dcrat | 10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667c

Analysis

max time kernel
116s
max time network
117s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
Size

4.9MB
MD5

ef0701b3280100d833767d56eeb65460
SHA1

0305cf08f143c73c9eddbfaca6dda2409b90ab24
SHA256

10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667c
SHA512

06e3c60965e78441e9fe4b078bcf4a639cf92a1c83fcff64c4f22b4451b54d90550d7a4278aeef7081409cd2373d0056b9153f8515f83b997b0530c52d63cf96
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2440	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2440	schtasks.exe	30

UAC bypass 3 TTPs 27 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2076-3-0x000000001B710000-0x000000001B83E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1324	powershell.exe
2580	powershell.exe
2472	powershell.exe
1688	powershell.exe
3048	powershell.exe
1240	powershell.exe
2256	powershell.exe
1576	powershell.exe
940	powershell.exe
1520	powershell.exe
1896	powershell.exe
676	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
1728	dllhost.exe
860	dllhost.exe
2684	dllhost.exe
1928	dllhost.exe
1800	dllhost.exe
1552	dllhost.exe
3040	dllhost.exe
1236	dllhost.exe

Checks whether UAC is enabled 1 TTPs 18 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXCD9C.tmp	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File opened for modification	C:\Program Files\VideoLAN\RCXD1A5.tmp	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCXDA21.tmp	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File created	C:\Program Files (x86)\Google\Temp\7a0fd90576e088	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\56085415360792	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\dwm.exe	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\RCXDF04.tmp	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\dwm.exe	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wininit.exe	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File created	C:\Program Files (x86)\Windows Mail\56085415360792	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\5940a34987c991	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File opened for modification	C:\Program Files\VideoLAN\taskhost.exe	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\RCXD3A9.tmp	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File created	C:\Program Files\VideoLAN\taskhost.exe	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File created	C:\Program Files\VideoLAN\b75386f1303e64	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RCXD61A.tmp	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File created	C:\Program Files (x86)\Windows Mail\wininit.exe	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File created	C:\Program Files (x86)\Google\Temp\explorer.exe	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\6cb0b6c459d5d3	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\explorer.exe	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2680	schtasks.exe
2976	schtasks.exe
2448	schtasks.exe
2136	schtasks.exe
3024	schtasks.exe
2636	schtasks.exe
2780	schtasks.exe
2664	schtasks.exe
1040	schtasks.exe
2892	schtasks.exe
1976	schtasks.exe
2284	schtasks.exe
2512	schtasks.exe
1528	schtasks.exe
2984	schtasks.exe
2444	schtasks.exe
1260	schtasks.exe
1796	schtasks.exe
2720	schtasks.exe
2856	schtasks.exe
2740	schtasks.exe
1904	schtasks.exe
2228	schtasks.exe
2624	schtasks.exe
1712	schtasks.exe
1840	schtasks.exe
2904	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
940	powershell.exe
1520	powershell.exe
2580	powershell.exe
3048	powershell.exe
1240	powershell.exe
2472	powershell.exe
676	powershell.exe
1688	powershell.exe
1896	powershell.exe
1576	powershell.exe
2256	powershell.exe
1324	powershell.exe
1728	dllhost.exe
860	dllhost.exe
2684	dllhost.exe
1928	dllhost.exe
1800	dllhost.exe
1552	dllhost.exe
3040	dllhost.exe
1236	dllhost.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
Token: SeDebugPrivilege	940	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	676	powershell.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	1728	dllhost.exe
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeDebugPrivilege	860	dllhost.exe
Token: SeDebugPrivilege	2684	dllhost.exe
Token: SeDebugPrivilege	1928	dllhost.exe
Token: SeDebugPrivilege	1800	dllhost.exe
Token: SeDebugPrivilege	1552	dllhost.exe
Token: SeDebugPrivilege	3040	dllhost.exe
Token: SeDebugPrivilege	1236	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1324	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	59
PID 2076 wrote to memory of 1324	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	59
PID 2076 wrote to memory of 1324	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	59
PID 2076 wrote to memory of 1576	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	60
PID 2076 wrote to memory of 1576	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	60
PID 2076 wrote to memory of 1576	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	60
PID 2076 wrote to memory of 940	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	61
PID 2076 wrote to memory of 940	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	61
PID 2076 wrote to memory of 940	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	61
PID 2076 wrote to memory of 1520	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	62
PID 2076 wrote to memory of 1520	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	62
PID 2076 wrote to memory of 1520	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	62
PID 2076 wrote to memory of 1896	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	63
PID 2076 wrote to memory of 1896	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	63
PID 2076 wrote to memory of 1896	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	63
PID 2076 wrote to memory of 2580	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	64
PID 2076 wrote to memory of 2580	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	64
PID 2076 wrote to memory of 2580	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	64
PID 2076 wrote to memory of 676	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	65
PID 2076 wrote to memory of 676	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	65
PID 2076 wrote to memory of 676	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	65
PID 2076 wrote to memory of 3048	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	66
PID 2076 wrote to memory of 3048	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	66
PID 2076 wrote to memory of 3048	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	66
PID 2076 wrote to memory of 2472	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	67
PID 2076 wrote to memory of 2472	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	67
PID 2076 wrote to memory of 2472	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	67
PID 2076 wrote to memory of 1240	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	68
PID 2076 wrote to memory of 1240	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	68
PID 2076 wrote to memory of 1240	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	68
PID 2076 wrote to memory of 1688	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	69
PID 2076 wrote to memory of 1688	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	69
PID 2076 wrote to memory of 1688	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	69
PID 2076 wrote to memory of 2256	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	70
PID 2076 wrote to memory of 2256	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	70
PID 2076 wrote to memory of 2256	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	70
PID 2076 wrote to memory of 1728	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	83
PID 2076 wrote to memory of 1728	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	83
PID 2076 wrote to memory of 1728	2076	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe	83
PID 1728 wrote to memory of 2652	1728	dllhost.exe	84
PID 1728 wrote to memory of 2652	1728	dllhost.exe	84
PID 1728 wrote to memory of 2652	1728	dllhost.exe	84
PID 1728 wrote to memory of 2080	1728	dllhost.exe	85
PID 1728 wrote to memory of 2080	1728	dllhost.exe	85
PID 1728 wrote to memory of 2080	1728	dllhost.exe	85
PID 2652 wrote to memory of 860	2652	WScript.exe	86
PID 2652 wrote to memory of 860	2652	WScript.exe	86
PID 2652 wrote to memory of 860	2652	WScript.exe	86
PID 860 wrote to memory of 1672	860	dllhost.exe	87
PID 860 wrote to memory of 1672	860	dllhost.exe	87
PID 860 wrote to memory of 1672	860	dllhost.exe	87
PID 860 wrote to memory of 2156	860	dllhost.exe	88
PID 860 wrote to memory of 2156	860	dllhost.exe	88
PID 860 wrote to memory of 2156	860	dllhost.exe	88
PID 1672 wrote to memory of 2684	1672	WScript.exe	89
PID 1672 wrote to memory of 2684	1672	WScript.exe	89
PID 1672 wrote to memory of 2684	1672	WScript.exe	89
PID 2684 wrote to memory of 1992	2684	dllhost.exe	90
PID 2684 wrote to memory of 1992	2684	dllhost.exe	90
PID 2684 wrote to memory of 1992	2684	dllhost.exe	90
PID 2684 wrote to memory of 372	2684	dllhost.exe	91
PID 2684 wrote to memory of 372	2684	dllhost.exe	91
PID 2684 wrote to memory of 372	2684	dllhost.exe	91
PID 1992 wrote to memory of 1928	1992	WScript.exe	92

System policy modification 1 TTPs 27 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe
"C:\Users\Admin\AppData\Local\Temp\10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667cN.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
  "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1728
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be9343f6-9e52-451c-a06a-9222186696c5.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
      "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:860
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89c84283-556e-4026-97f3-b837b00e5ab2.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1672
      - C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2684
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c2ac3762-f239-42ac-9066-f06e95732b33.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1992
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1928
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f3af06f-0024-443e-8323-8411425f2889.vbs"
        9⤵
        
        PID:2052
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1800
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0400aa0-ce9d-4e20-bc47-d686d3a0cf0c.vbs"
        11⤵
        
        PID:1580
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7b87f21d-a6f0-4a0c-88e5-f0e68ddefa8e.vbs"
        13⤵
        
        PID:2320
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3040
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f36b105b-7b45-4a29-9719-1f7fd58a7203.vbs"
        15⤵
        
        PID:2888
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1236
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\01faa5da-cbca-461e-a610-fb7c3d448090.vbs"
        17⤵
        
        PID:1280
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8af5f66c-ac03-4a8f-9bfd-750ba9262dd2.vbs"
        17⤵
        
        PID:1984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce40f958-6f20-4bd5-af5d-e804ce020e48.vbs"
        15⤵
        
        PID:2268
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1f6a16fe-e64a-4f8d-afd8-64a9fd73d427.vbs"
        13⤵
        
        PID:2748
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6cca321f-3d3a-4f6d-a094-852958162958.vbs"
        11⤵
        
        PID:344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a07322d4-b0da-476d-bd0f-912ad574f943.vbs"
        9⤵
        
        PID:296
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a0b7b3fd-90c5-4d20-b14e-ad90a7b1a5ec.vbs"
        7⤵
        
        PID:372
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd6d71ee-7665-443f-9003-6175556626a0.vbs"
        5⤵
        
        PID:2156
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e735c40-88fe-404d-b6c1-d3ed60f37fa5.vbs"
    3⤵
    PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\Temp\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Temp\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe

Filesize
4.9MB

MD5
ef0701b3280100d833767d56eeb65460

SHA1
0305cf08f143c73c9eddbfaca6dda2409b90ab24

SHA256
10d8263ebee4d35df4d2b38ef43526a76e8074b74e713dcb62bded38d2bf667c

SHA512
06e3c60965e78441e9fe4b078bcf4a639cf92a1c83fcff64c4f22b4451b54d90550d7a4278aeef7081409cd2373d0056b9153f8515f83b997b0530c52d63cf96

Download Submit
C:\Users\Admin\AppData\Local\Temp\01faa5da-cbca-461e-a610-fb7c3d448090.vbs

Filesize
755B

MD5
bf4e6c5e069f97fc3cd31bc37728dd66

SHA1
1c9e75da679c745ff10f1a8125dd75ca1b5c8a56

SHA256
c7cb6e5c34df82cd8addc9e4e190db318755d70c9c395a4e7d8b42dec33a8ee6

SHA512
d1233a34361b6517c34e03c9537e756470a8620ceab2bf07c86974f24f26eaaee5f8c7fac3aa6c239397e11221d934e3b797ea4ba3df0b34f4fb2e86273adf7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2e735c40-88fe-404d-b6c1-d3ed60f37fa5.vbs

Filesize
531B

MD5
e3701552b871058dd2f9977c19eb3e58

SHA1
57ce6862d0bab75412479fdfac786dd39415dfa4

SHA256
a11bbc6e05fd2b7758de861b0ccd1ae4f37cf95450faae8ee632247899979aa9

SHA512
2a3c6ac09b02bc56efb19f3d01c605a96dfb80877a013e42717d4a90fc43be9804cfbae489f4bfa535f5279447e8fa398477dac16abfa01e7710dea2b9afc52a

Download Submit
C:\Users\Admin\AppData\Local\Temp\5f3af06f-0024-443e-8323-8411425f2889.vbs

Filesize
755B

MD5
bda792d49804dc70b81e4f9e7da8b57b

SHA1
9b92939688a56d31cb6e0291c2cb4ae0f95c9238

SHA256
4b33e14625ba3ce208693e5caa281dc20d014333ecc92ef23d4ffbbdaa726b5c

SHA512
9d6bc480649bdc910ba1a176da94822aafff85fa750a640a7647d31ba8856535f0cc5209a9f3da779ffdb0249f6c4e888568e6bd23c011166f60c5d4b935e690

Download Submit
C:\Users\Admin\AppData\Local\Temp\7b87f21d-a6f0-4a0c-88e5-f0e68ddefa8e.vbs

Filesize
755B

MD5
e331e867933fd3accb33b4fd59923638

SHA1
b9bdf2f325f4e900347eaed2dd2a28b56c3957b4

SHA256
144a08081563ba196c1f34331ffb0e2d4e22a7ad06d1885493c9e243241d4088

SHA512
ea7e3dfb6d6ed504359a76931e72782c1dae9d2a49f308d8ecd4a3fffc2d8f4eabbba07b4c2b34b2a8742378e5b0539496303534d84c77263025e865a71f684d

Download Submit
C:\Users\Admin\AppData\Local\Temp\89c84283-556e-4026-97f3-b837b00e5ab2.vbs

Filesize
754B

MD5
b2c86b8321694f951b3cd92ed35ea4f7

SHA1
a5ee66c0e8b46de8f5cbf123d3de9bca0421800d

SHA256
d48e26ae51c263287c8bee4021de94d5245bb341b2f6e51e27389841d894e98f

SHA512
d8a7224c822541c684448fd6134d0c0d2b8549a9c831bfa1b1253adc0fc7e6839fc1cb0432d938424683ce99dd2b4b682da2a3cc0a138135e05d459dd53abc6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\be9343f6-9e52-451c-a06a-9222186696c5.vbs

Filesize
755B

MD5
9bb034bdbf244c62f0f41609d7fc3091

SHA1
b95f0ff37ca641606a9c44a80da7065c1a3e289f

SHA256
19178f13b61a1eecb8cc34860f9da6956c7a4075d03257add6381090d79bb98c

SHA512
5afc9fd3dcfc376b64df1ba98d989d944d04de074b65714d34457e74480444c66c7b4ae73e3cf95c4a86aed30f05b9271e89da295cb1a06561080a427100a59e

Download Submit
C:\Users\Admin\AppData\Local\Temp\c0400aa0-ce9d-4e20-bc47-d686d3a0cf0c.vbs

Filesize
755B

MD5
5c81aa1108b9fa8a9f8fdd1767d6f424

SHA1
b8578a46d5374867739d8220127fdaf52b420912

SHA256
7ad89960dfd4597a513089447b5d15bc66918e7a1b5a424dafb5c2c3b0cfae1e

SHA512
1c8a592182b2507617af234290d1421c0f50936f9610dd6f4e084f3a89f85e9afb213c24da97494ead02d27ab010c65caeca215731747685e6cc7e3650ab4ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\c2ac3762-f239-42ac-9066-f06e95732b33.vbs

Filesize
755B

MD5
1cebbc975a4c38e7a34e7d2705c460b2

SHA1
4482e1dbd90b674068538aabd1f3ac585c4b27fd

SHA256
0293e2bb8003db00977dd5b830ea0e7ddb567b4a7a222539a00c633e765a500e

SHA512
27e60063b245dd9f235142a01c7acb721f6a5b6bb2ede9e8ecc9b280e4e2e9b56e96befe8ad43721a8688b064816859d9102688efce25bd5532748733c47512a

Download Submit
C:\Users\Admin\AppData\Local\Temp\f36b105b-7b45-4a29-9719-1f7fd58a7203.vbs

Filesize
755B

MD5
b4f416546ccef9beadf7b6431a896c45

SHA1
bbe7ec98c2f491525a65718c0215be2106d862d8

SHA256
b8855f05b8780d21b451ce4c76b45307d91b04a1e569f5d7b51d34a5bda41240

SHA512
54929496c81f01ac198d8257b4eb4b79b29cd71705ef321235d876e6e6e9c9dc9d20518078ed82b82ab1d6a803b7531d49434fa065f3663a3ac0bde69bb42ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF42E.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
d818e6163f5a3d0fa5ac4915e8011269

SHA1
7cae5b2fc220a95e5c924612c82e23a3c17f3471

SHA256
7cc691e38ecc2be249d67accd4c0965321defb8f0078d44bf5d33dcfaedc27f6

SHA512
47050e58ae92d2fc6d6a9498749885bda3c99f9d87dabf25cb50a2a26263771c834c30328be7671dfa5bd46d2c92ac84ecca6b3a8cedf86cce5634a823f20e0f

Download Submit
memory/940-126-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/1236-271-0x0000000000CD0000-0x0000000000CE2000-memory.dmp

Filesize
72KB

Download
memory/1520-122-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/1552-242-0x00000000012A0000-0x0000000001794000-memory.dmp

Filesize
5.0MB

Download
memory/1728-105-0x00000000012E0000-0x00000000017D4000-memory.dmp

Filesize
5.0MB

Download
memory/1800-227-0x00000000001C0000-0x00000000006B4000-memory.dmp

Filesize
5.0MB

Download
memory/1928-211-0x0000000001120000-0x0000000001614000-memory.dmp

Filesize
5.0MB

Download
memory/1928-212-0x0000000000C20000-0x0000000000C32000-memory.dmp

Filesize
72KB

Download
memory/2076-0-0x000007FEF50F3000-0x000007FEF50F4000-memory.dmp

Filesize
4KB

Download
memory/2076-1-0x0000000001340000-0x0000000001834000-memory.dmp

Filesize
5.0MB

Download
memory/2076-9-0x0000000000AB0000-0x0000000000ABA000-memory.dmp

Filesize
40KB

Download
memory/2076-13-0x0000000000AF0000-0x0000000000AFE000-memory.dmp

Filesize
56KB

Download
memory/2076-12-0x0000000000AE0000-0x0000000000AEE000-memory.dmp

Filesize
56KB

Download
memory/2076-11-0x0000000000AD0000-0x0000000000ADA000-memory.dmp

Filesize
40KB

Download
memory/2076-10-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Filesize
72KB

Download
memory/2076-14-0x0000000000B00000-0x0000000000B08000-memory.dmp

Filesize
32KB

Download
memory/2076-15-0x0000000000B10000-0x0000000000B18000-memory.dmp

Filesize
32KB

Download
memory/2076-147-0x000007FEF50F0000-0x000007FEF5ADC000-memory.dmp

Filesize
9.9MB

Download
memory/2076-8-0x0000000000460000-0x0000000000470000-memory.dmp

Filesize
64KB

Download
memory/2076-16-0x0000000000B20000-0x0000000000B2C000-memory.dmp

Filesize
48KB

Download
memory/2076-7-0x0000000000A90000-0x0000000000AA6000-memory.dmp

Filesize
88KB

Download
memory/2076-6-0x0000000000450000-0x0000000000460000-memory.dmp

Filesize
64KB

Download
memory/2076-5-0x0000000000440000-0x0000000000448000-memory.dmp

Filesize
32KB

Download
memory/2076-4-0x0000000000420000-0x000000000043C000-memory.dmp

Filesize
112KB

Download
memory/2076-3-0x000000001B710000-0x000000001B83E000-memory.dmp

Filesize
1.2MB

Download
memory/2076-2-0x000007FEF50F0000-0x000007FEF5ADC000-memory.dmp

Filesize
9.9MB

Download
memory/2684-196-0x0000000000130000-0x0000000000624000-memory.dmp

Filesize
5.0MB

Download