dcrat | d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790b

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
Size

1.5MB
MD5

80c10ba32141f1c07e1408cc48a8e4c0
SHA1

a3f2f9c3516e508b2eaf1324a51cfed32e45132e
SHA256

d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790b
SHA512

04f2cc1bfd44d836a906173dcf013ea7a199c4f24be65f6e8308a70a9fba9515511bd8fefcbddf4fa4ed924b4ad5e3923926358495cd6607e63fb7fdfa43ff04
SSDEEP

24576:0NNUtQhWhtqDfDXQdy+N+gfQqRsgFlDRluQ70eJiVbWpR:EzhWhCXQFN+0IEuQgyiVK

Score

10^/10

dcrat evasion execution infostealer persistence rat trojan

Malware Config

Signatures

DcRat 4 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
		2604	schtasks.exe
		2140	schtasks.exe
		3052	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\winlogon.exe\", \"C:\\Windows\\winhlp32\\explorer.exe\", \"C:\\Windows\\System32\\dmdskres\\wininit.exe\""	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\winlogon.exe\""	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\winlogon.exe\", \"C:\\Windows\\winhlp32\\explorer.exe\""	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	1584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	1584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	1584	schtasks.exe	30

UAC bypass 3 TTPs 33 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2096	powershell.exe
1260	powershell.exe
1484	powershell.exe
2860	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe

Executes dropped EXE 10 IoCs

pid	Process
600	winlogon.exe
1612	winlogon.exe
1504	winlogon.exe
1060	winlogon.exe
2348	winlogon.exe
1264	winlogon.exe
1984	winlogon.exe
1580	winlogon.exe
2732	winlogon.exe
444	winlogon.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\System32\\dmdskres\\wininit.exe\""	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\System32\\dmdskres\\wininit.exe\""	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\winlogon.exe\""	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\winlogon.exe\""	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\winhlp32\\explorer.exe\""	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\winhlp32\\explorer.exe\""	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe

Checks whether UAC is enabled 1 TTPs 22 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\dmdskres\RCX232D.tmp	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
File opened for modification	C:\Windows\System32\dmdskres\wininit.exe	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
File created	C:\Windows\System32\dmdskres\wininit.exe	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
File created	C:\Windows\System32\dmdskres\56085415360792	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\winhlp32\explorer.exe	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
File created	C:\Windows\winhlp32\7a0fd90576e088	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
File opened for modification	C:\Windows\winhlp32\RCX2129.tmp	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
File opened for modification	C:\Windows\winhlp32\explorer.exe	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2140	schtasks.exe
3052	schtasks.exe
2604	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
1260	powershell.exe
2860	powershell.exe
2096	powershell.exe
1484	powershell.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
600	winlogon.exe
1612	winlogon.exe
1612	winlogon.exe
1612	winlogon.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	600	winlogon.exe
Token: SeDebugPrivilege	1612	winlogon.exe
Token: SeDebugPrivilege	1504	winlogon.exe
Token: SeDebugPrivilege	1060	winlogon.exe
Token: SeDebugPrivilege	2348	winlogon.exe
Token: SeDebugPrivilege	1264	winlogon.exe
Token: SeDebugPrivilege	1984	winlogon.exe
Token: SeDebugPrivilege	1580	winlogon.exe
Token: SeDebugPrivilege	2732	winlogon.exe
Token: SeDebugPrivilege	444	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2096	2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe	34
PID 2660 wrote to memory of 2096	2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe	34
PID 2660 wrote to memory of 2096	2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe	34
PID 2660 wrote to memory of 1260	2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe	35
PID 2660 wrote to memory of 1260	2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe	35
PID 2660 wrote to memory of 1260	2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe	35
PID 2660 wrote to memory of 1484	2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe	36
PID 2660 wrote to memory of 1484	2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe	36
PID 2660 wrote to memory of 1484	2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe	36
PID 2660 wrote to memory of 2860	2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe	37
PID 2660 wrote to memory of 2860	2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe	37
PID 2660 wrote to memory of 2860	2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe	37
PID 2660 wrote to memory of 600	2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe	42
PID 2660 wrote to memory of 600	2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe	42
PID 2660 wrote to memory of 600	2660	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe	42
PID 600 wrote to memory of 976	600	winlogon.exe	43
PID 600 wrote to memory of 976	600	winlogon.exe	43
PID 600 wrote to memory of 976	600	winlogon.exe	43
PID 600 wrote to memory of 792	600	winlogon.exe	44
PID 600 wrote to memory of 792	600	winlogon.exe	44
PID 600 wrote to memory of 792	600	winlogon.exe	44
PID 976 wrote to memory of 1612	976	WScript.exe	45
PID 976 wrote to memory of 1612	976	WScript.exe	45
PID 976 wrote to memory of 1612	976	WScript.exe	45
PID 1612 wrote to memory of 3032	1612	winlogon.exe	46
PID 1612 wrote to memory of 3032	1612	winlogon.exe	46
PID 1612 wrote to memory of 3032	1612	winlogon.exe	46
PID 1612 wrote to memory of 2152	1612	winlogon.exe	47
PID 1612 wrote to memory of 2152	1612	winlogon.exe	47
PID 1612 wrote to memory of 2152	1612	winlogon.exe	47
PID 3032 wrote to memory of 1504	3032	WScript.exe	48
PID 3032 wrote to memory of 1504	3032	WScript.exe	48
PID 3032 wrote to memory of 1504	3032	WScript.exe	48
PID 1504 wrote to memory of 2568	1504	winlogon.exe	49
PID 1504 wrote to memory of 2568	1504	winlogon.exe	49
PID 1504 wrote to memory of 2568	1504	winlogon.exe	49
PID 1504 wrote to memory of 1496	1504	winlogon.exe	50
PID 1504 wrote to memory of 1496	1504	winlogon.exe	50
PID 1504 wrote to memory of 1496	1504	winlogon.exe	50
PID 2568 wrote to memory of 1060	2568	WScript.exe	51
PID 2568 wrote to memory of 1060	2568	WScript.exe	51
PID 2568 wrote to memory of 1060	2568	WScript.exe	51
PID 1060 wrote to memory of 2232	1060	winlogon.exe	52
PID 1060 wrote to memory of 2232	1060	winlogon.exe	52
PID 1060 wrote to memory of 2232	1060	winlogon.exe	52
PID 1060 wrote to memory of 808	1060	winlogon.exe	53
PID 1060 wrote to memory of 808	1060	winlogon.exe	53
PID 1060 wrote to memory of 808	1060	winlogon.exe	53
PID 2232 wrote to memory of 2348	2232	WScript.exe	54
PID 2232 wrote to memory of 2348	2232	WScript.exe	54
PID 2232 wrote to memory of 2348	2232	WScript.exe	54
PID 2348 wrote to memory of 2156	2348	winlogon.exe	55
PID 2348 wrote to memory of 2156	2348	winlogon.exe	55
PID 2348 wrote to memory of 2156	2348	winlogon.exe	55
PID 2348 wrote to memory of 2012	2348	winlogon.exe	56
PID 2348 wrote to memory of 2012	2348	winlogon.exe	56
PID 2348 wrote to memory of 2012	2348	winlogon.exe	56
PID 2156 wrote to memory of 1264	2156	WScript.exe	57
PID 2156 wrote to memory of 1264	2156	WScript.exe	57
PID 2156 wrote to memory of 1264	2156	WScript.exe	57
PID 1264 wrote to memory of 1000	1264	winlogon.exe	58
PID 1264 wrote to memory of 1000	1264	winlogon.exe	58
PID 1264 wrote to memory of 1000	1264	winlogon.exe	58
PID 1264 wrote to memory of 1160	1264	winlogon.exe	59

System policy modification 1 TTPs 33 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe
"C:\Users\Admin\AppData\Local\Temp\d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790bN.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\winhlp32\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\dmdskres\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
  "C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:600
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04cbea1d-c050-4493-9a13-d7ba0f0c5f4d.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
      C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1612
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef80bb69-6a86-4141-838f-3e55ba22333e.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3032
      - C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
        
        C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1504
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\65521e8b-add7-4990-bcf1-eb4b50ca1b68.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
        
        C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\505eb185-224d-4192-8540-b94a0bfb1240.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
        
        C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2348
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\93cbcf91-1f9a-46af-b522-b138e38c4534.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
        
        C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1264
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a4fee96-08a4-4388-9d71-1e93a0aadeb0.vbs"
        13⤵
        
        PID:1000
        
        C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
        
        C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b26cec84-425b-4e04-875e-ac4ce101e0e0.vbs"
        15⤵
        
        PID:700
        
        C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
        
        C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1580
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e819247b-a71d-4357-b96d-eb37c4fefca7.vbs"
        17⤵
        
        PID:2248
        
        C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
        
        C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a68ab85f-591f-48ae-af23-ddecd22ee43a.vbs"
        19⤵
        
        PID:1616
        
        C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
        
        C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79ecb19e-5ca0-4a95-a6e8-025cf0b3ab79.vbs"
        21⤵
        
        PID:1648
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\508518f0-4cc2-457a-a8c4-7279ac2c50ed.vbs"
        21⤵
        
        PID:1812
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8a3b6d5-77f1-484a-99ae-c93665694f5c.vbs"
        19⤵
        
        PID:776
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8ad8f2e2-4b41-4169-ba98-4e905d66477d.vbs"
        17⤵
        
        PID:2956
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b067c470-b3da-44a1-becc-185a155fc584.vbs"
        15⤵
        
        PID:924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72e35411-701c-41d9-9a88-44ec2f50d459.vbs"
        13⤵
        
        PID:1160
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02af76d6-1320-4e69-afc0-cf93e36165fd.vbs"
        11⤵
        
        PID:2012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36f7e21a-fdc1-4057-aed2-c06ddbf3a169.vbs"
        9⤵
        
        PID:808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\719c683b-0b30-449c-ad00-c32260b09103.vbs"
        7⤵
        
        PID:1496
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1db2e3f4-916f-44d9-a0e7-174f5d22b9a0.vbs"
        5⤵
        
        PID:2152
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ab0f2c37-f367-45c7-9d0c-c9094dd4a1ac.vbs"
    3⤵
    PID:792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\winhlp32\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\dmdskres\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe

Filesize
1.5MB

MD5
80c10ba32141f1c07e1408cc48a8e4c0

SHA1
a3f2f9c3516e508b2eaf1324a51cfed32e45132e

SHA256
d23424c0067404957e3e18f85081a3341bee4165b461f2dcded51fadff7d790b

SHA512
04f2cc1bfd44d836a906173dcf013ea7a199c4f24be65f6e8308a70a9fba9515511bd8fefcbddf4fa4ed924b4ad5e3923926358495cd6607e63fb7fdfa43ff04

Download Submit
C:\Users\Admin\AppData\Local\Temp\04cbea1d-c050-4493-9a13-d7ba0f0c5f4d.vbs

Filesize
736B

MD5
39bbe993ecf8585d29f7bf22ed6cae77

SHA1
374c33fa82abf4e5c7c0195d9cef89f30c0e58e8

SHA256
e49a90628a274c00906cac22897e876a26f81a707214644745f4aa527b614b79

SHA512
2d5d71a3adea69a3040ee7eeac1883f0ee710311dc7ede1400db61c7e7cfe9c1e6cfb0c2cc2e372b5aed8088e6076479fb18b8a3282d3c6b1d6c6540cd085e46

Download Submit
C:\Users\Admin\AppData\Local\Temp\1a4fee96-08a4-4388-9d71-1e93a0aadeb0.vbs

Filesize
737B

MD5
34ec5e9b0a3b34e9dde4017fa8a6ae90

SHA1
16e5f8b291a0a520d0e24cd3266b05619f689d3e

SHA256
a7f41b4cf8bd1cf5d96bee96cfc78a09e6ce87e56912647b733c23a7c56c3035

SHA512
25b7de5ef0060a5f7bb317fdbb6fbf2406305f009a9ea51fbbe59e41f044aeba166575d286dcf8a06c6641490a83ca27197e41f8da96e5f69048c780927df943

Download Submit
C:\Users\Admin\AppData\Local\Temp\505eb185-224d-4192-8540-b94a0bfb1240.vbs

Filesize
737B

MD5
c2e9295f54e6337f19573decc0418665

SHA1
2b6cf97f7f063f8c1761a0a900a92e1926763bd7

SHA256
44d67892f7a920837aa471fa0f89aa558b2bbaf6b94b5c56ecec67222663f265

SHA512
b6f587248528989a48d17548e11c450ff4fc549ee91f017add097e85d5b11aecd47481d1944b24d7dcaaf26bdde6a91e9f00f12b45fe74f26d770bc80ac8a9d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\65521e8b-add7-4990-bcf1-eb4b50ca1b68.vbs

Filesize
737B

MD5
b5dfcb8044cdf3ac6d68fa8dd248596d

SHA1
c6e0bb7624cae0982654a29afdcc215190ca064a

SHA256
0aa096022fc2dde19b77ed9d1e3a1246c268275ec933310316c864335388fb82

SHA512
5e1df4835c2c0c878d921bcbdc89b54898f724e97237a95f08a0a9dc4a59718efe65423069f23c40bbfbca923d5efd141f093e3915d71fa239c2179835dc3b5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\79ecb19e-5ca0-4a95-a6e8-025cf0b3ab79.vbs

Filesize
736B

MD5
8ad52b616924b6e5f1dd7485cd7ab8e0

SHA1
0174478723514e3dd65295cd37ea8747d5e91c61

SHA256
b59ee4050fcafd8fadb57ff7f88fc2b678f9e9da81b42c9ad1c2df76cd419e2d

SHA512
aabcf74b9a247a33c35d7a6337f3ac4f014bef6c5e7cf87faca2fbee0f4a0bb56d2f619a5539be336f369a4d348eaa9dd93c365712327ff10e2f91f182061e64

Download Submit
C:\Users\Admin\AppData\Local\Temp\93cbcf91-1f9a-46af-b522-b138e38c4534.vbs

Filesize
737B

MD5
88fa4167d88fdd9e38fbfb4051105a14

SHA1
5a318a93e2332d7ec2a1866583c9741befece877

SHA256
73419c42ec3dbec26c3bb8a8470c3a094592bb598af52666bc883e7229eaf1c8

SHA512
efd23cc0d862a1ea2fb0e2f8ed994c4af127e0c7c8f2aae4d60d9cc568ac92afc44acd1d2db090ea0505258807afb7709b6688e3b506c7187ec89ffcb0be79a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\a68ab85f-591f-48ae-af23-ddecd22ee43a.vbs

Filesize
737B

MD5
f12f0227ca900016944457c54a54602c

SHA1
889ba349e1478c717b6b72b3b0d0dc7ca9b1e967

SHA256
d91924d9c7e28cd316a58a87674cff7954bac485e0a066af2ccb7f138737fe64

SHA512
8a1a0e37b23cb11ec830762fa1c3ff99696f140c1aad50dab62772e95b5c507b8eedbea145eb0ab4e02bd2972727a44836cf974c6a67f18a3de72c0b1526f0b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ab0f2c37-f367-45c7-9d0c-c9094dd4a1ac.vbs

Filesize
513B

MD5
a39f6735678ee82cf6dc06286dc7c94a

SHA1
e4f74a986dbc1d7e69bc7df994eb0c58756ada2f

SHA256
b294ac7c822de9350e8354263d0b0685310a03bf7895daff88cc6b33a3361d45

SHA512
8c3dfc2eab92273d4888c9d5d4f68482f87b4a60efdfeef8ba306e282af57b6dc818523de86b7331a6b6cb47ce2502520d93056e33e58141e785dba917698919

Download Submit
C:\Users\Admin\AppData\Local\Temp\b26cec84-425b-4e04-875e-ac4ce101e0e0.vbs

Filesize
737B

MD5
1eb514e09050bee889eab7d5e088038d

SHA1
df6702258eb8beb337576b2678263cb99bd045a8

SHA256
5809194e7c92b74c4d16519ac6f959cff47c078e342b42762c2573a0ad363612

SHA512
b0bb193a528107c2eadc48e7e873ff40970f96b74ef37308212d8c4fd2096e0e866f29cc6db7c86392b18306ac6b7c00f43a7a03063626c690352524fc827541

Download Submit
C:\Users\Admin\AppData\Local\Temp\e819247b-a71d-4357-b96d-eb37c4fefca7.vbs

Filesize
737B

MD5
cdb9c491981f07655f513eeed1102f59

SHA1
27c6167da614ae1ebf0543d381176cd23dd463a0

SHA256
31da122d0b86b522eea1ffd86157f4501a83aafd97bdeeaef6709b9c3ccddd83

SHA512
fe4bdda9f4c08b7c66facf857c3d46331398e202da2cf29b6bda63b67bf291a2b3f0357a1e65d0f1ff3ed0f44d1d676106735e9bddf42ef7df7147cf9d758fb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ef80bb69-6a86-4141-838f-3e55ba22333e.vbs

Filesize
737B

MD5
12394764073cc85fa61a887b7e0d2992

SHA1
9c6ed242a6eaf852f80c847167075dc6dbb25358

SHA256
7394dacd03b6fcbafcf04e90dd62db731596d01bbb1cad5a1a584652388c808b

SHA512
b93e506f9e3ed3d8d17aff9956d5bdb1e599493e0fde141a649f4dbacc5a0d68f6f28e33f869e1e33a9601edb1e60046df1726e8d35a16257ad5506fc402eaba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2cc19451f6302d0a43bacee8ebbe473e

SHA1
df50d5c9324449a98100805e7ea3a7ef9db2444d

SHA256
ea7517508d17b3c6988146a413b7e29727fca62ab54122f1a7beb8dd2d6ca74f

SHA512
0f8d2bcb63427fc7bf13d5f7802935c7a685f906101f8a7a7f3dcda3ca9e8ab67f6a84d4e2e8d7ba19a9d69b1e0afa71f9d9b57d5a4e79d006086cce502db9a0

Download Submit
memory/444-187-0x0000000000190000-0x000000000030E000-memory.dmp

Filesize
1.5MB

Download
memory/600-70-0x0000000000C80000-0x0000000000DFE000-memory.dmp

Filesize
1.5MB

Download
memory/1060-118-0x00000000003B0000-0x000000000052E000-memory.dmp

Filesize
1.5MB

Download
memory/1260-72-0x0000000001DC0000-0x0000000001DC8000-memory.dmp

Filesize
32KB

Download
memory/1260-71-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/1264-142-0x0000000000B30000-0x0000000000CAE000-memory.dmp

Filesize
1.5MB

Download
memory/1504-106-0x0000000000020000-0x000000000019E000-memory.dmp

Filesize
1.5MB

Download
memory/1612-94-0x0000000000360000-0x0000000000372000-memory.dmp

Filesize
72KB

Download
memory/1612-93-0x0000000001030000-0x00000000011AE000-memory.dmp

Filesize
1.5MB

Download
memory/2348-130-0x0000000000340000-0x00000000004BE000-memory.dmp

Filesize
1.5MB

Download
memory/2660-21-0x0000000000B80000-0x0000000000B88000-memory.dmp

Filesize
32KB

Download
memory/2660-3-0x0000000000140000-0x0000000000148000-memory.dmp

Filesize
32KB

Download
memory/2660-16-0x0000000000B40000-0x0000000000B48000-memory.dmp

Filesize
32KB

Download
memory/2660-15-0x0000000000B30000-0x0000000000B3A000-memory.dmp

Filesize
40KB

Download
memory/2660-82-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

Filesize
9.9MB

Download
memory/2660-14-0x0000000000B20000-0x0000000000B2C000-memory.dmp

Filesize
48KB

Download
memory/2660-13-0x0000000000B10000-0x0000000000B1A000-memory.dmp

Filesize
40KB

Download
memory/2660-0-0x000007FEF54C3000-0x000007FEF54C4000-memory.dmp

Filesize
4KB

Download
memory/2660-18-0x0000000000B60000-0x0000000000B68000-memory.dmp

Filesize
32KB

Download
memory/2660-12-0x0000000000B00000-0x0000000000B08000-memory.dmp

Filesize
32KB

Download
memory/2660-1-0x0000000000E00000-0x0000000000F7E000-memory.dmp

Filesize
1.5MB

Download
memory/2660-24-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

Filesize
9.9MB

Download
memory/2660-8-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/2660-9-0x00000000003B0000-0x00000000003BC000-memory.dmp

Filesize
48KB

Download
memory/2660-10-0x00000000003C0000-0x00000000003D0000-memory.dmp

Filesize
64KB

Download
memory/2660-39-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

Filesize
9.9MB

Download
memory/2660-7-0x0000000000180000-0x000000000018C000-memory.dmp

Filesize
48KB

Download
memory/2660-20-0x0000000000B70000-0x0000000000B7C000-memory.dmp

Filesize
48KB

Download
memory/2660-6-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/2660-5-0x0000000000160000-0x000000000016C000-memory.dmp

Filesize
48KB

Download
memory/2660-4-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/2660-11-0x0000000000450000-0x0000000000460000-memory.dmp

Filesize
64KB

Download
memory/2660-2-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

Filesize
9.9MB

Download
memory/2660-17-0x0000000000B50000-0x0000000000B5C000-memory.dmp

Filesize
48KB

Download