dcrat | 3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2025 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Size

1.5MB
MD5

7a4f0846743a7071ffdd25abc446b107
SHA1

996c98355bdb997ad8d5d02283ca06438c959cd1
SHA256

3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c
SHA512

fcb17641446ebd06321192777fca64d7c0b5a9c143eeb46884228d6d6996da928e02043b0b0d335b99c998695cb2f4d7b21d212784ca09e785f6ca12f342ed8e
SSDEEP

24576:dbfESdvMj6hoGDAQsJ+N6XcHQWq3QY2SrXQLdok0OjYS4mej+T1kJCve:ZEi6GDAQORcwW5/oBjme81s

Score

10^/10

dcrat execution infostealer persistence rat

Malware Config

Signatures

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

pid	Process
916	schtasks.exe
2300	schtasks.exe
1776	schtasks.exe
4692	schtasks.exe
2012	schtasks.exe
3272	schtasks.exe
4888	schtasks.exe
4868	schtasks.exe
3340	schtasks.exe
4988	schtasks.exe
4848	schtasks.exe
1448	schtasks.exe
1408	schtasks.exe
1100	schtasks.exe
3128	schtasks.exe
4520	schtasks.exe
2584	schtasks.exe
2112	schtasks.exe
2716	schtasks.exe
4460	schtasks.exe
3540	schtasks.exe
4956	schtasks.exe
4420	schtasks.exe
2972	schtasks.exe
3404	schtasks.exe
948	schtasks.exe
1124	schtasks.exe
4748	schtasks.exe
4676	schtasks.exe
2980	schtasks.exe
536	schtasks.exe
3536	schtasks.exe
2440	schtasks.exe
4612	schtasks.exe
2912	schtasks.exe
2012	schtasks.exe
4600	schtasks.exe
3552	schtasks.exe
3472	schtasks.exe
2680	schtasks.exe
3200	schtasks.exe
3472	schtasks.exe
3676	schtasks.exe
5016	schtasks.exe
1812	schtasks.exe
4456	schtasks.exe
4588	schtasks.exe
4832	schtasks.exe
1656	schtasks.exe
4164	schtasks.exe
3628	schtasks.exe
3724	schtasks.exe
3128	schtasks.exe
4516	schtasks.exe
2092	schtasks.exe
744	schtasks.exe
2508	schtasks.exe
2776	schtasks.exe
1360	schtasks.exe
4592	schtasks.exe
3536	schtasks.exe
4364	schtasks.exe
2760	schtasks.exe
4024	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 25 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\lsass.exe\", \"C:\\Documents and Settings\\sysmon.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\lsass.exe\", \"C:\\Documents and Settings\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Users\\Admin\\Cookies\\sihost.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\lsass.exe\", \"C:\\Documents and Settings\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Users\\Admin\\Cookies\\sihost.exe\", \"C:\\Users\\Admin\\NetHood\\powershell.exe\", \"C:\\ProgramData\\USOShared\\Logs\\User\\conhost.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\lsass.exe\", \"C:\\Documents and Settings\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Users\\Admin\\Cookies\\sihost.exe\", \"C:\\Users\\Admin\\NetHood\\powershell.exe\", \"C:\\ProgramData\\USOShared\\Logs\\User\\conhost.exe\", \"C:\\Windows\\ja-JP\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\lsass.exe\", \"C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\System.exe\", \"C:\\Documents and Settings\\powershell.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\lsass.exe\", \"C:\\Documents and Settings\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Users\\Admin\\Cookies\\sihost.exe\", \"C:\\Users\\Admin\\NetHood\\powershell.exe\", \"C:\\ProgramData\\USOShared\\Logs\\User\\conhost.exe\", \"C:\\Windows\\ja-JP\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\lsass.exe\", \"C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\System.exe\", \"C:\\Documents and Settings\\powershell.exe\", \"C:\\Documents and Settings\\WaaSMedicAgent.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\wininit.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\lsass.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\lsass.exe\", \"C:\\Documents and Settings\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Users\\Admin\\Cookies\\sihost.exe\", \"C:\\Users\\Admin\\NetHood\\powershell.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\lsass.exe\", \"C:\\Documents and Settings\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Users\\Admin\\Cookies\\sihost.exe\", \"C:\\Users\\Admin\\NetHood\\powershell.exe\", \"C:\\ProgramData\\USOShared\\Logs\\User\\conhost.exe\", \"C:\\Windows\\ja-JP\\conhost.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\lsass.exe\", \"C:\\Documents and Settings\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Users\\Admin\\Cookies\\sihost.exe\", \"C:\\Users\\Admin\\NetHood\\powershell.exe\", \"C:\\ProgramData\\USOShared\\Logs\\User\\conhost.exe\", \"C:\\Windows\\ja-JP\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\lsass.exe\", \"C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\System.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\lsass.exe\", \"C:\\Documents and Settings\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Users\\Admin\\Cookies\\sihost.exe\", \"C:\\Users\\Admin\\NetHood\\powershell.exe\", \"C:\\ProgramData\\USOShared\\Logs\\User\\conhost.exe\", \"C:\\Windows\\ja-JP\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\lsass.exe\", \"C:\\Documents and Settings\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Users\\Admin\\Cookies\\sihost.exe\", \"C:\\Users\\Admin\\NetHood\\powershell.exe\", \"C:\\ProgramData\\USOShared\\Logs\\User\\conhost.exe\", \"C:\\Windows\\ja-JP\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\lsass.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\lsass.exe\", \"C:\\Documents and Settings\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\lsass.exe\", \"C:\\Documents and Settings\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\conhost.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\", \"C:\\ProgramData\\Templates\\upfc.exe\", \"C:\\ProgramData\\Templates\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\lsass.exe\", \"C:\\Documents and Settings\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Documents and Settings\\taskhostw.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4420	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	744	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	512	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4164	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3676	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3540	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3272	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3628	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1124	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3932	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	1224	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	1224	schtasks.exe	85

Command and Scripting Interpreter: PowerShell 1 TTPs 27 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4536	powershell.exe
2136	powershell.exe
1884	powershell.exe
916	powershell.exe
2056	powershell.exe
3344	powershell.exe
2684	powershell.exe
320	powershell.exe
2220	powershell.exe
4744	powershell.exe
4792	powershell.exe
4740	powershell.exe
5092	powershell.exe
1068	powershell.exe
3940	powershell.exe
3284	powershell.exe
2236	powershell.exe
4676	powershell.exe
2084	powershell.exe
1652	powershell.exe
4548	powershell.exe
2160	powershell.exe
2732	powershell.exe
1952	powershell.exe
5040	powershell.exe
4340	powershell.exe
1312	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	conhost.exe

Executes dropped EXE 3 IoCs

pid	Process
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
5404	conhost.exe
6064	conhost.exe

Adds Run key to start application 2 TTPs 25 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\lsass.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Documents and Settings\\SearchApp.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows Media Player\\lsass.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Documents and Settings\\sysmon.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\Performance\\WinSAT\\DataStore\\conhost.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\ja-JP\\conhost.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\PolicyDefinitions\\en-US\\fontdrvhost.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Recovery\\WindowsRE\\conhost.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Documents and Settings\\WaaSMedicAgent.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Documents and Settings\\taskhostw.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\ProgramData\\Templates\\sihost.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Portable Devices\\RuntimeBroker.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\wininit.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "\"C:\\Users\\Admin\\NetHood\\powershell.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\ProgramData\\USOShared\\Logs\\User\\conhost.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\System.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\ProgramData\\Templates\\upfc.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Admin\\Cookies\\sihost.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "\"C:\\Documents and Settings\\powershell.exe\""	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\lsass.exe	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXAD10.tmp	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Schema\RCXB408.tmp	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Schema\56085415360792	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File created	C:\Program Files (x86)\Windows Portable Devices\6cb0b6c459d5d3	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXB196.tmp	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\dwm.exe	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Schema\wininit.exe	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File created	C:\Program Files (x86)\Windows Portable Devices\9e8d7a4ca61bd9	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Schema\wininit.exe	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\RCXB90B.tmp	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\lsass.exe	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\886983d96e3d3e	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File created	C:\Program Files (x86)\Windows Portable Devices\dwm.exe	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File created	C:\Program Files (x86)\Windows Media Player\6203df4a6bafc7	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File created	C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\PolicyDefinitions\en-US\fontdrvhost.exe	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File created	C:\Windows\PolicyDefinitions\en-US\5b884080fd4f94	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File opened for modification	C:\Windows\PolicyDefinitions\en-US\RCXA637.tmp	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File created	C:\Windows\Performance\WinSAT\DataStore\conhost.exe	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File created	C:\Windows\ja-JP\088424020bedd6	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File opened for modification	C:\Windows\PolicyDefinitions\en-US\fontdrvhost.exe	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File created	C:\Windows\Performance\WinSAT\DataStore\088424020bedd6	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File created	C:\Windows\ja-JP\conhost.exe	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File opened for modification	C:\Windows\Performance\WinSAT\DataStore\conhost.exe	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
File opened for modification	C:\Windows\ja-JP\conhost.exe	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
756	schtasks.exe
3204	schtasks.exe
5016	schtasks.exe
1360	schtasks.exe
2572	schtasks.exe
4364	schtasks.exe
4692	schtasks.exe
2760	schtasks.exe
932	schtasks.exe
3760	schtasks.exe
3600	schtasks.exe
3128	schtasks.exe
3536	schtasks.exe
4600	schtasks.exe
1448	schtasks.exe
4024	schtasks.exe
1656	schtasks.exe
2972	schtasks.exe
4540	schtasks.exe
2776	schtasks.exe
4520	schtasks.exe
3472	schtasks.exe
4516	schtasks.exe
5064	schtasks.exe
1116	schtasks.exe
1444	schtasks.exe
2300	schtasks.exe
3128	schtasks.exe
3516	schtasks.exe
1932	schtasks.exe
744	schtasks.exe
4164	schtasks.exe
2716	schtasks.exe
1776	schtasks.exe
1328	schtasks.exe
4888	schtasks.exe
2012	schtasks.exe
1112	schtasks.exe
3272	schtasks.exe
3676	schtasks.exe
916	schtasks.exe
4848	schtasks.exe
3536	schtasks.exe
4368	schtasks.exe
2584	schtasks.exe
3552	schtasks.exe
2092	schtasks.exe
1116	schtasks.exe
4592	schtasks.exe
4612	schtasks.exe
3472	schtasks.exe
2112	schtasks.exe
2804	schtasks.exe
4588	schtasks.exe
4748	schtasks.exe
2680	schtasks.exe
536	schtasks.exe
4988	schtasks.exe
4832	schtasks.exe
4676	schtasks.exe
2012	schtasks.exe
5040	schtasks.exe
4956	schtasks.exe
2748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4676	powershell.exe
4676	powershell.exe
4340	powershell.exe
4340	powershell.exe
4740	powershell.exe
4740	powershell.exe
2136	powershell.exe
2136	powershell.exe
1884	powershell.exe
1884	powershell.exe
3344	powershell.exe
3344	powershell.exe
4744	powershell.exe
4744	powershell.exe
2684	powershell.exe
2684	powershell.exe
1952	powershell.exe
1952	powershell.exe
1312	powershell.exe
1312	powershell.exe
2056	powershell.exe
2056	powershell.exe
1884	powershell.exe
2084	powershell.exe
2084	powershell.exe
2684	powershell.exe
4676	powershell.exe
4676	powershell.exe
2084	powershell.exe
4740	powershell.exe
2136	powershell.exe
4340	powershell.exe
3344	powershell.exe
4744	powershell.exe
1312	powershell.exe
1952	powershell.exe
2056	powershell.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
2220	powershell.exe
2220	powershell.exe
2220	powershell.exe
2236	powershell.exe
2236	powershell.exe
1652	powershell.exe
1652	powershell.exe
5092	powershell.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	1884	powershell.exe
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeDebugPrivilege	1312	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	2236	powershell.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	320	powershell.exe
Token: SeDebugPrivilege	916	powershell.exe
Token: SeDebugPrivilege	3284	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	5404	conhost.exe
Token: SeDebugPrivilege	6064	conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 4676	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	137
PID 4808 wrote to memory of 4676	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	137
PID 4808 wrote to memory of 4340	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	138
PID 4808 wrote to memory of 4340	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	138
PID 4808 wrote to memory of 2084	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	139
PID 4808 wrote to memory of 2084	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	139
PID 4808 wrote to memory of 2136	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	140
PID 4808 wrote to memory of 2136	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	140
PID 4808 wrote to memory of 4740	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	141
PID 4808 wrote to memory of 4740	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	141
PID 4808 wrote to memory of 1952	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	142
PID 4808 wrote to memory of 1952	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	142
PID 4808 wrote to memory of 2056	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	143
PID 4808 wrote to memory of 2056	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	143
PID 4808 wrote to memory of 4744	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	144
PID 4808 wrote to memory of 4744	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	144
PID 4808 wrote to memory of 3344	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	145
PID 4808 wrote to memory of 3344	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	145
PID 4808 wrote to memory of 1312	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	146
PID 4808 wrote to memory of 1312	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	146
PID 4808 wrote to memory of 2684	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	147
PID 4808 wrote to memory of 2684	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	147
PID 4808 wrote to memory of 1884	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	148
PID 4808 wrote to memory of 1884	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	148
PID 4808 wrote to memory of 4548	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	149
PID 4808 wrote to memory of 4548	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	149
PID 4808 wrote to memory of 4984	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	163
PID 4808 wrote to memory of 4984	4808	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	163
PID 4984 wrote to memory of 2160	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	225
PID 4984 wrote to memory of 2160	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	225
PID 4984 wrote to memory of 916	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	226
PID 4984 wrote to memory of 916	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	226
PID 4984 wrote to memory of 2732	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	227
PID 4984 wrote to memory of 2732	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	227
PID 4984 wrote to memory of 5092	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	228
PID 4984 wrote to memory of 5092	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	228
PID 4984 wrote to memory of 1652	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	229
PID 4984 wrote to memory of 1652	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	229
PID 4984 wrote to memory of 5040	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	230
PID 4984 wrote to memory of 5040	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	230
PID 4984 wrote to memory of 320	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	231
PID 4984 wrote to memory of 320	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	231
PID 4984 wrote to memory of 1068	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	232
PID 4984 wrote to memory of 1068	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	232
PID 4984 wrote to memory of 3940	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	233
PID 4984 wrote to memory of 3940	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	233
PID 4984 wrote to memory of 3284	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	234
PID 4984 wrote to memory of 3284	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	234
PID 4984 wrote to memory of 2220	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	235
PID 4984 wrote to memory of 2220	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	235
PID 4984 wrote to memory of 4536	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	236
PID 4984 wrote to memory of 4536	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	236
PID 4984 wrote to memory of 4792	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	237
PID 4984 wrote to memory of 4792	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	237
PID 4984 wrote to memory of 2236	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	238
PID 4984 wrote to memory of 2236	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	238
PID 4984 wrote to memory of 2132	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	253
PID 4984 wrote to memory of 2132	4984	3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe	253
PID 2132 wrote to memory of 536	2132	cmd.exe	255
PID 2132 wrote to memory of 536	2132	cmd.exe	255
PID 2132 wrote to memory of 5404	2132	cmd.exe	257
PID 2132 wrote to memory of 5404	2132	cmd.exe	257
PID 5404 wrote to memory of 5536	5404	conhost.exe	258
PID 5404 wrote to memory of 5536	5404	conhost.exe	258

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
"C:\Users\Admin\AppData\Local\Temp\3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Documents and Settings\taskhostw.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Documents and Settings\SearchApp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PolicyDefinitions\en-US\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Templates\upfc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Templates\sihost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\Configuration\Schema\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4548
- C:\Users\Admin\AppData\Local\Temp\3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe
  "C:\Users\Admin\AppData\Local\Temp\3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Documents and Settings\sysmon.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Performance\WinSAT\DataStore\conhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Cookies\sihost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\NetHood\powershell.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\USOShared\Logs\User\conhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ja-JP\conhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3284
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\regid.1991-06.com.microsoft\lsass.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\UEV\InboxTemplates\System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Documents and Settings\powershell.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Documents and Settings\WaaSMedicAgent.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2236
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kfm9ff3F0u.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:536
  - - C:\Windows\ja-JP\conhost.exe
      "C:\Windows\ja-JP\conhost.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5404
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2aa8095c-147b-45be-80ff-9769f1d25a76.vbs"
        5⤵
        
        PID:5536
      - C:\Windows\ja-JP\conhost.exe
        
        C:\Windows\ja-JP\conhost.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:6064
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b6cbe892-e992-42ba-b6db-9c7f3956065c.vbs"
        5⤵
        
        PID:5580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "75Zetaskhostw" /sc MINUTE /mo 12 /tr "'C:\Documents and Settings\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ZxgKtaskhostw" /sc ONLOGON /tr "'C:\Documents and Settings\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7406taskhostw" /sc ONSTART /tr "'C:\Documents and Settings\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc MINUTE /mo 5 /tr "'C:\Documents and Settings\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TprkRuntimeBroker" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DxFzRuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "UijYRuntimeBroker" /sc ONSTART /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "QazHSearchApp" /sc MINUTE /mo 7 /tr "'C:\Documents and Settings\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Ipt6SearchApp" /sc ONLOGON /tr "'C:\Documents and Settings\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "KxFpSearchApp" /sc ONSTART /tr "'C:\Documents and Settings\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc MINUTE /mo 11 /tr "'C:\Documents and Settings\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "GwVRfontdrvhost" /sc MINUTE /mo 13 /tr "'C:\Windows\PolicyDefinitions\en-US\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "slvPfontdrvhost" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\en-US\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "jzncfontdrvhost" /sc ONSTART /tr "'C:\Windows\PolicyDefinitions\en-US\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc MINUTE /mo 12 /tr "'C:\Windows\PolicyDefinitions\en-US\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3TdOupfc" /sc MINUTE /mo 14 /tr "'C:\ProgramData\Templates\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "gs3bupfc" /sc ONLOGON /tr "'C:\ProgramData\Templates\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AG0cupfc" /sc ONSTART /tr "'C:\ProgramData\Templates\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc MINUTE /mo 7 /tr "'C:\ProgramData\Templates\upfc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "guuAsihost" /sc MINUTE /mo 10 /tr "'C:\ProgramData\Templates\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "tKaCsihost" /sc ONLOGON /tr "'C:\ProgramData\Templates\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "PEAZsihost" /sc ONSTART /tr "'C:\ProgramData\Templates\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc MINUTE /mo 10 /tr "'C:\ProgramData\Templates\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ImmkRuntimeBroker" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "QOwuRuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "UYcsRuntimeBroker" /sc ONSTART /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cLbqsihost" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "QOFysihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dfo8sihost" /sc ONSTART /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1w3Cdwm" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "72x7dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2YM4dwm" /sc ONSTART /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "zwgYwininit" /sc MINUTE /mo 5 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LzIUwininit" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "pQ1xwininit" /sc ONSTART /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc MINUTE /mo 11 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TZ9dcsrss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "w9cycsrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RgB3csrss" /sc ONSTART /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hJDUlsass" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ONlWlsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Ojgplsass" /sc ONSTART /tr "'C:\Program Files (x86)\Windows Media Player\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "x43ssysmon" /sc MINUTE /mo 12 /tr "'C:\Documents and Settings\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IFATsysmon" /sc ONLOGON /tr "'C:\Documents and Settings\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TOkOsysmon" /sc ONSTART /tr "'C:\Documents and Settings\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc MINUTE /mo 7 /tr "'C:\Documents and Settings\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "gDulcsrss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bQGIcsrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "QBFbcsrss" /sc ONSTART /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "qSPqconhost" /sc MINUTE /mo 14 /tr "'C:\Windows\Performance\WinSAT\DataStore\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dV7cconhost" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "JX7gconhost" /sc ONSTART /tr "'C:\Windows\Performance\WinSAT\DataStore\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc MINUTE /mo 11 /tr "'C:\Windows\Performance\WinSAT\DataStore\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "JhlPconhost" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "GcUmconhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "s8Ebconhost" /sc ONSTART /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4Qabsihost" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Cookies\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "pW5wsihost" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\sihost.exe'" /rl HIGHEST /f
1⤵
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "B9Tosihost" /sc ONSTART /tr "'C:\Users\Admin\Cookies\sihost.exe'" /rl HIGHEST /f
1⤵
PID:3432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Cookies\sihost.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "glBbpowershell" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\NetHood\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "8rWTpowershell" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AA8xpowershell" /sc ONSTART /tr "'C:\Users\Admin\NetHood\powershell.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\NetHood\powershell.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "uzLCconhost" /sc MINUTE /mo 5 /tr "'C:\ProgramData\USOShared\Logs\User\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "r6Zgconhost" /sc ONLOGON /tr "'C:\ProgramData\USOShared\Logs\User\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "oBC8conhost" /sc ONSTART /tr "'C:\ProgramData\USOShared\Logs\User\conhost.exe'" /rl HIGHEST /f
1⤵
PID:516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc MINUTE /mo 11 /tr "'C:\ProgramData\USOShared\Logs\User\conhost.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "65C4conhost" /sc MINUTE /mo 6 /tr "'C:\Windows\ja-JP\conhost.exe'" /rl HIGHEST /f
1⤵
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "EQKZconhost" /sc ONLOGON /tr "'C:\Windows\ja-JP\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "N4dTconhost" /sc ONSTART /tr "'C:\Windows\ja-JP\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc MINUTE /mo 9 /tr "'C:\Windows\ja-JP\conhost.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IRnaRuntimeBroker" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "iS0KRuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "j8LDRuntimeBroker" /sc ONSTART /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5ffjlsass" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\lsass.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "C8mSlsass" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3y39lsass" /sc ONSTART /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\lsass.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\lsass.exe'" /f
1⤵
PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "k4E0System" /sc MINUTE /mo 8 /tr "'C:\ProgramData\Microsoft\UEV\InboxTemplates\System.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "JrqtSystem" /sc ONLOGON /tr "'C:\ProgramData\Microsoft\UEV\InboxTemplates\System.exe'" /rl HIGHEST /f
1⤵
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "XRh8System" /sc ONSTART /tr "'C:\ProgramData\Microsoft\UEV\InboxTemplates\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc MINUTE /mo 5 /tr "'C:\ProgramData\Microsoft\UEV\InboxTemplates\System.exe'" /f
1⤵
- DcRat
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2NtSpowershell" /sc MINUTE /mo 9 /tr "'C:\Documents and Settings\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "FjjGpowershell" /sc ONLOGON /tr "'C:\Documents and Settings\powershell.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "PClppowershell" /sc ONSTART /tr "'C:\Documents and Settings\powershell.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc MINUTE /mo 5 /tr "'C:\Documents and Settings\powershell.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lyBUWaaSMedicAgent" /sc MINUTE /mo 13 /tr "'C:\Documents and Settings\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4LbSWaaSMedicAgent" /sc ONLOGON /tr "'C:\Documents and Settings\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4riSWaaSMedicAgent" /sc ONSTART /tr "'C:\Documents and Settings\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc MINUTE /mo 5 /tr "'C:\Documents and Settings\WaaSMedicAgent.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Media Player\RCXB90B.tmp

Filesize
1.5MB

MD5
f98f80f5217492863e3967abea61c6e2

SHA1
d03a9ee331d2d49d74d1f38521b976fe430405be

SHA256
8ad8ff58284adcddd9c120bf068aa1e02553ba02a82049f4614149f9932c116b

SHA512
635db850fcbcb76af68059f43bca779292dba728a80758e032ca55e36fa672983bad87b3f5e9e669059726a668d9dd564958b0ae248b23b68175b2c141c468a3

Download Submit
C:\Program Files\WindowsPowerShell\Configuration\Schema\RCXB408.tmp

Filesize
1.5MB

MD5
f3a53bc15a1905a9533d34b82ee75c5e

SHA1
410039dea60685fff80d421637e0c38a5c303a47

SHA256
b7915c8037f190d29913d45ee3e434969cf16627cb17c26b2f0436876fc1305a

SHA512
cba596b9a48c34e72a82fe94b46fcba08d68ae92502c443355a11a50060c5f7ab63d41a186d56f816d6d2fb5122eb1ca3c72d94037dabd77e3742f79c39170fc

Download Submit
C:\ProgramData\Microsoft\Windows\Templates\upfc.exe

Filesize
1.5MB

MD5
7a4f0846743a7071ffdd25abc446b107

SHA1
996c98355bdb997ad8d5d02283ca06438c959cd1

SHA256
3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c

SHA512
fcb17641446ebd06321192777fca64d7c0b5a9c143eeb46884228d6d6996da928e02043b0b0d335b99c998695cb2f4d7b21d212784ca09e785f6ca12f342ed8e

Download Submit
C:\Recovery\WindowsRE\9e8d7a4ca61bd9

Filesize
838B

MD5
6fc8163e9a43a67cf075357de81808f8

SHA1
0aab93c718644bfe3a933e4a8f49e30cbe9d90c6

SHA256
948a1c8c654721340d85751f3648cdbdeea1ac4f42064137a113ea4169f688be

SHA512
b396ee0789ab2c1aee6bd272a22baa4d275fb91a10130c9c9450e405af364cb1349fb6ab3a152c4d6939ab98172f0fc726c6fbde78ec1a6083dc230cbface2ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\3d8d0017657e423983aa082f3bea85494c8c75a8464f02e179a670d9f9a7e36c.exe.log

Filesize
1KB

MD5
7800fca2323a4130444c572374a030f4

SHA1
40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa

SHA256
29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e

SHA512
c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Filesize
1KB

MD5
3ad9a5252966a3ab5b1b3222424717be

SHA1
5397522c86c74ddbfb2585b9613c794f4b4c3410

SHA256
27525f5fc7871c6828ab5173315e95b5c7e918d2ee532781c562c378584b5249

SHA512
b1a745f7a0f33b777ffc34f74f42752144d9f2d06b8bc613e703570494762b3af87e153212c3274b18af14f17b8619e2f350b7c3cc11228f7d4208d4251e90e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b4b6d4cc52b5a3a71149b1f33d94d5de

SHA1
97d3dbdd24919eab70e3b14c68797cefc07e90dd

SHA256
da8c02ce00d5b1e6d4c3667465c7bbc14d7cd5227eb634f3d9690afd488267fe

SHA512
fc894f03709b83df7d2fca2779e1e60549078b67bcdbff0b61c8e5a802982210ae971309c1f92577573299288963ab5c95c6b38cbaedf53dc6062812c57a97af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
07ab6cc81c5230a598c0ad1711b6bd97

SHA1
de7e270e12d447dfc5896b7c96777eb32725778a

SHA256
900aa2c83ec8773c3f9705f75b28fff0eaca57f7adb33dc82564d7ea8f8069a3

SHA512
ffef0ad0824ea0fdab29eb3c44448100f79365a1729c7665eba9aef85a88e60901bc6a6c248de15a28d21be9ce5839d68861e4449ff557d8845927c740ba3a25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
caae66b2d6030f85188e48e4ea3a9fa6

SHA1
108425bd97144fa0f92ff7b2109fec293d14a461

SHA256
a6c642eaf80247e9682be60ab5ae9ece4d042af56013d164d8047b6fd1aefa1d

SHA512
189119a2390e51a49ea0fb8ad1427279cc2bf85f220f3212957c50b33387623b42ab7736fb5a717757b5c4b99c570e7ed2e5e6a578424aafb5c126cdf129ea15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
085e0a3b869f290afea5688a8ac4e7c5

SHA1
0fedef5057708908bcca9e7572be8f46cef4f3ca

SHA256
1fed2c9bc05b3fcb93f493124dbf1680c6445f67e3d49680257183132514509c

SHA512
bbac0555a05dbe83154a90caa44a653c8a05c87594a211548b165c5b1d231e3818830e754c0b6de3e5cb64dba3a5ad18bebae05cb9157e1dd46bce2a86d18ede

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be67063c62a242565760a02a642a9f02

SHA1
d1043a892b44d6676f71b568f578fff947266a19

SHA256
56f158298dc5f781d6636a0b15d040f9cffb1d46cd11079aa40a26b662217f48

SHA512
90d2cbd882ff8043412ad25e74df0cf6b71d6f3fbdfa6f1efa0efc8eed86a925606c7d2e967f112a34d3f0e04f01a396898508571400dcf7e6fd69e78f406638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a9a7f35c006bbf5da72f9cb250ffbddb

SHA1
458a8cedc38dac109631d9fccb3bf6d2c5c0e89e

SHA256
a1db56d56e35a6c95f98204e40f69f70422969681d408e5edc4afbf732eef86b

SHA512
d341773d30e09214567c65f24cd1854f1e438b8528aa30d35b6baac16e671dde1245edda654f19343b7c160da45985ab53f08453e7f6286e272d544f8741c131

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4f473e15a0686d0c819ad40b5f232368

SHA1
a769892ae2e8203e7d4a992a317189b56723da33

SHA256
53d6c0d9a801d45fefdcec9b3ecf217fef683efc4e40ba9c72f0116ee4d20237

SHA512
d9b43132432078d5496688717253e58e7caab0dcbd20fc41fa8a718d11d699e93ee198f18be4243ed34bcf8912e1377888fe72ae5b26d920e765ab523f0bdf55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
7a451cd1316d70a65910773fee8c3a43

SHA1
d2db32d5037153dd1d94565b51b5b385817a3c3d

SHA256
862d25ed22075f3d1f5e8d29a3c6e050dc91e53a4dc653c3f0f7c627a12ee26c

SHA512
60887f795036fbd6d25234c17dab4463a8a02f576ae8c07dd7b4c4ff1dba35f99b7301139ea051a7a80fdfc9e003a2f0c2dd0d444a82ecf87a3df21507332aa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\2aa8095c-147b-45be-80ff-9769f1d25a76.vbs

Filesize
704B

MD5
b4687ba461a6821cde48e9ca6940cfeb

SHA1
c676caa77418ab1c30ddfec6f01ca530e9216c90

SHA256
83ce7ebe9604172415aead8ab22d432e848ee0c08c4954cf5d333b791e8445e2

SHA512
8ab9a3096a9a6f2cbd96c5c85a523f9b5594531a5fe03f3560fe0187fc332c013c6df857a728d2a6bb5ff456e0e712e5602c794191ff8e120cc7003e27abafae

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fmsvlh0j.rst.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b6cbe892-e992-42ba-b6db-9c7f3956065c.vbs

Filesize
480B

MD5
b3fd0973fd04c59f7d691582e9c31cc2

SHA1
1aade1d53ffaee1cf2f63b2a7da87618186f72ea

SHA256
2a36b3738d8fdecc97ade76fc16e75caf4aa37f4b2b53e58ab3d3f4be597636e

SHA512
e14065013fff66ca370260bc5db8046da5df108813280556bcb6638cc28b5b5f97fc9fc90d4c38114b02eb82970a8482f20279f2c42b5e8a4c512196a66d9a28

Download Submit
C:\Users\Admin\AppData\Local\Temp\kfm9ff3F0u.bat

Filesize
192B

MD5
4df7ea9e7e129e10ca248678328c9643

SHA1
c88c522e354286e815ad6e5ab5d34bbf82da0dd8

SHA256
362bf4b523b055978395b4346bc5df8f54507cd336ec9bf49b2f29c506531dfe

SHA512
a68f7a5b9c4e619141e0b9941e794d4d7b8c5420ce617e3e80714a99100112f07a68adda12c6eb0e87cd6eb4f029e65a3a7007b6354db44a98ad205395aff255

Download Submit
memory/4676-131-0x000001F8CCB20000-0x000001F8CCB42000-memory.dmp

Filesize
136KB

Download
memory/4808-11-0x000000001B160000-0x000000001B16A000-memory.dmp

Filesize
40KB

Download
memory/4808-10-0x000000001B150000-0x000000001B15C000-memory.dmp

Filesize
48KB

Download
memory/4808-234-0x00007FF8BE390000-0x00007FF8BEE51000-memory.dmp

Filesize
10.8MB

Download
memory/4808-231-0x00007FF8BE390000-0x00007FF8BEE51000-memory.dmp

Filesize
10.8MB

Download
memory/4808-120-0x00007FF8BE393000-0x00007FF8BE395000-memory.dmp

Filesize
8KB

Download
memory/4808-13-0x000000001B1D0000-0x000000001B1DA000-memory.dmp

Filesize
40KB

Download
memory/4808-14-0x000000001B1E0000-0x000000001B1EC000-memory.dmp

Filesize
48KB

Download
memory/4808-12-0x000000001B170000-0x000000001B17C000-memory.dmp

Filesize
48KB

Download
memory/4808-0-0x00007FF8BE393000-0x00007FF8BE395000-memory.dmp

Filesize
8KB

Download
memory/4808-1-0x0000000000350000-0x00000000004DC000-memory.dmp

Filesize
1.5MB

Download
memory/4808-9-0x000000001B130000-0x000000001B13C000-memory.dmp

Filesize
48KB

Download
memory/4808-8-0x000000001B140000-0x000000001B150000-memory.dmp

Filesize
64KB

Download
memory/4808-6-0x0000000002730000-0x0000000002740000-memory.dmp

Filesize
64KB

Download
memory/4808-7-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/4808-5-0x0000000000D00000-0x0000000000D10000-memory.dmp

Filesize
64KB

Download
memory/4808-4-0x000000001B180000-0x000000001B1D0000-memory.dmp

Filesize
320KB

Download
memory/4808-3-0x0000000000D20000-0x0000000000D3C000-memory.dmp

Filesize
112KB

Download
memory/4808-2-0x00007FF8BE390000-0x00007FF8BEE51000-memory.dmp

Filesize
10.8MB

Download
memory/4984-235-0x000000001B9F0000-0x000000001BA02000-memory.dmp

Filesize
72KB

Download