dcrat | 7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-12-2024 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe
Size

4.9MB
MD5

84c3e32da77210eb29452816fe3d4830
SHA1

073ef3fe85c0ec68ad52c88c76644a8c2a4c0411
SHA256

7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81
SHA512

d094bdaa1fe2c53ee7e955be38e295fbb09c7138865fa095aa2441d4b6faa49aa3773746e9f1e9e35677f7bb84dfec24e8525bdd774fdbe2e8b1867445294692
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2928	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2928	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2928	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2928	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	2928	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2928	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	2928	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	2928	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2928	schtasks.exe	30

UAC bypass 3 TTPs 33 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2800-3-0x000000001B510000-0x000000001B63E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2352	powershell.exe
2420	powershell.exe
2952	powershell.exe
1280	powershell.exe
2028	powershell.exe
2824	powershell.exe
1420	powershell.exe
2152	powershell.exe
2844	powershell.exe
1724	powershell.exe
2696	powershell.exe
2960	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2768	csrss.exe
2972	csrss.exe
1892	csrss.exe
3032	csrss.exe
2696	csrss.exe
2192	csrss.exe
2088	csrss.exe
1544	csrss.exe
1304	csrss.exe
2808	csrss.exe

Checks whether UAC is enabled 1 TTPs 22 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2932	schtasks.exe
2620	schtasks.exe
2680	schtasks.exe
2172	schtasks.exe
2676	schtasks.exe
2628	schtasks.exe
2856	schtasks.exe
2068	schtasks.exe
824	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe
2028	powershell.exe
2352	powershell.exe
2844	powershell.exe
2960	powershell.exe
2952	powershell.exe
1724	powershell.exe
2152	powershell.exe
2696	powershell.exe
2420	powershell.exe
2824	powershell.exe
1280	powershell.exe
1420	powershell.exe
2768	csrss.exe
2972	csrss.exe
1892	csrss.exe
3032	csrss.exe
2696	csrss.exe
2192	csrss.exe
2088	csrss.exe
1544	csrss.exe
1304	csrss.exe
2808	csrss.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	1280	powershell.exe
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeDebugPrivilege	2768	csrss.exe
Token: SeDebugPrivilege	2972	csrss.exe
Token: SeDebugPrivilege	1892	csrss.exe
Token: SeDebugPrivilege	3032	csrss.exe
Token: SeDebugPrivilege	2696	csrss.exe
Token: SeDebugPrivilege	2192	csrss.exe
Token: SeDebugPrivilege	2088	csrss.exe
Token: SeDebugPrivilege	1544	csrss.exe
Token: SeDebugPrivilege	1304	csrss.exe
Token: SeDebugPrivilege	2808	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 1280	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	40
PID 2800 wrote to memory of 1280	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	40
PID 2800 wrote to memory of 1280	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	40
PID 2800 wrote to memory of 1724	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	41
PID 2800 wrote to memory of 1724	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	41
PID 2800 wrote to memory of 1724	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	41
PID 2800 wrote to memory of 2696	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	43
PID 2800 wrote to memory of 2696	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	43
PID 2800 wrote to memory of 2696	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	43
PID 2800 wrote to memory of 2028	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	44
PID 2800 wrote to memory of 2028	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	44
PID 2800 wrote to memory of 2028	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	44
PID 2800 wrote to memory of 2844	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	45
PID 2800 wrote to memory of 2844	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	45
PID 2800 wrote to memory of 2844	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	45
PID 2800 wrote to memory of 2952	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	46
PID 2800 wrote to memory of 2952	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	46
PID 2800 wrote to memory of 2952	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	46
PID 2800 wrote to memory of 2960	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	47
PID 2800 wrote to memory of 2960	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	47
PID 2800 wrote to memory of 2960	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	47
PID 2800 wrote to memory of 2152	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	49
PID 2800 wrote to memory of 2152	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	49
PID 2800 wrote to memory of 2152	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	49
PID 2800 wrote to memory of 2420	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	50
PID 2800 wrote to memory of 2420	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	50
PID 2800 wrote to memory of 2420	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	50
PID 2800 wrote to memory of 2352	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	52
PID 2800 wrote to memory of 2352	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	52
PID 2800 wrote to memory of 2352	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	52
PID 2800 wrote to memory of 1420	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	53
PID 2800 wrote to memory of 1420	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	53
PID 2800 wrote to memory of 1420	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	53
PID 2800 wrote to memory of 2824	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	54
PID 2800 wrote to memory of 2824	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	54
PID 2800 wrote to memory of 2824	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	54
PID 2800 wrote to memory of 1304	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	64
PID 2800 wrote to memory of 1304	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	64
PID 2800 wrote to memory of 1304	2800	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe	64
PID 1304 wrote to memory of 2536	1304	cmd.exe	66
PID 1304 wrote to memory of 2536	1304	cmd.exe	66
PID 1304 wrote to memory of 2536	1304	cmd.exe	66
PID 1304 wrote to memory of 2768	1304	cmd.exe	67
PID 1304 wrote to memory of 2768	1304	cmd.exe	67
PID 1304 wrote to memory of 2768	1304	cmd.exe	67
PID 2768 wrote to memory of 2208	2768	csrss.exe	68
PID 2768 wrote to memory of 2208	2768	csrss.exe	68
PID 2768 wrote to memory of 2208	2768	csrss.exe	68
PID 2768 wrote to memory of 824	2768	csrss.exe	69
PID 2768 wrote to memory of 824	2768	csrss.exe	69
PID 2768 wrote to memory of 824	2768	csrss.exe	69
PID 2208 wrote to memory of 2972	2208	WScript.exe	71
PID 2208 wrote to memory of 2972	2208	WScript.exe	71
PID 2208 wrote to memory of 2972	2208	WScript.exe	71
PID 2972 wrote to memory of 952	2972	csrss.exe	72
PID 2972 wrote to memory of 952	2972	csrss.exe	72
PID 2972 wrote to memory of 952	2972	csrss.exe	72
PID 2972 wrote to memory of 1336	2972	csrss.exe	73
PID 2972 wrote to memory of 1336	2972	csrss.exe	73
PID 2972 wrote to memory of 1336	2972	csrss.exe	73
PID 952 wrote to memory of 1892	952	WScript.exe	74
PID 952 wrote to memory of 1892	952	WScript.exe	74
PID 952 wrote to memory of 1892	952	WScript.exe	74
PID 1892 wrote to memory of 2384	1892	csrss.exe	75

System policy modification 1 TTPs 33 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe
"C:\Users\Admin\AppData\Local\Temp\7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1pqWF3ZRZL.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2536
- - C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
    "C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2768
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ebcf54a8-e1a0-4c36-a187-15cb96e7431f.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2208
    - - C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        
        C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2972
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\57263fe6-1f88-4380-bb2c-f9d41f4968ee.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:952
        
        C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        
        C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1892
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9608635-63b7-401e-b6c6-1798c2f05f56.vbs"
        8⤵
        
        PID:2384
        
        C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        
        C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3032
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d24c229-fe43-491c-a836-60a40522f34e.vbs"
        10⤵
        
        PID:2116
        
        C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        
        C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\66ccc31d-4734-43aa-af91-058a2f2ad5e1.vbs"
        12⤵
        
        PID:2592
        
        C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        
        C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2192
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee099303-1262-41fb-a3ed-80ae6340ef7a.vbs"
        14⤵
        
        PID:2832
        
        C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        
        C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2088
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe33dd71-10a5-439b-afb9-5e4a10fa91b6.vbs"
        16⤵
        
        PID:1836
        
        C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        
        C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1544
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8117d0f-0619-491c-8498-f169fef72e83.vbs"
        18⤵
        
        PID:676
        
        C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        
        C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1304
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4fde6f27-2604-43c0-928e-16dfd1e4e79c.vbs"
        20⤵
        
        PID:1240
        
        C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        
        C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe
        21⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c5fd868-d4b5-4ca2-88fe-bfcda93b6c7c.vbs"
        22⤵
        
        PID:2616
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5e4faf1c-54e9-458b-bb1a-6f1c49554872.vbs"
        22⤵
        
        PID:1484
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ede23fd0-345c-4834-815f-eecf3e81e12f.vbs"
        20⤵
        
        PID:2204
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6686352-1bd1-476a-bfb6-576a10bee3b8.vbs"
        18⤵
        
        PID:2860
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\afcf07fc-23e4-475e-a5ad-6ccaf3f839e8.vbs"
        16⤵
        
        PID:2792
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c02cef5-1c01-403e-b020-f85a05bb48b5.vbs"
        14⤵
        
        PID:1356
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7f4e5172-682b-4f28-bc82-45dd4b45ddee.vbs"
        12⤵
        
        PID:2620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\88582f57-cfee-44ef-a0f8-ce023c4dd380.vbs"
        10⤵
        
        PID:2868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b1a9fac1-285d-4bf1-9fe8-cf77e221c444.vbs"
        8⤵
        
        PID:1040
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8862574c-4664-4955-9e10-ed041a1dc351.vbs"
        6⤵
        
        PID:1336
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c80a7405-e7d3-4562-b420-8c353b332ec9.vbs"
      4⤵
      PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N7" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Favorites\7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N" /sc ONLOGON /tr "'C:\Users\All Users\Favorites\7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N7" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Favorites\7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe

Filesize
4.9MB

MD5
8b1ae5a3a4c40f96c4703c44ea4c896c

SHA1
42f887b06846e9a8003f83acf7cacb56f539dab3

SHA256
4113114376b5a37535053ffda3c0b4abff07562d13713edd9f26d6ae3ca3a926

SHA512
dca25dc4a4ac03bc25745e5eb046098550ee98f51a751496b5d02525aee27d122a2382eb3d5df161729e81555cf4e696917e16279ca579b3afc44f7fda4224b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1c5fd868-d4b5-4ca2-88fe-bfcda93b6c7c.vbs

Filesize
734B

MD5
9c84f9cfa4865eb2e27b0c9ca9d19e83

SHA1
ff96338503cd3ba926c2efbe2f25055653130693

SHA256
d2a6eb462366d213e1444012d1f6199fac669e16fbf2a3f4a3a18b6a5e1f4433

SHA512
3df8e62089f8a1352a24c68f32e902487b7da05ee6443dd4e75b24ba514cf0ef287b5ef06f78b75f38d723da126419ebdcae6efd698dcb3ca188fa88545501aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\1pqWF3ZRZL.bat

Filesize
223B

MD5
4cb007681b61e8b855a8641a242e0473

SHA1
2c8b0ed85a1cf95a2a0a69d770ae0820348d6362

SHA256
202fb38f8a2daa572cb5ef42cca232fd93122c2b56e6959db7f6c4cca0f6b800

SHA512
964e5c59f2fcc729360f02347f83add87d1f2809832b686637561d5c2bdf3ee0ce92a60b05e67df6f48dc154682921dfd6bb72910cf1c36aa3fff130cad3f774

Download Submit
C:\Users\Admin\AppData\Local\Temp\4fde6f27-2604-43c0-928e-16dfd1e4e79c.vbs

Filesize
734B

MD5
266e130e153914565fb45ced7f55e2d9

SHA1
1655e24447ad00f8a6b23f5d0a255158d8a86436

SHA256
84777c7838f59924f1f0abe4fc688b38c8f5ecdaec6b25e64f6f9bd410377e13

SHA512
665e0e4f4c55bdff3351afd57e5bd0ca0cb2152f4966c34308177465d01d988f917fa4084dc13ce74e58369016db9f421e9cfdaca553ab5b0142a3a1096154a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\57263fe6-1f88-4380-bb2c-f9d41f4968ee.vbs

Filesize
734B

MD5
e9d129b8b1394c4190bf14018c9f62bf

SHA1
58ab4be4945a4b08f495cd208a80666ed57758ad

SHA256
38ec28c742bf27daa90f6475196219cc2c3afac16c28acd4100bcf1e77da0074

SHA512
4099104aee9eb10331831c0815dfc6c694cda466eb7c7b9417beff4e775d7ff72e108bc7d999d60685768b59144428a71f5246af885755bb54ad30f51900b332

Download Submit
C:\Users\Admin\AppData\Local\Temp\66ccc31d-4734-43aa-af91-058a2f2ad5e1.vbs

Filesize
734B

MD5
377a4ad0d6b0e9c2565bbf092c2a196a

SHA1
b1b1fccc785c43a073f1f8b2552f0665b062f6bb

SHA256
e6e80f4f73ec6899a26d9880237073ab3a6fbb1cd1172590799171cf724254a3

SHA512
ce015e00d8ce7addc7af0f04c6f507ae8a5e330cb3c2e9c232349e43de456e07132d33e92740d7eebf80aba0207ed0d1764dd8f967c5f03debdc35f4fcbef5b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\8d24c229-fe43-491c-a836-60a40522f34e.vbs

Filesize
734B

MD5
75506e896016b043de60b7983aa4dba5

SHA1
40b3a569f37dabc5540cc5dfb9601fc790ba85ac

SHA256
93d43b862bfbc5a535ec2b0c2728bdd5908092a220738aea99edf9e2fc8beb6e

SHA512
d13f8d063d349d03506bc75185bcb00f2587ea390d1d5f9a13b3aeeaa981b37751e204fcd782c94f68961e4e4abf22d2ac7645e60deb3256a744824bf22b9d06

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9608635-63b7-401e-b6c6-1798c2f05f56.vbs

Filesize
734B

MD5
e6699ede693c433d9d01679d71b3d5d5

SHA1
8790a43e69e74e3c3e8b95bfb993b55592340ffc

SHA256
f5acf507cf8d721f5260ee1d1647274c3fa9d655225ffb65f4a50a9d41c41d14

SHA512
652b1074b3e888ad33affb711314c977e2f7c3215f400135351b7d6366cf2c4ad913cf65d543f3ddecca1416bf096c74404d698c3c76e95f1379e0cde75e5b19

Download Submit
C:\Users\Admin\AppData\Local\Temp\c80a7405-e7d3-4562-b420-8c353b332ec9.vbs

Filesize
510B

MD5
b5f1eae32390dd0f5924c02f256e01fe

SHA1
9cb7940f8e52d72db71af9af8ce5f56e23c0444b

SHA256
fe6c0e9a4004a51d7612f704a8202d1596f46737547eb8c811afb2b4a1547232

SHA512
782a1f4ab7d1197050689bad51a9a201a511e6cd34a5d4bd203cd420a7970d2d9b618964774000325ed102e49bc672b4a718bd593b65fd9fbcabe9c3d1be4319

Download Submit
C:\Users\Admin\AppData\Local\Temp\c8117d0f-0619-491c-8498-f169fef72e83.vbs

Filesize
734B

MD5
dcafb5eb3731f9839eac08ceb98ee5a1

SHA1
cd7c17b8e0093488ac8d45fdd5761af3989864d7

SHA256
d3cd0a9c61f5af1606047d5ac2e833f1eab16c7f8f5832d15a2a548a5f1feef5

SHA512
2e8a15c07c46f72f485106c6c35a7b558e8e6b795222083955d1a289404c72951b173bc8516be6cbad3f90a6b1e9a615498e683fd063f5c8901dc1e8fe39a6bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebcf54a8-e1a0-4c36-a187-15cb96e7431f.vbs

Filesize
734B

MD5
7ed00af035fd0f2372e8198cceb15d6b

SHA1
97791e6f09581749179a8b8463a764c86cfd2608

SHA256
2f512d95e4a4b56eddceebfaf30c558676fae31367c73f5c150247f09d85308b

SHA512
67a57c91444fce6eff499784be5be2a29373f6debd533a9803cd5464c229b58475751e3c1d28f594d5f7a82a7b002278c4603eef71c114531731455b3b694f42

Download Submit
C:\Users\Admin\AppData\Local\Temp\ee099303-1262-41fb-a3ed-80ae6340ef7a.vbs

Filesize
734B

MD5
bc9dcda206e8a2965c9dd151c1bd869c

SHA1
d4aa65f70fa37bb04799c2a980ce045c9c56b446

SHA256
018c1cc7e58e7e1173efe66293aaff2017350d89cd226e3512689eee7abde0ed

SHA512
8b0c7237f8c6966997b9ffea47a46d5d1cf3eb75238ac5ba1c8074a7e67bba6dbaac89c3940153da876ae4b725973dd104ef48ce82519e14e6874c04ab0bb95a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fe33dd71-10a5-439b-afb9-5e4a10fa91b6.vbs

Filesize
734B

MD5
bae07aafb079d248d73c83a7779e6636

SHA1
bb57da89501731caa9be33c7e853e9ebcb2b00ac

SHA256
2c33b0caa87ff0e62ff4263e0384bd0b4edd7dd935145f47d453b4307e382a10

SHA512
28b35aecdeeb9d8543ff11193c14e80944d467974e55e88cc653b1022b4cff9686f60f265348a111cf687da0c7ea70b408eb8e6811aca6415a606d0a8549ec19

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB480.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DOY2U877N56FSDQHSBGE.temp

Filesize
7KB

MD5
5dcc6f5b97f2ce6e27a556e3d7245f04

SHA1
a63a009a0ccb7d8c864279b4cf24315903251d47

SHA256
5532f6b231141111503c999fa29322ea3686eb7ec48667a21619c1e0c48de9cb

SHA512
694a7206ffa9ab41111fe6b7326bd00c1c51aad74bccb628a646909e2f0e296709f7b94b92f2d8a4d65d60c9e8d1bd2f0f1a77d5cd365eda2a54806220be47e3

Download Submit
C:\Users\Public\Favorites\7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81N.exe

Filesize
4.9MB

MD5
84c3e32da77210eb29452816fe3d4830

SHA1
073ef3fe85c0ec68ad52c88c76644a8c2a4c0411

SHA256
7e60f1b37aecfc21c61c46b534862a212af62ad8ce5b9af83ba9d8f4f32f5a81

SHA512
d094bdaa1fe2c53ee7e955be38e295fbb09c7138865fa095aa2441d4b6faa49aa3773746e9f1e9e35677f7bb84dfec24e8525bdd774fdbe2e8b1867445294692

Download Submit
memory/1304-234-0x0000000000820000-0x0000000000D14000-memory.dmp

Filesize
5.0MB

Download
memory/1544-218-0x00000000000E0000-0x00000000005D4000-memory.dmp

Filesize
5.0MB

Download
memory/1544-219-0x00000000009A0000-0x00000000009B2000-memory.dmp

Filesize
72KB

Download
memory/2028-61-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2028-69-0x0000000001E50000-0x0000000001E58000-memory.dmp

Filesize
32KB

Download
memory/2088-203-0x00000000011B0000-0x00000000016A4000-memory.dmp

Filesize
5.0MB

Download
memory/2192-188-0x0000000000700000-0x0000000000712000-memory.dmp

Filesize
72KB

Download
memory/2768-118-0x00000000010C0000-0x00000000015B4000-memory.dmp

Filesize
5.0MB

Download
memory/2800-9-0x0000000000A10000-0x0000000000A1A000-memory.dmp

Filesize
40KB

Download
memory/2800-1-0x00000000000C0000-0x00000000005B4000-memory.dmp

Filesize
5.0MB

Download
memory/2800-0-0x000007FEF5883000-0x000007FEF5884000-memory.dmp

Filesize
4KB

Download
memory/2800-14-0x0000000000A60000-0x0000000000A68000-memory.dmp

Filesize
32KB

Download
memory/2800-13-0x0000000000A50000-0x0000000000A5E000-memory.dmp

Filesize
56KB

Download
memory/2800-12-0x0000000000A40000-0x0000000000A4E000-memory.dmp

Filesize
56KB

Download
memory/2800-11-0x0000000000A30000-0x0000000000A3A000-memory.dmp

Filesize
40KB

Download
memory/2800-10-0x0000000000A20000-0x0000000000A32000-memory.dmp

Filesize
72KB

Download
memory/2800-15-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/2800-16-0x0000000002420000-0x000000000242C000-memory.dmp

Filesize
48KB

Download
memory/2800-7-0x00000000009E0000-0x00000000009F6000-memory.dmp

Filesize
88KB

Download
memory/2800-8-0x0000000000A00000-0x0000000000A10000-memory.dmp

Filesize
64KB

Download
memory/2800-6-0x00000000009D0000-0x00000000009E0000-memory.dmp

Filesize
64KB

Download
memory/2800-5-0x0000000000840000-0x0000000000848000-memory.dmp

Filesize
32KB

Download
memory/2800-4-0x0000000000810000-0x000000000082C000-memory.dmp

Filesize
112KB

Download
memory/2800-3-0x000000001B510000-0x000000001B63E000-memory.dmp

Filesize
1.2MB

Download
memory/2800-2-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/2800-63-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/2808-249-0x00000000003E0000-0x00000000008D4000-memory.dmp

Filesize
5.0MB

Download