colibri | c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79ccc

Analysis

max time kernel
118s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Size

4.9MB
MD5

a0f7a7c23f4328406cd5e9c3048ac530
SHA1

f0182c24eb6c86b592e92ccabf50abb48bfb92ce
SHA256

c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79ccc
SHA512

7f439594403da5e99de6e4ba5a388ba3ce61571c7589a34040f8dc36ccab3e0ea28193b94852fa3d00c22f9ac32aab454cd569e8ba38175a5be56a25f5b86dbf
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri

DcRat 50 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\e6c9b481da804f		c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
		1356	schtasks.exe
		3328	schtasks.exe
File created	C:\Program Files (x86)\Google\38384e6a620884		c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
		3540	schtasks.exe
		1896	schtasks.exe
		4320	schtasks.exe
		4472	schtasks.exe
		3244	schtasks.exe
		5084	schtasks.exe
		2116	schtasks.exe
		2712	schtasks.exe
File created	C:\Windows\SKB\LanguageModels\5b884080fd4f94		c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
		2564	schtasks.exe
		3292	schtasks.exe
		1920	schtasks.exe
		4400	schtasks.exe
		2744	schtasks.exe
		2500	schtasks.exe
		2368	schtasks.exe
		1388	schtasks.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\eddb19405b7ce1		c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
		4972	schtasks.exe
		400	schtasks.exe
		1168	schtasks.exe
		2628	schtasks.exe
		3912	schtasks.exe
		1048	schtasks.exe
		936	schtasks.exe
		1620	schtasks.exe
		2324	schtasks.exe
File created	C:\Program Files\Windows Multimedia Platform\9e8d7a4ca61bd9		c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
		900	schtasks.exe
		1272	schtasks.exe
		1684	schtasks.exe
		3632	schtasks.exe
		4164	schtasks.exe
		4532	schtasks.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\eddb19405b7ce1		c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
		4888	schtasks.exe
		2032	schtasks.exe
		2236	schtasks.exe
		536	schtasks.exe
		3608	schtasks.exe
		2936	schtasks.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\6203df4a6bafc7		c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
		3868	schtasks.exe
		4372	schtasks.exe
		1072	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	936	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	400	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3868	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5084	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3540	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4164	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	2384	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2384	schtasks.exe	84

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/404-2-0x000000001BDA0000-0x000000001BECE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4796	powershell.exe
116	powershell.exe
4092	powershell.exe
3212	powershell.exe
3104	powershell.exe
4948	powershell.exe
4784	powershell.exe
3308	powershell.exe
4720	powershell.exe
3760	powershell.exe
1788	powershell.exe
3924	powershell.exe
3260	powershell.exe
2704	powershell.exe
1500	powershell.exe
864	powershell.exe
2964	powershell.exe
4508	powershell.exe
4332	powershell.exe
1908	powershell.exe
2344	powershell.exe
4992	powershell.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	csrss.exe

Executes dropped EXE 37 IoCs

pid	Process
2968	tmp730F.tmp.exe
1588	tmp730F.tmp.exe
1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
1336	tmp955A.tmp.exe
2396	tmp955A.tmp.exe
1176	tmp955A.tmp.exe
1144	csrss.exe
748	tmpAB63.tmp.exe
668	tmpAB63.tmp.exe
1592	csrss.exe
1680	tmpE05D.tmp.exe
1072	tmpE05D.tmp.exe
1444	tmpE05D.tmp.exe
2328	tmpE05D.tmp.exe
792	tmpE05D.tmp.exe
4204	csrss.exe
868	tmp120C.tmp.exe
2616	tmp120C.tmp.exe
4436	csrss.exe
2472	csrss.exe
3328	tmp4E98.tmp.exe
5008	tmp4E98.tmp.exe
3332	csrss.exe
4444	tmp8279.tmp.exe
3308	tmp8279.tmp.exe
3300	csrss.exe
1956	csrss.exe
2916	tmpBBF8.tmp.exe
3616	tmpBBF8.tmp.exe
4688	tmpBBF8.tmp.exe
2928	csrss.exe
3248	tmpD82B.tmp.exe
4624	tmpD82B.tmp.exe
1172	csrss.exe
4612	tmp8D0.tmp.exe
1352	tmp8D0.tmp.exe
2604	csrss.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 2968 set thread context of 1588	2968	tmp730F.tmp.exe	114
PID 2396 set thread context of 1176	2396	tmp955A.tmp.exe	157
PID 748 set thread context of 668	748	tmpAB63.tmp.exe	191
PID 2328 set thread context of 792	2328	tmpE05D.tmp.exe	210
PID 868 set thread context of 2616	868	tmp120C.tmp.exe	221
PID 3328 set thread context of 5008	3328	tmp4E98.tmp.exe	235
PID 4444 set thread context of 3308	4444	tmp8279.tmp.exe	244
PID 3616 set thread context of 4688	3616	tmpBBF8.tmp.exe	259
PID 3248 set thread context of 4624	3248	tmpD82B.tmp.exe	269
PID 4612 set thread context of 1352	4612	tmp8D0.tmp.exe	278

Drops file in Program Files directory 30 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\uninstall\eddb19405b7ce1	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCX7F89.tmp	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\sppsvc.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\csrss.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Program Files (x86)\Google\SearchApp.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File opened for modification	C:\Program Files (x86)\Google\RCX7524.tmp	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\e6c9b481da804f	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RCX70FB.tmp	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\lsass.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\eddb19405b7ce1	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Program Files (x86)\Google\38384e6a620884	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\backgroundTaskHost.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\RCX794D.tmp	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\lsass.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Program Files (x86)\Windows Portable Devices\886983d96e3d3e	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\OfficeClickToRun.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\0a1fd5f707cd16	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Program Files (x86)\Windows Portable Devices\csrss.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Program Files\Windows Multimedia Platform\9e8d7a4ca61bd9	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File opened for modification	C:\Program Files (x86)\Google\SearchApp.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\backgroundTaskHost.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\sppsvc.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\6203df4a6bafc7	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCX7B61.tmp	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCX7D75.tmp	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\OfficeClickToRun.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\InputMethod\CHS\f3b6ecef712a24	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File opened for modification	C:\Windows\InputMethod\CHS\spoolsv.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Windows\SKB\LanguageModels\fontdrvhost.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Windows\SKB\LanguageModels\5b884080fd4f94	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File opened for modification	C:\Windows\SKB\LanguageModels\RCX7310.tmp	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File opened for modification	C:\Windows\SKB\LanguageModels\fontdrvhost.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
File created	C:\Windows\InputMethod\CHS\spoolsv.exe	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpD82B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp730F.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp955A.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp955A.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE05D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpAB63.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp120C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE05D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8279.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBBF8.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8D0.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE05D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE05D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4E98.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBBF8.tmp.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3912	schtasks.exe
3292	schtasks.exe
1072	schtasks.exe
2628	schtasks.exe
4320	schtasks.exe
2368	schtasks.exe
1896	schtasks.exe
2116	schtasks.exe
1272	schtasks.exe
1620	schtasks.exe
2032	schtasks.exe
4972	schtasks.exe
1048	schtasks.exe
3328	schtasks.exe
2936	schtasks.exe
1388	schtasks.exe
2744	schtasks.exe
4400	schtasks.exe
1356	schtasks.exe
2712	schtasks.exe
5084	schtasks.exe
2564	schtasks.exe
4888	schtasks.exe
4472	schtasks.exe
1684	schtasks.exe
3244	schtasks.exe
1920	schtasks.exe
2500	schtasks.exe
2236	schtasks.exe
400	schtasks.exe
3540	schtasks.exe
4532	schtasks.exe
4372	schtasks.exe
536	schtasks.exe
4164	schtasks.exe
936	schtasks.exe
3632	schtasks.exe
2324	schtasks.exe
3868	schtasks.exe
1168	schtasks.exe
3608	schtasks.exe
900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
3924	powershell.exe
3924	powershell.exe
3308	powershell.exe
3308	powershell.exe
4784	powershell.exe
4784	powershell.exe
1788	powershell.exe
1788	powershell.exe
4508	powershell.exe
4508	powershell.exe
4992	powershell.exe
4992	powershell.exe
1908	powershell.exe
1908	powershell.exe
4332	powershell.exe
4332	powershell.exe
2964	powershell.exe
2964	powershell.exe
2344	powershell.exe
2344	powershell.exe
4784	powershell.exe
4948	powershell.exe
4948	powershell.exe
4332	powershell.exe
3308	powershell.exe
4992	powershell.exe
3924	powershell.exe
1788	powershell.exe
1908	powershell.exe
4508	powershell.exe
2964	powershell.exe
2344	powershell.exe
4948	powershell.exe
1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
4092	powershell.exe
4092	powershell.exe
4720	powershell.exe
4720	powershell.exe
864	powershell.exe
1500	powershell.exe
864	powershell.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	3308	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	4332	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Token: SeDebugPrivilege	4092	powershell.exe
Token: SeDebugPrivilege	116	powershell.exe
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	3104	powershell.exe
Token: SeDebugPrivilege	3260	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeDebugPrivilege	1144	csrss.exe
Token: SeDebugPrivilege	1592	csrss.exe
Token: SeDebugPrivilege	4204	csrss.exe
Token: SeDebugPrivilege	4436	csrss.exe
Token: SeDebugPrivilege	2472	csrss.exe
Token: SeDebugPrivilege	3332	csrss.exe
Token: SeDebugPrivilege	3300	csrss.exe
Token: SeDebugPrivilege	1956	csrss.exe
Token: SeDebugPrivilege	2928	csrss.exe
Token: SeDebugPrivilege	1172	csrss.exe
Token: SeDebugPrivilege	2604	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 2968	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	112
PID 404 wrote to memory of 2968	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	112
PID 404 wrote to memory of 2968	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	112
PID 2968 wrote to memory of 1588	2968	tmp730F.tmp.exe	114
PID 2968 wrote to memory of 1588	2968	tmp730F.tmp.exe	114
PID 2968 wrote to memory of 1588	2968	tmp730F.tmp.exe	114
PID 2968 wrote to memory of 1588	2968	tmp730F.tmp.exe	114
PID 2968 wrote to memory of 1588	2968	tmp730F.tmp.exe	114
PID 2968 wrote to memory of 1588	2968	tmp730F.tmp.exe	114
PID 2968 wrote to memory of 1588	2968	tmp730F.tmp.exe	114
PID 404 wrote to memory of 4948	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	116
PID 404 wrote to memory of 4948	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	116
PID 404 wrote to memory of 4992	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	117
PID 404 wrote to memory of 4992	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	117
PID 404 wrote to memory of 2964	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	118
PID 404 wrote to memory of 2964	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	118
PID 404 wrote to memory of 3308	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	119
PID 404 wrote to memory of 3308	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	119
PID 404 wrote to memory of 2344	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	120
PID 404 wrote to memory of 2344	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	120
PID 404 wrote to memory of 3924	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	122
PID 404 wrote to memory of 3924	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	122
PID 404 wrote to memory of 4332	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	124
PID 404 wrote to memory of 4332	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	124
PID 404 wrote to memory of 1908	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	125
PID 404 wrote to memory of 1908	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	125
PID 404 wrote to memory of 4784	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	126
PID 404 wrote to memory of 4784	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	126
PID 404 wrote to memory of 1788	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	127
PID 404 wrote to memory of 1788	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	127
PID 404 wrote to memory of 4508	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	128
PID 404 wrote to memory of 4508	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	128
PID 404 wrote to memory of 1040	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	138
PID 404 wrote to memory of 1040	404	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	138
PID 1040 wrote to memory of 1336	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	154
PID 1040 wrote to memory of 1336	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	154
PID 1040 wrote to memory of 1336	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	154
PID 1336 wrote to memory of 2396	1336	tmp955A.tmp.exe	156
PID 1336 wrote to memory of 2396	1336	tmp955A.tmp.exe	156
PID 1336 wrote to memory of 2396	1336	tmp955A.tmp.exe	156
PID 2396 wrote to memory of 1176	2396	tmp955A.tmp.exe	157
PID 2396 wrote to memory of 1176	2396	tmp955A.tmp.exe	157
PID 2396 wrote to memory of 1176	2396	tmp955A.tmp.exe	157
PID 2396 wrote to memory of 1176	2396	tmp955A.tmp.exe	157
PID 2396 wrote to memory of 1176	2396	tmp955A.tmp.exe	157
PID 2396 wrote to memory of 1176	2396	tmp955A.tmp.exe	157
PID 2396 wrote to memory of 1176	2396	tmp955A.tmp.exe	157
PID 1040 wrote to memory of 4796	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	158
PID 1040 wrote to memory of 4796	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	158
PID 1040 wrote to memory of 2704	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	159
PID 1040 wrote to memory of 2704	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	159
PID 1040 wrote to memory of 116	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	160
PID 1040 wrote to memory of 116	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	160
PID 1040 wrote to memory of 3260	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	161
PID 1040 wrote to memory of 3260	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	161
PID 1040 wrote to memory of 4092	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	162
PID 1040 wrote to memory of 4092	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	162
PID 1040 wrote to memory of 4720	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	163
PID 1040 wrote to memory of 4720	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	163
PID 1040 wrote to memory of 1500	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	164
PID 1040 wrote to memory of 1500	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	164
PID 1040 wrote to memory of 864	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	165
PID 1040 wrote to memory of 864	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	165
PID 1040 wrote to memory of 3212	1040	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe	166

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
"C:\Users\Admin\AppData\Local\Temp\c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe"
1⤵
- DcRat
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:404
- C:\Users\Admin\AppData\Local\Temp\tmp730F.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp730F.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Users\Admin\AppData\Local\Temp\tmp730F.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp730F.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:1588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4508
- C:\Users\Admin\AppData\Local\Temp\c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe
  "C:\Users\Admin\AppData\Local\Temp\c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1040
- - C:\Users\Admin\AppData\Local\Temp\tmp955A.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp955A.tmp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Users\Admin\AppData\Local\Temp\tmp955A.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp955A.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\tmp955A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp955A.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:1176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3104
- - C:\Program Files (x86)\Windows Portable Devices\csrss.exe
    "C:\Program Files (x86)\Windows Portable Devices\csrss.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:1144
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3dd6ce52-ebb7-4a65-88c9-ca55c61011d8.vbs"
      4⤵
      PID:1772
    - - C:\Program Files (x86)\Windows Portable Devices\csrss.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\csrss.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1592
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ddeaa66-3e0c-43b0-8309-f1b81330386c.vbs"
        6⤵
        
        PID:3492
        
        C:\Program Files (x86)\Windows Portable Devices\csrss.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\csrss.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4204
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3bc80c6a-ea9f-4b2f-afa3-eac90098ed5a.vbs"
        8⤵
        
        PID:4428
        
        C:\Program Files (x86)\Windows Portable Devices\csrss.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\csrss.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4436
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7b9ccbb0-3930-4693-a352-da03cff9d580.vbs"
        10⤵
        
        PID:468
        
        C:\Program Files (x86)\Windows Portable Devices\csrss.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\csrss.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2472
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\16fff420-e5f2-444b-b675-c7da3f4b82af.vbs"
        12⤵
        
        PID:4556
        
        C:\Program Files (x86)\Windows Portable Devices\csrss.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\csrss.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3332
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\080e5ac7-1c98-4824-84a2-ceaa6ee57416.vbs"
        14⤵
        
        PID:4536
        
        C:\Program Files (x86)\Windows Portable Devices\csrss.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\csrss.exe"
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3300
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\86563777-04f5-4cd9-b986-4daf945a1080.vbs"
        16⤵
        
        PID:4476
        
        C:\Program Files (x86)\Windows Portable Devices\csrss.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\csrss.exe"
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1956
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42e178d3-dcbf-4e7d-89ab-672b6e6f98a1.vbs"
        18⤵
        
        PID:3084
        
        C:\Program Files (x86)\Windows Portable Devices\csrss.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\csrss.exe"
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2928
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4575c0c6-9348-49c8-b749-8f26092e9006.vbs"
        20⤵
        
        PID:4044
        
        C:\Program Files (x86)\Windows Portable Devices\csrss.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\csrss.exe"
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1172
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d6cd7c88-42f7-441c-9b7c-5d2e2a12b4b1.vbs"
        22⤵
        
        PID:720
        
        C:\Program Files (x86)\Windows Portable Devices\csrss.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\csrss.exe"
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2604
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\072d33c3-9bc6-430e-aeaf-107575ddb46b.vbs"
        24⤵
        
        PID:1592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a3f8f4ed-2b07-4aec-bab3-b413081f1d84.vbs"
        24⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\tmp3937.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3937.tmp.exe"
        24⤵
        
        PID:5000
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\322af452-be4d-4e8c-a372-ac2357d9d943.vbs"
        22⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\tmp8D0.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8D0.tmp.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\tmp8D0.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8D0.tmp.exe"
        23⤵
        Executes dropped EXE
        
        PID:1352
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2b0084a7-aef1-47fc-92d4-58ac75633fc0.vbs"
        20⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\tmpD82B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD82B.tmp.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\tmpD82B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD82B.tmp.exe"
        21⤵
        Executes dropped EXE
        
        PID:4624
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\317333eb-ecae-4b77-8ff5-ece58f434f89.vbs"
        18⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\tmpBBF8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBBF8.tmp.exe"
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\tmpBBF8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBBF8.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\tmpBBF8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBBF8.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:4688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f8394d1-fd67-4ba2-ba9b-8a4349718cfd.vbs"
        16⤵
        
        PID:3076
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\102299c0-bb35-4912-ad13-47a3f499caee.vbs"
        14⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\tmp8279.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8279.tmp.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\tmp8279.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8279.tmp.exe"
        15⤵
        Executes dropped EXE
        
        PID:3308
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dea9eae5-adc3-4356-9c65-526248803c1c.vbs"
        12⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\tmp4E98.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4E98.tmp.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\tmp4E98.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4E98.tmp.exe"
        13⤵
        Executes dropped EXE
        
        PID:5008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4830cf61-0187-4670-b1b9-20596cff2f56.vbs"
        10⤵
        
        PID:4684
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9d75d159-6a33-4114-add7-f923c3a2797a.vbs"
        8⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\tmp120C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp120C.tmp.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\tmp120C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp120C.tmp.exe"
        9⤵
        Executes dropped EXE
        
        PID:2616
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\33b9b619-8789-44f9-8e30-abd0b9531fe2.vbs"
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\tmpE05D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE05D.tmp.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\tmpE05D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE05D.tmp.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\tmpE05D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE05D.tmp.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\tmpE05D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE05D.tmp.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\tmpE05D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE05D.tmp.exe"
        10⤵
        Executes dropped EXE
        
        PID:792
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32de2547-d0fa-4662-9c5d-be7281744fa4.vbs"
      4⤵
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\tmpAB63.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpAB63.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:748
    - - C:\Users\Admin\AppData\Local\Temp\tmpAB63.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpAB63.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows\SKB\LanguageModels\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\SKB\LanguageModels\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\uninstall\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\uninstall\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Users\Default\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Default\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Users\Default\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Windows\InputMethod\CHS\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\InputMethod\CHS\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Windows\InputMethod\CHS\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\123.0.6312.123\lsass.exe

Filesize
4.9MB

MD5
a0f7a7c23f4328406cd5e9c3048ac530

SHA1
f0182c24eb6c86b592e92ccabf50abb48bfb92ce

SHA256
c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79ccc

SHA512
7f439594403da5e99de6e4ba5a388ba3ce61571c7589a34040f8dc36ccab3e0ea28193b94852fa3d00c22f9ac32aab454cd569e8ba38175a5be56a25f5b86dbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\c43ca8d4db6d919255a551797c7f01e75d8272fc8a2881bae204952091e79cccN.exe.log

Filesize
1KB

MD5
bbb951a34b516b66451218a3ec3b0ae1

SHA1
7393835a2476ae655916e0a9687eeaba3ee876e9

SHA256
eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a

SHA512
63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3db1c0d23daacf01eb99125ccc2787d3

SHA1
0849528de1ba411279231d635d8f39d54cc829d2

SHA256
bceb96f5c3d31447980eb8cd891bba75b3e5b6eb60abf4d829fc13cd8faf2582

SHA512
3d84635a3395bca1d91ce182ccfb9e38c8da87ad678704673a72d580e4251cedc5a6b2a89040a172a5687b67952e74a13673bd115bce7bdabaed06f89323de5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bf3651a8682259b5e292b98289271f76

SHA1
4694a32734c377985dafbd15e26b9a129f1e4a45

SHA256
5ffc07abea05b9bb523e511ed75995488a22e3dd54fddc50b62b8336bd57c575

SHA512
d9cd369fc710131f0f24c3add83a923625831b1bfb4fba0da83dd71fa41a4ed5a0f0e00755f3cf8ae2aef4aa498c353348c51c167f7d6a2af834f07c78b33896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b740f7616c3c3d006afd7e1586758eeb

SHA1
c465af4c07ecb9e3de239c410d3b2ed5de93cdde

SHA256
c11b84252afa74e4f323fcbae853cb45217a65d70ac44dea182f9ec872bd9872

SHA512
d4dd7531d48a9f6d6432fe0d55cefc76139566c54514ba722d76e5bd4371bfca0e491939795883de21901eac98b1af7236ea83281a7dde8befe16719993f185e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
90355e74a38e1aab8c3a306b3021da95

SHA1
4636ca6d7a6e4e3fc740a6a220826b5329b76e1f

SHA256
5851b1399bab7cbbbec6259b420ef8b2e6d1e8e9e03938d4ee0c04e3597c7658

SHA512
63e2b243a807d3e9d8aea8829d695e48d1c5731ae1ba2324870ce94bbf37e74ed00d923f28c2816da338380800de840ea05e855aa870451d64d2274eb3d6a785

Download Submit
C:\Users\Admin\AppData\Local\Temp\16fff420-e5f2-444b-b675-c7da3f4b82af.vbs

Filesize
733B

MD5
9675944869dd93f14bfaf9e3bd0e25b1

SHA1
096c7172a249e83217525fd4ea876b3258e9bf0e

SHA256
935e07fe6e88a6cea96f2264cd78fe5f40fb3d94ecafcf15a8d61d52f2fcc687

SHA512
a3d111b458772fd24ea183d74c787d6da9ceba33c8735a6f85aeeae3987bfb943be15bdfa457f6f67acea8848cdb58f26f0fb0d6e04e57ffb76f0a9edaa4b370

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ddeaa66-3e0c-43b0-8309-f1b81330386c.vbs

Filesize
733B

MD5
23ea46e09b183323f38aaa33b21826fd

SHA1
7eb7ea3821be1a65155455a4e1275f43987d5009

SHA256
e117fe32ff588c5903095ad480b17e59ec9dea8c0996c5b3f5aa5fbdfdee3ef7

SHA512
a4b6f6d1288bc285409444a3c820daea5edc0669095e82d86afc28970c508c44306a8310e74d2b587ac2c324b6eaf1f6e11a68296c46223714a566483433845c

Download Submit
C:\Users\Admin\AppData\Local\Temp\32de2547-d0fa-4662-9c5d-be7281744fa4.vbs

Filesize
509B

MD5
c3b60ad51b00f57dbc464f4835a5d174

SHA1
87d320acdd7f263b3b1d01b0f5bbb9671d900dd9

SHA256
0a53a7005a4bf8a736b2913f9f56dba4b83d5ae47f522aa8698f3f339e5718fb

SHA512
2901c8d2f7338208febdf85144a05972dfaf745d21c1ce74afa2478330b22158f5101e4ab9066437a68abcf2aa1ca25bb0e6a37570183b6965b1a4829b1f6af9

Download Submit
C:\Users\Admin\AppData\Local\Temp\3bc80c6a-ea9f-4b2f-afa3-eac90098ed5a.vbs

Filesize
733B

MD5
4906796b2a3fa6d42ad8994fbd444cdb

SHA1
48037e7704bd721dc1d33b8d8ec66967fdb86e82

SHA256
64cc013307830973290bc1b3490bf53883b828d00b8234a213af11a793cdf03e

SHA512
cbb66168c91e1287db69281986a6957a04d3520e1a9b8fe26d74dcd73d27f2abcb6ee5a37ce3071c0d15c0549841b66a1c83b674df289f17f13ff0c1ca9d20d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\3dd6ce52-ebb7-4a65-88c9-ca55c61011d8.vbs

Filesize
733B

MD5
0a12598f0144d1c4a8fb1f061d211178

SHA1
b83dc699dc8e25c61127d829d2d6f41f7beeecee

SHA256
80abe1d17887242c4df4b147c1099c66b8c425bc4934f7b502f7292bc91f0c19

SHA512
645cdb187301053966dfd47ba5ced2101623cd3cd28186c06c8b545270d16081a111fe1f9fa21b6d2e8021d8659d08950d1193acbdaca3cec189b3b341c08680

Download Submit
C:\Users\Admin\AppData\Local\Temp\7b9ccbb0-3930-4693-a352-da03cff9d580.vbs

Filesize
733B

MD5
c95de5ff4b9053a4ef85f9048ecf3331

SHA1
7b6f3d8ec221bab699ac211231823bfd3c505d50

SHA256
ef5236052b1886aa9f90172766b4431b323a2a4ae0c6e84e19ea2b333291b51c

SHA512
8fadfb393fa27863ccabc824bca3a5246b1c99d91a55eaeb6946a30d20a9a09bea3d1ee3d31265264ef47ed9dcef40de0419e94890e7dd30c25ff0d97ea349d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_414jy10t.mt3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp730F.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
memory/404-11-0x000000001C660000-0x000000001C672000-memory.dmp

Filesize
72KB

Download
memory/404-0-0x00007FFEF09F3000-0x00007FFEF09F5000-memory.dmp

Filesize
8KB

Download
memory/404-1-0x0000000000C20000-0x0000000001114000-memory.dmp

Filesize
5.0MB

Download
memory/404-16-0x000000001C6A0000-0x000000001C6A8000-memory.dmp

Filesize
32KB

Download
memory/404-220-0x00007FFEF09F0000-0x00007FFEF14B1000-memory.dmp

Filesize
10.8MB

Download
memory/404-17-0x000000001C6B0000-0x000000001C6B8000-memory.dmp

Filesize
32KB

Download
memory/404-18-0x000000001C7C0000-0x000000001C7CC000-memory.dmp

Filesize
48KB

Download
memory/404-13-0x000000001C670000-0x000000001C67A000-memory.dmp

Filesize
40KB

Download
memory/404-14-0x000000001C680000-0x000000001C68E000-memory.dmp

Filesize
56KB

Download
memory/404-15-0x000000001C690000-0x000000001C69E000-memory.dmp

Filesize
56KB

Download
memory/404-12-0x000000001CBA0000-0x000000001D0C8000-memory.dmp

Filesize
5.2MB

Download
memory/404-2-0x000000001BDA0000-0x000000001BECE000-memory.dmp

Filesize
1.2MB

Download
memory/404-10-0x000000001C600000-0x000000001C60A000-memory.dmp

Filesize
40KB

Download
memory/404-8-0x000000001C5D0000-0x000000001C5E6000-memory.dmp

Filesize
88KB

Download
memory/404-9-0x000000001C5F0000-0x000000001C600000-memory.dmp

Filesize
64KB

Download
memory/404-5-0x000000001C610000-0x000000001C660000-memory.dmp

Filesize
320KB

Download
memory/404-6-0x000000001BF40000-0x000000001BF48000-memory.dmp

Filesize
32KB

Download
memory/404-7-0x000000001C5C0000-0x000000001C5D0000-memory.dmp

Filesize
64KB

Download
memory/404-4-0x000000001C5A0000-0x000000001C5BC000-memory.dmp

Filesize
112KB

Download
memory/404-3-0x00007FFEF09F0000-0x00007FFEF14B1000-memory.dmp

Filesize
10.8MB

Download
memory/1588-63-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3308-120-0x000001F4F1AE0000-0x000001F4F1B02000-memory.dmp

Filesize
136KB

Download
memory/4204-512-0x000000001CF70000-0x000000001CF82000-memory.dmp

Filesize
72KB

Download