dcrat | d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Size

4.9MB
MD5

d38526128c39b9be768f702680a8345b
SHA1

b315d0373e8689816eb8b320b1a37b646ca090fc
SHA256

d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869
SHA512

98a0dc113ac897acf98722343a0c333e28b98baf58c2931773998cd1ea0b3d5c65964fa7b94c6f3769f1756b0cea366bd9e70af2ae2350c28c630d4a2f9f2dd1
SSDEEP

49152:Ll5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx80:8

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	1496	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	1496	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	1496	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	1496	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	1496	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	1496	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	1496	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	1496	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	1496	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	1496	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	1496	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	1496	schtasks.exe	30

UAC bypass 3 TTPs 30 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2220-2-0x000000001BBB0000-0x000000001BCDE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2292	powershell.exe
2420	powershell.exe
2192	powershell.exe
2280	powershell.exe
1828	powershell.exe
2600	powershell.exe
1184	powershell.exe
2448	powershell.exe
2240	powershell.exe
1812	powershell.exe
2052	powershell.exe
1068	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
2616	lsass.exe
1952	lsass.exe
2548	lsass.exe
2176	lsass.exe
1812	lsass.exe
2256	lsass.exe
1556	lsass.exe
2192	lsass.exe
2500	lsass.exe

Checks whether UAC is enabled 1 TTPs 20 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\6203df4a6bafc7	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\RCX2B2B.tmp	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2740	schtasks.exe
2520	schtasks.exe
2168	schtasks.exe
2816	schtasks.exe
2728	schtasks.exe
2468	schtasks.exe
2688	schtasks.exe
2676	schtasks.exe
2936	schtasks.exe
2824	schtasks.exe
2868	schtasks.exe
2828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
2448	powershell.exe
2280	powershell.exe
2240	powershell.exe
1068	powershell.exe
2600	powershell.exe
2420	powershell.exe
1828	powershell.exe
1812	powershell.exe
1184	powershell.exe
2292	powershell.exe
2052	powershell.exe
2192	powershell.exe
2616	lsass.exe
1952	lsass.exe
2548	lsass.exe
2176	lsass.exe
1812	lsass.exe
2256	lsass.exe
1556	lsass.exe
2192	lsass.exe
2500	lsass.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	1828	powershell.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeDebugPrivilege	1184	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	2616	lsass.exe
Token: SeDebugPrivilege	1952	lsass.exe
Token: SeDebugPrivilege	2548	lsass.exe
Token: SeDebugPrivilege	2176	lsass.exe
Token: SeDebugPrivilege	1812	lsass.exe
Token: SeDebugPrivilege	2256	lsass.exe
Token: SeDebugPrivilege	1556	lsass.exe
Token: SeDebugPrivilege	2192	lsass.exe
Token: SeDebugPrivilege	2500	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2280	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	43
PID 2220 wrote to memory of 2280	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	43
PID 2220 wrote to memory of 2280	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	43
PID 2220 wrote to memory of 2192	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	44
PID 2220 wrote to memory of 2192	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	44
PID 2220 wrote to memory of 2192	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	44
PID 2220 wrote to memory of 1812	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	45
PID 2220 wrote to memory of 1812	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	45
PID 2220 wrote to memory of 1812	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	45
PID 2220 wrote to memory of 2240	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	47
PID 2220 wrote to memory of 2240	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	47
PID 2220 wrote to memory of 2240	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	47
PID 2220 wrote to memory of 2448	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	48
PID 2220 wrote to memory of 2448	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	48
PID 2220 wrote to memory of 2448	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	48
PID 2220 wrote to memory of 2420	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	51
PID 2220 wrote to memory of 2420	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	51
PID 2220 wrote to memory of 2420	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	51
PID 2220 wrote to memory of 2292	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	52
PID 2220 wrote to memory of 2292	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	52
PID 2220 wrote to memory of 2292	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	52
PID 2220 wrote to memory of 2600	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	53
PID 2220 wrote to memory of 2600	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	53
PID 2220 wrote to memory of 2600	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	53
PID 2220 wrote to memory of 1184	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	55
PID 2220 wrote to memory of 1184	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	55
PID 2220 wrote to memory of 1184	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	55
PID 2220 wrote to memory of 1068	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	56
PID 2220 wrote to memory of 1068	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	56
PID 2220 wrote to memory of 1068	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	56
PID 2220 wrote to memory of 1828	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	59
PID 2220 wrote to memory of 1828	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	59
PID 2220 wrote to memory of 1828	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	59
PID 2220 wrote to memory of 2052	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	60
PID 2220 wrote to memory of 2052	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	60
PID 2220 wrote to memory of 2052	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	60
PID 2220 wrote to memory of 2616	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	67
PID 2220 wrote to memory of 2616	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	67
PID 2220 wrote to memory of 2616	2220	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	67
PID 2616 wrote to memory of 2468	2616	lsass.exe	68
PID 2616 wrote to memory of 2468	2616	lsass.exe	68
PID 2616 wrote to memory of 2468	2616	lsass.exe	68
PID 2616 wrote to memory of 2828	2616	lsass.exe	69
PID 2616 wrote to memory of 2828	2616	lsass.exe	69
PID 2616 wrote to memory of 2828	2616	lsass.exe	69
PID 2468 wrote to memory of 1952	2468	WScript.exe	70
PID 2468 wrote to memory of 1952	2468	WScript.exe	70
PID 2468 wrote to memory of 1952	2468	WScript.exe	70
PID 1952 wrote to memory of 2564	1952	lsass.exe	71
PID 1952 wrote to memory of 2564	1952	lsass.exe	71
PID 1952 wrote to memory of 2564	1952	lsass.exe	71
PID 1952 wrote to memory of 1672	1952	lsass.exe	72
PID 1952 wrote to memory of 1672	1952	lsass.exe	72
PID 1952 wrote to memory of 1672	1952	lsass.exe	72
PID 2564 wrote to memory of 2548	2564	WScript.exe	73
PID 2564 wrote to memory of 2548	2564	WScript.exe	73
PID 2564 wrote to memory of 2548	2564	WScript.exe	73
PID 2548 wrote to memory of 2268	2548	lsass.exe	74
PID 2548 wrote to memory of 2268	2548	lsass.exe	74
PID 2548 wrote to memory of 2268	2548	lsass.exe	74
PID 2548 wrote to memory of 1528	2548	lsass.exe	75
PID 2548 wrote to memory of 1528	2548	lsass.exe	75
PID 2548 wrote to memory of 1528	2548	lsass.exe	75
PID 2268 wrote to memory of 2176	2268	WScript.exe	76

System policy modification 1 TTPs 30 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
"C:\Users\Admin\AppData\Local\Temp\d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe
  "C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2616
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\49750c2a-fefc-49bb-9d1d-64867912fc19.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe
      "C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1952
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd4cd876-cb25-43d0-a0b8-a60c2de7c0da.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2564
      - C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2efe464-0970-49b9-82e8-ce35abb185e0.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2268
        
        C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2176
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b18817de-23e4-4daf-b98f-ea1fba2c15cc.vbs"
        9⤵
        
        PID:1288
        
        C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1812
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\35ec2e60-782d-4d85-92cf-807e4d52b3c5.vbs"
        11⤵
        
        PID:2896
        
        C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2256
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6dd34672-cf96-4b55-8a74-64bc4aec64dc.vbs"
        13⤵
        
        PID:2112
        
        C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1556
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5b19cde-9acf-4e05-accc-71a329fb43b8.vbs"
        15⤵
        
        PID:2348
        
        C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2192
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\03ea7405-b758-4fdb-98bb-cbad71e12a98.vbs"
        17⤵
        
        PID:2904
        
        C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe"
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2500
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac468295-153f-4020-b596-de6a0439fa3b.vbs"
        19⤵
        
        PID:2072
        
        C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe"
        20⤵
        
        PID:1816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32691971-6ecd-4fc0-9d2a-5c4bf9f628ab.vbs"
        19⤵
        
        PID:2804
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bfca312b-be49-41a2-82d3-4c49963cba24.vbs"
        17⤵
        
        PID:2452
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3937689a-f033-4be4-81e8-577dbb0f3119.vbs"
        15⤵
        
        PID:1592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4d2b9ff6-b9fd-4ec4-aef9-d0a7ec4f6af2.vbs"
        13⤵
        
        PID:2388
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7cfba00c-e21a-4ac4-b716-95b131001afb.vbs"
        11⤵
        
        PID:2668
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\14918a71-4e25-43d6-b015-68d0dbc300de.vbs"
        9⤵
        
        PID:1836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e05b1998-2944-4c3a-9fa6-e85027f02066.vbs"
        7⤵
        
        PID:1528
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b600e7d8-133f-4836-8310-d69f6f7102b0.vbs"
        5⤵
        
        PID:1672
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b846bf1-f4e4-4d05-9b0b-2f6850dc304f.vbs"
    3⤵
    PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe

Filesize
4.9MB

MD5
d38526128c39b9be768f702680a8345b

SHA1
b315d0373e8689816eb8b320b1a37b646ca090fc

SHA256
d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869

SHA512
98a0dc113ac897acf98722343a0c333e28b98baf58c2931773998cd1ea0b3d5c65964fa7b94c6f3769f1756b0cea366bd9e70af2ae2350c28c630d4a2f9f2dd1

Download Submit
C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe

Filesize
3.7MB

MD5
a87a50ca59e60411af341df7ded791b4

SHA1
46fd98c137063070b97746e0ac13482116bc740d

SHA256
02c4f93462e811c313de73aa470189e078d1ee66bab3dcc83c7d374e329bbfa7

SHA512
bd89a15becb56a24904fccf08c135ade78be9804c098a717ccd213d4398e086be828e910777393160e5697f704e06a4162624d57fd65d1a5efc4ac41f1aa2b9a

Download Submit
C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe

Filesize
4.9MB

MD5
417b0b7081d0d8915953740ad27a531d

SHA1
5e2f44d2d10c60b62dad6355ec77f5f5c1fac40c

SHA256
187163657c2401cff5d70f0dd894ccc78bac45f44efd687871b933d2f2dc5d14

SHA512
6eb2d04af4e83bce7f784a2294923e4a586f23791ae4c33346a955efd783d2674126a7acfcae48cf2ea595f88ce2e9b985e614d461bd7ecce56ff00cf68f57af

Download Submit
C:\Users\Admin\AppData\Local\Temp\03ea7405-b758-4fdb-98bb-cbad71e12a98.vbs

Filesize
724B

MD5
30fb5852cd804c37a4f24c9d1bf4f339

SHA1
df979c4a241ee91510eca3211e4bd41fb8147b19

SHA256
1cb82fe71636922c44bcfa6cea6ab188a0f40a0f5374fcb6d3bd1606fe9c88d3

SHA512
8a883cc4144655d2237a4dc93a77ac78e537bfe7b12882b99070a7c6db2eb83b3f140b6f64564603363627199e90caa392876083a91b69a0df721588824d0d64

Download Submit
C:\Users\Admin\AppData\Local\Temp\35ec2e60-782d-4d85-92cf-807e4d52b3c5.vbs

Filesize
724B

MD5
15811c74b8e54a2ae29fe3fbd27856da

SHA1
fe8fb286e2b8d11d7b34eab362a222b419a0d5fc

SHA256
0855ab444454cf2c6ab2533a8fe1384d2ad3c839636dff37b7f42813d83d2e4b

SHA512
78779e318063c4c037d7a672ebd34889d1f76b67d31b7df415dc69472de00949af18b8e9280247d6fdb2b0ea041916deb838ca2b0258514a3df1e898bdb2808f

Download Submit
C:\Users\Admin\AppData\Local\Temp\49750c2a-fefc-49bb-9d1d-64867912fc19.vbs

Filesize
724B

MD5
651724f3e9514b2f1c8de96dcb102e2f

SHA1
fcb0ec70e450978fed7f7d7826390e782cd411bd

SHA256
baacf7658356f2f8d7dd3aa14e69c5b294bad20e7af2e749812a6a5f97c3b0bd

SHA512
021b3df87ad9d17ae72da6e3eb5a5c24071ca0fd618ebd234f6d1cf34ce8d62d52b0efb07a952a922963e99908318e553fb11d53b6ec406398eb0e2dbaeb7f3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\6dd34672-cf96-4b55-8a74-64bc4aec64dc.vbs

Filesize
724B

MD5
d8cb00316f9c5774c24083bf4c82c441

SHA1
9bb8d30f3b2832c2ebd672db2328627780f16ca1

SHA256
ccc4ac775e1f9810adc7c7028d228ff3c46a4594c629ef6c5cfc9d3184bd28df

SHA512
c5f0c9ec748b6218a71483a83518399bc5d992f4e4223600524b60f9aa9831aab00bcc29a3ef8c641d099a13dd019f388e653e8f92a9b00b14e533140febacfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\8b846bf1-f4e4-4d05-9b0b-2f6850dc304f.vbs

Filesize
500B

MD5
5f274e8f3fbc7438d9242073369eb9ba

SHA1
d1ff33a0a9882d623f3c0dd1eef5bc5cb1618058

SHA256
9b31078274b01effe03170540e36434d7b3625442f7d21f9032b2df6c07be609

SHA512
6e60a97fe14d713a001831a3affcb0e2e126d2e198fbd5f154585868f5498256635b8d58f74baa0a5a0409976b79ac443b78e73eb88eb79195803fa9aaa65397

Download Submit
C:\Users\Admin\AppData\Local\Temp\ac468295-153f-4020-b596-de6a0439fa3b.vbs

Filesize
724B

MD5
455cede41f586937a5fa833d09769977

SHA1
2f13cc57898e1a756acddc5d48d2e4837b9992dc

SHA256
d6cd1b80a8db5f99f900d2433b9a7fcd5fe2eea3837c3c326f3c239647735676

SHA512
0665e2aa3b4ad1e2f4a2ffdcb17163eb7d7f654d43eb5fee6e64456b0a397996810b2d7f6b8119ea274bc1a094fe39876e324a3605df154cc66104854a1b5ba4

Download Submit
C:\Users\Admin\AppData\Local\Temp\b18817de-23e4-4daf-b98f-ea1fba2c15cc.vbs

Filesize
724B

MD5
41c0b0877a35e27ba91cf6bb3f3778a4

SHA1
dd542273612259f04b37dd28a48e6d4f64fb739a

SHA256
ef9592b8b7389b7a04f9658eec759f28fa2400a4b1983c48a5c8393cfda23eff

SHA512
3a688cb9dbd34d75bd4ea6724b6f3744df77a850f1609d0dee887174c382fd0252ef03b0777cd04ac9293dea1d5d5c51efbb70062624ffeaa2f384a1ba82a8db

Download Submit
C:\Users\Admin\AppData\Local\Temp\bd4cd876-cb25-43d0-a0b8-a60c2de7c0da.vbs

Filesize
724B

MD5
969bdf690b63a662a04937e42e7e6b9c

SHA1
f19db1abce16a643ea8e89b02a59957f0252b08c

SHA256
e25f876cfd2009e8eb08fa986ddc0c50266e6456df4d4dd442a58ac92c5f2cc1

SHA512
8ece5c6e58972aaced1e9c6ba6a5020a626eb17137a5bebde4e660828b47856943588021aafcc07fc60931f8ffb85a09a775d6334a5c647dbe2af1acc1f1675c

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5b3963bbf66df5e1cbde1527123bc653ef1faee.exe

Filesize
4.9MB

MD5
c3085e508938fb6a52ebd94c5bf8b97b

SHA1
6f1467ad6ac4ebceb78f5d571fb6d8bde5013436

SHA256
23afc1971bf71fed6c00666167d398a06fc3bc399da168b7bd9510899db48d06

SHA512
5d336f6d346dbbde900de59d7b6b9091db2d37ad5ca804c7b3116d1fe50f161bb7ec5f074b9167446cff803b7e0a2137df131a02b7828e56265c35480b7781c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5b19cde-9acf-4e05-accc-71a329fb43b8.vbs

Filesize
724B

MD5
f963f34d2ebddd311a61c0be5dec381b

SHA1
f9573715e02077218d2532baa153e073cd9e3663

SHA256
bdad5c1e06aa864763f34fdb6838f77f51388ef9047cc72bd68467989485d4c7

SHA512
4123425fb9648e84e42b0cedcf2bdae009b059493205be387b49c6959d0a0c2d28d70861d888e65ea467f62d46c69e3d325858c6dcb44fd35d57625ffc3c624c

Download Submit
C:\Users\Admin\AppData\Local\Temp\f2efe464-0970-49b9-82e8-ce35abb185e0.vbs

Filesize
724B

MD5
6869dbaa5e94617e9f1f4a108c7d3f1c

SHA1
081afaa78101d0684262abf0ecf13af640e1e283

SHA256
5de200aab8deb2221d691057397b448f9105aa5471b3f5386ebd10f4a3aac07f

SHA512
1f80f1e74adaeac04be088041543ec882cc0ae3a772dd0829decde7393716707f895fb5fa9b0221d3ece224da6a65197d14320930cfebe9994426c63be030819

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3FED.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K4B1OAYRF1QRVH011CQF.temp

Filesize
7KB

MD5
622bb8d44f6364fc3d43a6a321866ccb

SHA1
28980d0e03b851369e1048fe8e5dba6551b4bffb

SHA256
2a622d809e8fe5c39742a02e91c450696d4bf3492abed59349ae32910c2586d7

SHA512
d15f57f3b23e03d1d5d047a95937dab4ccf944958fd80fd09b1c93c0ea9be19b2af0f085e52a501800af8a39bc7e6b0bb892344f8ff9d8a872a3d54d46b1c079

Download Submit
memory/1556-208-0x0000000000390000-0x0000000000884000-memory.dmp

Filesize
5.0MB

Download
memory/1556-209-0x0000000000A30000-0x0000000000A42000-memory.dmp

Filesize
72KB

Download
memory/1952-137-0x00000000013E0000-0x00000000018D4000-memory.dmp

Filesize
5.0MB

Download
memory/2192-224-0x00000000009D0000-0x0000000000EC4000-memory.dmp

Filesize
5.0MB

Download
memory/2220-10-0x0000000000D30000-0x0000000000D42000-memory.dmp

Filesize
72KB

Download
memory/2220-0-0x000007FEF6103000-0x000007FEF6104000-memory.dmp

Filesize
4KB

Download
memory/2220-1-0x0000000000D60000-0x0000000001254000-memory.dmp

Filesize
5.0MB

Download
memory/2220-123-0x000007FEF6100000-0x000007FEF6AEC000-memory.dmp

Filesize
9.9MB

Download
memory/2220-2-0x000000001BBB0000-0x000000001BCDE000-memory.dmp

Filesize
1.2MB

Download
memory/2220-16-0x0000000002690000-0x000000000269C000-memory.dmp

Filesize
48KB

Download
memory/2220-15-0x0000000002680000-0x0000000002688000-memory.dmp

Filesize
32KB

Download
memory/2220-14-0x0000000002670000-0x0000000002678000-memory.dmp

Filesize
32KB

Download
memory/2220-13-0x0000000002660000-0x000000000266E000-memory.dmp

Filesize
56KB

Download
memory/2220-12-0x0000000000D50000-0x0000000000D5E000-memory.dmp

Filesize
56KB

Download
memory/2220-11-0x0000000000D40000-0x0000000000D4A000-memory.dmp

Filesize
40KB

Download
memory/2220-3-0x000007FEF6100000-0x000007FEF6AEC000-memory.dmp

Filesize
9.9MB

Download
memory/2220-9-0x0000000000D20000-0x0000000000D2A000-memory.dmp

Filesize
40KB

Download
memory/2220-7-0x0000000000450000-0x0000000000466000-memory.dmp

Filesize
88KB

Download
memory/2220-8-0x0000000000470000-0x0000000000480000-memory.dmp

Filesize
64KB

Download
memory/2220-6-0x0000000000440000-0x0000000000450000-memory.dmp

Filesize
64KB

Download
memory/2220-5-0x0000000000430000-0x0000000000438000-memory.dmp

Filesize
32KB

Download
memory/2220-4-0x0000000000390000-0x00000000003AC000-memory.dmp

Filesize
112KB

Download
memory/2448-73-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2448-74-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2500-239-0x0000000000B30000-0x0000000001024000-memory.dmp

Filesize
5.0MB

Download
memory/2500-240-0x0000000000B20000-0x0000000000B32000-memory.dmp

Filesize
72KB

Download
memory/2616-122-0x0000000000BD0000-0x00000000010C4000-memory.dmp

Filesize
5.0MB

Download