dcrat | 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_860\\dwm.exe\", \"C:\\Users\\Admin\\Saved Games\\dwm.exe\", \"C:\\Windows\\System32\\C_936\\SppExtComObj.exe\", \"C:\\Windows\\Cursors\\RuntimeBroker.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_860\\dwm.exe\", \"C:\\Users\\Admin\\Saved Games\\dwm.exe\", \"C:\\Windows\\System32\\C_936\\SppExtComObj.exe\", \"C:\\Windows\\Cursors\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Google\\Update\\1.3.36.371\\dllhost.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_860\\dwm.exe\", \"C:\\Users\\Admin\\Saved Games\\dwm.exe\", \"C:\\Windows\\System32\\C_936\\SppExtComObj.exe\", \"C:\\Windows\\Cursors\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Google\\Update\\1.3.36.371\\dllhost.exe\", \"C:\\Windows\\System32\\KBDBR\\spoolsv.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_860\\dwm.exe\", \"C:\\Users\\Admin\\Saved Games\\dwm.exe\", \"C:\\Windows\\System32\\C_936\\SppExtComObj.exe\", \"C:\\Windows\\Cursors\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Google\\Update\\1.3.36.371\\dllhost.exe\", \"C:\\Windows\\System32\\KBDBR\\spoolsv.exe\", \"C:\\Windows\\System32\\iprtrmgr\\lsass.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_860\\dwm.exe\", \"C:\\Users\\Admin\\Saved Games\\dwm.exe\", \"C:\\Windows\\System32\\C_936\\SppExtComObj.exe\", \"C:\\Windows\\Cursors\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Google\\Update\\1.3.36.371\\dllhost.exe\", \"C:\\Windows\\System32\\KBDBR\\spoolsv.exe\", \"C:\\Windows\\System32\\iprtrmgr\\lsass.exe\", \"C:\\Windows\\TAPI\\SppExtComObj.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_860\\dwm.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_860\\dwm.exe\", \"C:\\Users\\Admin\\Saved Games\\dwm.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_860\\dwm.exe\", \"C:\\Users\\Admin\\Saved Games\\dwm.exe\", \"C:\\Windows\\System32\\C_936\\SppExtComObj.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	3324	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	3324	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	3324	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	3324	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	3324	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	3324	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	3324	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	3324	schtasks.exe	83

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/804-1-0x0000000000240000-0x0000000000334000-memory.dmp	dcrat
behavioral2/files/0x000a000000023b81-20.dat	dcrat
behavioral2/files/0x000b000000023b76-52.dat	dcrat
behavioral2/files/0x000c000000023b78-63.dat	dcrat
behavioral2/files/0x000c000000023b7c-74.dat	dcrat
behavioral2/files/0x000c000000023b7e-85.dat	dcrat
behavioral2/files/0x000300000001e767-105.dat	dcrat
behavioral2/memory/452-134-0x0000000000290000-0x0000000000384000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe

Executes dropped EXE 1 IoCs

pid	Process
452	dwm.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\TAPI\\SppExtComObj.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\Cursors\\RuntimeBroker.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.371\\dllhost.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\iprtrmgr\\lsass.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Admin\\Saved Games\\dwm.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\C_860\\dwm.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Admin\\Saved Games\\dwm.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\System32\\C_936\\SppExtComObj.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\System32\\C_936\\SppExtComObj.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\KBDBR\\spoolsv.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\KBDBR\\spoolsv.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\TAPI\\SppExtComObj.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\C_860\\dwm.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.371\\dllhost.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\iprtrmgr\\lsass.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\Cursors\\RuntimeBroker.exe\""	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\KBDBR\spoolsv.exe	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Windows\System32\iprtrmgr\lsass.exe	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File created	C:\Windows\System32\KBDBR\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Windows\System32\C_860\RCX8521.tmp	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Windows\System32\C_936\RCX8A35.tmp	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Windows\System32\C_936\SppExtComObj.exe	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Windows\System32\iprtrmgr\RCX94AE.tmp	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File created	C:\Windows\System32\C_936\e1ef82546f0b02b7e974f28047f3788b1128cce1	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Windows\System32\C_860\RCX8520.tmp	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File created	C:\Windows\System32\iprtrmgr\lsass.exe	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Windows\System32\KBDBR\RCX91BE.tmp	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Windows\System32\iprtrmgr\RCX943F.tmp	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File created	C:\Windows\System32\C_860\6cb0b6c459d5d3455a3da700e713f2e2529862ff	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File created	C:\Windows\System32\KBDBR\spoolsv.exe	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File created	C:\Windows\System32\C_936\SppExtComObj.exe	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File created	C:\Windows\System32\iprtrmgr\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Windows\System32\C_936\RCX8AA3.tmp	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Windows\System32\KBDBR\RCX91BD.tmp	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File created	C:\Windows\System32\C_860\dwm.exe	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Windows\System32\C_860\dwm.exe	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\RCX8F4A.tmp	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\RCX8FB8.tmp	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\dllhost.exe	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.371\dllhost.exe	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.371\5940a34987c99120d96dace90a3f93f329dcad63	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Cursors\RuntimeBroker.exe	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File created	C:\Windows\Cursors\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Windows\Cursors\RCX8CC7.tmp	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Windows\Cursors\RCX8D35.tmp	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Windows\Cursors\RuntimeBroker.exe	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Windows\TAPI\RCX96B3.tmp	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File created	C:\Windows\TAPI\SppExtComObj.exe	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File created	C:\Windows\TAPI\e1ef82546f0b02b7e974f28047f3788b1128cce1	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Windows\TAPI\RCX96B2.tmp	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
File opened for modification	C:\Windows\TAPI\SppExtComObj.exe	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
800	schtasks.exe
4480	schtasks.exe
3704	schtasks.exe
4572	schtasks.exe
2660	schtasks.exe
2676	schtasks.exe
2856	schtasks.exe
3700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
804	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
804	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
804	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
804	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
804	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	804	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Token: SeDebugPrivilege	452	dwm.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 452	804	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe	93
PID 804 wrote to memory of 452	804	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe	93

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
"C:\Users\Admin\AppData\Local\Temp\1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:804
- C:\Users\Admin\Saved Games\dwm.exe
  "C:\Users\Admin\Saved Games\dwm.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\C_860\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\System32\C_936\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Cursors\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\1.3.36.371\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\KBDBR\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\iprtrmgr\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\TAPI\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses