin\AppData\Local\Temp\d84d4d28-45f5-4a6e-b63a-cf8fb1e4956a.vbs

Filesize
710B

MD5
875ab52dfdecd13752cf9f0ecdf6f8b9

SHA1
ade3cd2547f088af2e70ae7f5c54b7a432f4a6f8

SHA256
c0ed01362c2c96b15a3b21fc227cffcee5bbca6b18c954b74d628c9c2af8caa8

SHA512
e70f8dc544ce102eca32b5fc242b0dc551b85ed412bab5a9958db4955cb5b2d01221eff9766090c5eb37a7143017dd9d8a6f013e98d704ccb26f92e3cd228d9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fe2a95b1-7461-4539-82a9-30678ac7ece0.vbs

Filesize
710B

MD5
022b301fd3beb8baf60973f16d15e87f

SHA1
57544fbf1f93ea0ae4ed3532b4c715f2c4af2b84

SHA256
6dd91fb993f926013494b839e0f9b5ab1d8ded8366e09754636a16e40ee9795e

SHA512
9f2897e432bd6b990f09de320f27737cc0b9af09c502f22f7c5abf88119414ffacee0acd650dbdfac2086075940a2eeaf2f36a700f1d6e520d96780c41e9770b

Download Submit
memory/392-160-0x000000001C150000-0x000000001C162000-memory.dmp

Filesize
72KB

Download
memory/404-14-0x0000000002C70000-0x0000000002C80000-memory.dmp

Filesize
64KB

Download
memory/404-69-0x00007FFEC1A60000-0x00007FFEC2521000-memory.dmp

Filesize
10.8MB

Download
memory/404-20-0x000000001B610000-0x000000001B622000-memory.dmp

Filesize
72KB

Download
memory/404-21-0x000000001C390000-0x000000001C8B8000-memory.dmp

Filesize
5.2MB

Download
memory/404-24-0x000000001BE70000-0x000000001BE7C000-memory.dmp

Filesize
48KB

Download
memory/404-23-0x000000001BE60000-0x000000001BE68000-memory.dmp

Filesize
32KB

Download
memory/404-25-0x000000001BE80000-0x000000001BE8C000-memory.dmp

Filesize
48KB

Download
memory/404-22-0x000000001B640000-0x000000001B64C000-memory.dmp

Filesize
48KB

Download
memory/404-26-0x000000001BF90000-0x000000001BF98000-memory.dmp

Filesize
32KB

Download
memory/404-27-0x000000001BFA0000-0x000000001BFAC000-memory.dmp

Filesize
48KB

Download
memory/404-32-0x000000001C0F0000-0x000000001C0FC000-memory.dmp

Filesize
48KB

Download
memory/404-31-0x000000001C0E0000-0x000000001C0E8000-memory.dmp

Filesize
32KB

Download
memory/404-30-0x000000001C0D0000-0x000000001C0D8000-memory.dmp

Filesize
32KB

Download
memory/404-29-0x000000001C0C0000-0x000000001C0CE000-memory.dmp

Filesize
56KB

Download
memory/404-28-0x000000001BFB0000-0x000000001BFBA000-memory.dmp

Filesize
40KB

Download
memory/404-33-0x000000001C100000-0x000000001C108000-memory.dmp

Filesize
32KB

Download
memory/404-34-0x000000001C210000-0x000000001C21A000-memory.dmp

Filesize
40KB

Download
memory/404-35-0x000000001C110000-0x000000001C11C000-memory.dmp

Filesize
48KB

Download
memory/404-18-0x000000001B5F0000-0x000000001B5FC000-memory.dmp

Filesize
48KB

Download
memory/404-19-0x000000001B600000-0x000000001B608000-memory.dmp

Filesize
32KB

Download
memory/404-17-0x000000001B5E0000-0x000000001B5E8000-memory.dmp

Filesize
32KB

Download
memory/404-16-0x000000001B5D0000-0x000000001B5DC000-memory.dmp

Filesize
48KB

Download
memory/404-15-0x000000001B5C0000-0x000000001B5CA000-memory.dmp

Filesize
40KB

Download
memory/404-0-0x00007FFEC1A63000-0x00007FFEC1A65000-memory.dmp

Filesize
8KB

Download
memory/404-13-0x0000000002C60000-0x0000000002C68000-memory.dmp

Filesize
32KB

Download
memory/404-12-0x0000000002C80000-0x0000000002C8C000-memory.dmp

Filesize
48KB

Download
memory/404-7-0x0000000002C00000-0x0000000002C08000-memory.dmp

Filesize
32KB

Download
memory/404-9-0x0000000002C20000-0x0000000002C36000-memory.dmp

Filesize
88KB

Download
memory/404-1-0x0000000000760000-0x000000000099E000-memory.dmp

Filesize
2.2MB

Download
memory/404-11-0x0000000002C50000-0x0000000002C62000-memory.dmp

Filesize
72KB

Download
memory/404-10-0x0000000002C40000-0x0000000002C48000-memory.dmp

Filesize
32KB

Download
memory/404-8-0x0000000002C10000-0x0000000002C20000-memory.dmp

Filesize
64KB

Download
memory/404-6-0x000000001B570000-0x000000001B5C0000-memory.dmp

Filesize
320KB

Download
memory/404-5-0x0000000002BE0000-0x0000000002BFC000-memory.dmp

Filesize
112KB

Download
memory/404-4-0x0000000002BD0000-0x0000000002BD8000-memory.dmp

Filesize
32KB

Download
memory/404-3-0x0000000001260000-0x000000000126E000-memory.dmp

Filesize
56KB

Download
memory/404-2-0x00007FFEC1A60000-0x00007FFEC2521000-memory.dmp

Filesize
10.8MB

Download
memory/1204-137-0x000000001BB10000-0x000000001BB22000-memory.dmp

Filesize
72KB

Download
memory/4988-216-0x000000001B960000-0x000000001B972000-memory.dmp

Filesize
72KB

Download