colibri | fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25

Analysis

max time kernel
116s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16/12/2024, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Size 4.9MB
Sample241216-ry949atmfq
SHA256 fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25
MD5 ebc81db3d71154bc617356d897e0d450
SHA1 d8a2a478437abd6f69685903700b1e9e5a30c6ce
SHA512 33dd0b853085ff2256384c34b44652b9815a34920eea200a3859ac7f626e9795036bdcac6b2de8cf4c03d433431ea5121676f84312a7a90f34fdeb6a8c54ea72
SSDEEP 49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri

DcRat 38 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		4428	schtasks.exe
		4272	schtasks.exe
		556	schtasks.exe
		4636	schtasks.exe
		3988	schtasks.exe
		392	schtasks.exe
		3424	schtasks.exe
		548	schtasks.exe
		4512	schtasks.exe
		2580	schtasks.exe
		2980	schtasks.exe
		2916	schtasks.exe
		3996	schtasks.exe
		2280	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
		392	schtasks.exe
		4152	schtasks.exe
		4652	schtasks.exe
		1944	schtasks.exe
		2244	schtasks.exe
		5068	schtasks.exe
		1684	schtasks.exe
		1360	schtasks.exe
		3900	schtasks.exe
		4620	schtasks.exe
		1336	schtasks.exe
File created	C:\Windows\Provisioning\cc11b995f2a76d		fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
		4708	schtasks.exe
		3120	schtasks.exe
		4528	schtasks.exe
		2604	schtasks.exe
		2212	schtasks.exe
		2936	schtasks.exe
		4956	schtasks.exe
		1876	schtasks.exe
		3344	schtasks.exe
		832	schtasks.exe
		4684	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	392	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	392	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4152	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3424	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3344	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3996	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	3404	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	3404	schtasks.exe	82

UAC bypass 3 TTPs 42 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4880-2-0x000000001B990000-0x000000001BABE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2032	powershell.exe
4960	powershell.exe
2012	powershell.exe
2232	powershell.exe
1816	powershell.exe
2808	powershell.exe
1908	powershell.exe
1676	powershell.exe
952	powershell.exe
2804	powershell.exe
940	powershell.exe
2324	powershell.exe
4824	powershell.exe
4864	powershell.exe
3692	powershell.exe
3680	powershell.exe
4012	powershell.exe
4832	powershell.exe
2180	powershell.exe
3012	powershell.exe
2656	powershell.exe
432	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Registry.exe

Executes dropped EXE 36 IoCs

pid	Process
3976	tmp888C.tmp.exe
760	tmp888C.tmp.exe
2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
368	tmpAC4D.tmp.exe
3840	tmpAC4D.tmp.exe
1832	Registry.exe
640	tmpCAD2.tmp.exe
3560	tmpCAD2.tmp.exe
584	Registry.exe
804	tmpEA41.tmp.exe
548	tmpEA41.tmp.exe
4280	Registry.exe
4768	tmp1B63.tmp.exe
4824	tmp1B63.tmp.exe
64	tmp1B63.tmp.exe
3420	Registry.exe
2960	tmp4C27.tmp.exe
4512	tmp4C27.tmp.exe
1996	Registry.exe
1448	tmp6983.tmp.exe
1400	tmp6983.tmp.exe
2224	Registry.exe
4616	Registry.exe
1272	Registry.exe
4424	tmpD358.tmp.exe
3800	tmpD358.tmp.exe
3684	Registry.exe
1684	tmpEF3D.tmp.exe
1448	tmpEF3D.tmp.exe
3076	Registry.exe
4360	tmpC4B.tmp.exe
3756	tmpC4B.tmp.exe
3948	Registry.exe
432	tmp285E.tmp.exe
2608	tmp285E.tmp.exe
4340	Registry.exe

Checks whether UAC is enabled 1 TTPs 28 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 3976 set thread context of 760	3976	tmp888C.tmp.exe	115
PID 368 set thread context of 3840	368	tmpAC4D.tmp.exe	154
PID 640 set thread context of 3560	640	tmpCAD2.tmp.exe	184
PID 804 set thread context of 548	804	tmpEA41.tmp.exe	190
PID 4824 set thread context of 64	4824	tmp1B63.tmp.exe	199
PID 2960 set thread context of 4512	2960	tmp4C27.tmp.exe	205
PID 1448 set thread context of 1400	1448	tmp6983.tmp.exe	211
PID 4424 set thread context of 3800	4424	tmpD358.tmp.exe	223
PID 1684 set thread context of 1448	1684	tmpEF3D.tmp.exe	229
PID 4360 set thread context of 3756	4360	tmpC4B.tmp.exe	235
PID 432 set thread context of 2608	432	tmp285E.tmp.exe	241

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Mail\6cb0b6c459d5d3	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File created	C:\Program Files (x86)\WindowsPowerShell\fontdrvhost.exe	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File created	C:\Program Files (x86)\WindowsPowerShell\5b884080fd4f94	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File created	C:\Program Files\Microsoft Office\5b884080fd4f94	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File opened for modification	C:\Program Files\Windows Mail\dwm.exe	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File opened for modification	C:\Program Files\Microsoft Office\fontdrvhost.exe	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\winlogon.exe	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File created	C:\Program Files\Windows Mail\dwm.exe	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File created	C:\Program Files\Microsoft Office\fontdrvhost.exe	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\fontdrvhost.exe	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Downloaded Program Files\services.exe	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File created	C:\Windows\Downloaded Program Files\c5b4cb5e9653cc	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File opened for modification	C:\Windows\it-IT\winlogon.exe	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File created	C:\Windows\Provisioning\winlogon.exe	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File created	C:\Windows\Provisioning\cc11b995f2a76d	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File opened for modification	C:\Windows\security\EDP\Logs\Registry.exe	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File created	C:\Windows\it-IT\winlogon.exe	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File opened for modification	C:\Windows\Downloaded Program Files\services.exe	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File opened for modification	C:\Windows\Provisioning\winlogon.exe	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File opened for modification	C:\Windows\Provisioning\RCX8379.tmp	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File created	C:\Windows\it-IT\cc11b995f2a76d	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File created	C:\Windows\security\EDP\Logs\Registry.exe	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File created	C:\Windows\security\EDP\Logs\ee2ad38f3d4382	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
File created	C:\Windows\servicing\es-ES\upfc.exe	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpEF3D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp888C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpAC4D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpEA41.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1B63.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpD358.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC4B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp285E.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpCAD2.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1B63.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4C27.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp6983.tmp.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Registry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3120	schtasks.exe
548	schtasks.exe
4428	schtasks.exe
392	schtasks.exe
2212	schtasks.exe
1684	schtasks.exe
4708	schtasks.exe
3900	schtasks.exe
3988	schtasks.exe
392	schtasks.exe
4512	schtasks.exe
3424	schtasks.exe
4956	schtasks.exe
3344	schtasks.exe
2604	schtasks.exe
2916	schtasks.exe
5068	schtasks.exe
2244	schtasks.exe
1336	schtasks.exe
1944	schtasks.exe
1876	schtasks.exe
4152	schtasks.exe
1360	schtasks.exe
2980	schtasks.exe
4528	schtasks.exe
3996	schtasks.exe
4652	schtasks.exe
2280	schtasks.exe
4272	schtasks.exe
2936	schtasks.exe
2580	schtasks.exe
832	schtasks.exe
4636	schtasks.exe
556	schtasks.exe
4684	schtasks.exe
4620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
2180	powershell.exe
2180	powershell.exe
2012	powershell.exe
2012	powershell.exe
1676	powershell.exe
1676	powershell.exe
4864	powershell.exe
4864	powershell.exe
1908	powershell.exe
1908	powershell.exe
4960	powershell.exe
4960	powershell.exe
3692	powershell.exe
3692	powershell.exe
3012	powershell.exe
3012	powershell.exe
4824	powershell.exe
4824	powershell.exe
2032	powershell.exe
2032	powershell.exe
4960	powershell.exe
4824	powershell.exe
2032	powershell.exe
2324	powershell.exe
2324	powershell.exe
2180	powershell.exe
4864	powershell.exe
2012	powershell.exe
1676	powershell.exe
3692	powershell.exe
3012	powershell.exe
1908	powershell.exe
2324	powershell.exe
2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
2656	powershell.exe
2656	powershell.exe
432	powershell.exe
432	powershell.exe
2804	powershell.exe
2804	powershell.exe
1816	powershell.exe
1816	powershell.exe
2232	powershell.exe
2232	powershell.exe
952	powershell.exe
952	powershell.exe
940	powershell.exe
940	powershell.exe
2808	powershell.exe
2808	powershell.exe
3680	powershell.exe
3680	powershell.exe
4832	powershell.exe
4832	powershell.exe
4012	powershell.exe
4012	powershell.exe
3680	powershell.exe
432	powershell.exe
2656	powershell.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	432	powershell.exe
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeDebugPrivilege	952	powershell.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	940	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	3680	powershell.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	1832	Registry.exe
Token: SeDebugPrivilege	584	Registry.exe
Token: SeDebugPrivilege	4280	Registry.exe
Token: SeDebugPrivilege	3420	Registry.exe
Token: SeDebugPrivilege	1996	Registry.exe
Token: SeDebugPrivilege	2224	Registry.exe
Token: SeDebugPrivilege	4616	Registry.exe
Token: SeDebugPrivilege	1272	Registry.exe
Token: SeDebugPrivilege	3684	Registry.exe
Token: SeDebugPrivilege	3076	Registry.exe
Token: SeDebugPrivilege	3948	Registry.exe
Token: SeDebugPrivilege	4340	Registry.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 2324	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	89
PID 4880 wrote to memory of 2324	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	89
PID 4880 wrote to memory of 1908	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	90
PID 4880 wrote to memory of 1908	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	90
PID 4880 wrote to memory of 2032	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	91
PID 4880 wrote to memory of 2032	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	91
PID 4880 wrote to memory of 2180	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	92
PID 4880 wrote to memory of 2180	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	92
PID 4880 wrote to memory of 4960	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	93
PID 4880 wrote to memory of 4960	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	93
PID 4880 wrote to memory of 2012	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	94
PID 4880 wrote to memory of 2012	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	94
PID 4880 wrote to memory of 4824	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	95
PID 4880 wrote to memory of 4824	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	95
PID 4880 wrote to memory of 3012	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	96
PID 4880 wrote to memory of 3012	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	96
PID 4880 wrote to memory of 1676	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	97
PID 4880 wrote to memory of 1676	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	97
PID 4880 wrote to memory of 4864	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	98
PID 4880 wrote to memory of 4864	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	98
PID 4880 wrote to memory of 3692	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	99
PID 4880 wrote to memory of 3692	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	99
PID 4880 wrote to memory of 3784	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	110
PID 4880 wrote to memory of 3784	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	110
PID 4880 wrote to memory of 3976	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	111
PID 4880 wrote to memory of 3976	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	111
PID 4880 wrote to memory of 3976	4880	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	111
PID 3976 wrote to memory of 760	3976	tmp888C.tmp.exe	115
PID 3976 wrote to memory of 760	3976	tmp888C.tmp.exe	115
PID 3976 wrote to memory of 760	3976	tmp888C.tmp.exe	115
PID 3976 wrote to memory of 760	3976	tmp888C.tmp.exe	115
PID 3976 wrote to memory of 760	3976	tmp888C.tmp.exe	115
PID 3976 wrote to memory of 760	3976	tmp888C.tmp.exe	115
PID 3976 wrote to memory of 760	3976	tmp888C.tmp.exe	115
PID 3784 wrote to memory of 4996	3784	cmd.exe	116
PID 3784 wrote to memory of 4996	3784	cmd.exe	116
PID 3784 wrote to memory of 2280	3784	cmd.exe	120
PID 3784 wrote to memory of 2280	3784	cmd.exe	120
PID 2280 wrote to memory of 368	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	152
PID 2280 wrote to memory of 368	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	152
PID 2280 wrote to memory of 368	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	152
PID 368 wrote to memory of 3840	368	tmpAC4D.tmp.exe	154
PID 368 wrote to memory of 3840	368	tmpAC4D.tmp.exe	154
PID 368 wrote to memory of 3840	368	tmpAC4D.tmp.exe	154
PID 368 wrote to memory of 3840	368	tmpAC4D.tmp.exe	154
PID 368 wrote to memory of 3840	368	tmpAC4D.tmp.exe	154
PID 368 wrote to memory of 3840	368	tmpAC4D.tmp.exe	154
PID 368 wrote to memory of 3840	368	tmpAC4D.tmp.exe	154
PID 2280 wrote to memory of 2656	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	157
PID 2280 wrote to memory of 2656	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	157
PID 2280 wrote to memory of 432	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	158
PID 2280 wrote to memory of 432	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	158
PID 2280 wrote to memory of 2232	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	159
PID 2280 wrote to memory of 2232	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	159
PID 2280 wrote to memory of 3680	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	160
PID 2280 wrote to memory of 3680	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	160
PID 2280 wrote to memory of 1816	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	161
PID 2280 wrote to memory of 1816	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	161
PID 2280 wrote to memory of 952	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	162
PID 2280 wrote to memory of 952	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	162
PID 2280 wrote to memory of 4012	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	163
PID 2280 wrote to memory of 4012	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	163
PID 2280 wrote to memory of 2808	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	164
PID 2280 wrote to memory of 2808	2280	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe	164

System policy modification 1 TTPs 42 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
"C:\Users\Admin\AppData\Local\Temp\fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe"
1⤵
- DcRat
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GEujOzFY9Y.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4996
- - C:\Users\Admin\AppData\Local\Temp\fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe
    "C:\Users\Admin\AppData\Local\Temp\fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\tmpAC4D.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpAC4D.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:368
    - - C:\Users\Admin\AppData\Local\Temp\tmpAC4D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpAC4D.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:3840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4832
  - - C:\Windows\security\EDP\Logs\Registry.exe
      "C:\Windows\security\EDP\Logs\Registry.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:1832
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5dcdbc43-a5e2-4531-8892-35614abac38c.vbs"
        5⤵
        
        PID:3076
      - C:\Windows\security\EDP\Logs\Registry.exe
        
        C:\Windows\security\EDP\Logs\Registry.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4c974ad8-f69a-4fd5-b3b2-012f2ac59ae3.vbs"
        7⤵
        
        PID:4064
        
        C:\Windows\security\EDP\Logs\Registry.exe
        
        C:\Windows\security\EDP\Logs\Registry.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4280
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae00a318-e0ac-4fdf-a770-361a2f06ceb3.vbs"
        9⤵
        
        PID:3004
        
        C:\Windows\security\EDP\Logs\Registry.exe
        
        C:\Windows\security\EDP\Logs\Registry.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3420
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31046b26-3d53-4b9d-b1f8-563cee78b6c3.vbs"
        11⤵
        
        PID:3108
        
        C:\Windows\security\EDP\Logs\Registry.exe
        
        C:\Windows\security\EDP\Logs\Registry.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e651f8a4-5a64-4220-bd59-f31f0c8cba20.vbs"
        13⤵
        
        PID:4536
        
        C:\Windows\security\EDP\Logs\Registry.exe
        
        C:\Windows\security\EDP\Logs\Registry.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2224
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ca30a68a-5a0b-4fba-8d5c-af88797f004e.vbs"
        15⤵
        
        PID:1332
        
        C:\Windows\security\EDP\Logs\Registry.exe
        
        C:\Windows\security\EDP\Logs\Registry.exe
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4616
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\09b05da3-9e4b-4287-b1a0-75e83d63abc4.vbs"
        17⤵
        
        PID:2764
        
        C:\Windows\security\EDP\Logs\Registry.exe
        
        C:\Windows\security\EDP\Logs\Registry.exe
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\82e87709-f7a4-4eff-9c95-db211c52be88.vbs"
        19⤵
        
        PID:4372
        
        C:\Windows\security\EDP\Logs\Registry.exe
        
        C:\Windows\security\EDP\Logs\Registry.exe
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3684
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b016df35-9bdc-490b-9a0c-6e03094bfd53.vbs"
        21⤵
        
        PID:2212
        
        C:\Windows\security\EDP\Logs\Registry.exe
        
        C:\Windows\security\EDP\Logs\Registry.exe
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3076
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8cc02b8-934b-464b-944c-1c783dc2a90e.vbs"
        23⤵
        
        PID:2444
        
        C:\Windows\security\EDP\Logs\Registry.exe
        
        C:\Windows\security\EDP\Logs\Registry.exe
        24⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db2ce271-75f0-41d9-bf0a-8a792e8a901a.vbs"
        25⤵
        
        PID:3668
        
        C:\Windows\security\EDP\Logs\Registry.exe
        
        C:\Windows\security\EDP\Logs\Registry.exe
        26⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0cf37b8c-02e3-43ee-9ecb-35ded381f79e.vbs"
        27⤵
        
        PID:4764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f441d74b-471d-456d-926a-611bcd5061d3.vbs"
        27⤵
        
        PID:4220
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1f95bfc0-fea3-4a34-9d55-8da1ddd76b73.vbs"
        25⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\tmp285E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp285E.tmp.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\tmp285E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp285E.tmp.exe"
        26⤵
        Executes dropped EXE
        
        PID:2608
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e78dbce-6bfd-4829-b6e6-120b7254ad08.vbs"
        23⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\tmpC4B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC4B.tmp.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\tmpC4B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC4B.tmp.exe"
        24⤵
        Executes dropped EXE
        
        PID:3756
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a99110c-2f66-44f1-a780-2a715c1377ba.vbs"
        21⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\tmpEF3D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpEF3D.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\tmpEF3D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpEF3D.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:1448
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d987da6-4c5a-4df7-8b88-1c550f185010.vbs"
        19⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\tmpD358.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD358.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\tmpD358.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD358.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:3800
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d6e9067c-1c04-48e2-ba9e-04b2c4239ec6.vbs"
        17⤵
        
        PID:2004
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e7dad774-a6a1-4420-baca-707b2ffa9de4.vbs"
        15⤵
        
        PID:2720
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72523398-f0c1-41b7-a5c7-03f7ec93c813.vbs"
        13⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\tmp6983.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp6983.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\tmp6983.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp6983.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:1400
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a3d2975-6f44-428b-8668-29e013b65ac5.vbs"
        11⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\tmp4C27.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4C27.tmp.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\tmp4C27.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4C27.tmp.exe"
        12⤵
        Executes dropped EXE
        
        PID:4512
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32f416ac-4788-468d-be5f-a49b3a76031b.vbs"
        9⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\tmp1B63.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1B63.tmp.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\tmp1B63.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1B63.tmp.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\tmp1B63.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1B63.tmp.exe"
        11⤵
        Executes dropped EXE
        
        PID:64
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\69e835a1-3ace-43be-9be9-e066ced7893c.vbs"
        7⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\tmpEA41.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpEA41.tmp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\tmpEA41.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpEA41.tmp.exe"
        8⤵
        Executes dropped EXE
        
        PID:548
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\14307c1e-9028-443e-a959-7a03f079d551.vbs"
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\tmpCAD2.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCAD2.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:640
      - C:\Users\Admin\AppData\Local\Temp\tmpCAD2.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCAD2.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:3560
- C:\Users\Admin\AppData\Local\Temp\tmp888C.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp888C.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Users\Admin\AppData\Local\Temp\tmp888C.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp888C.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Windows\Provisioning\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Provisioning\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Windows\Provisioning\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Windows\security\EDP\Logs\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\security\EDP\Logs\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Windows\security\EDP\Logs\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\WindowsPowerShell\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\WindowsPowerShell\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Windows\Downloaded Program Files\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\Downloaded Program Files\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Windows\it-IT\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\it-IT\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Windows\it-IT\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Downloads\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Downloads\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Downloads\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25Nf" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25Nf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Registry.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log
Size 1KB
SHA256 414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
MD5 4a667f150a4d1d02f53a9f24d89d53d1
SHA1 306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA512 4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
MD5 SHA1 SHA512

Submit Download

fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fba69a368d73d2a2232258d465d825481048ec5cab01cffc0241dd6a37f12d25N.exe.log
Size 1KB
SHA256 eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a
MD5 bbb951a34b516b66451218a3ec3b0ae1
SHA1 7393835a2476ae655916e0a9687eeaba3ee876e9
SHA512 63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download