dcrat | baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2025 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Size

984KB
MD5

c7c936018ed654eb04b5134b6254af77
SHA1

051a69111ace14b75dc7a1efb75d573ded9bf65c
SHA256

baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad
SHA512

72bebc9aadd789ceed81aa7110524fbf841e791af46e5b57b3235d4da6266f19ff608b4fac97b3d397e39b939aa55f671301b30b1a6b7d6d0b709da945a6a6ae
SSDEEP

12288:MyEIOYTNEIf5AycvEhKIV6tEcln0Ai2a61h3cQ9Fk+ntGoWuzsx1oiLgoJ:MyErYT+PvXIUln/1GJgo

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		528	schtasks.exe
		5088	schtasks.exe
		4692	schtasks.exe
		1844	schtasks.exe
		1356	schtasks.exe
		2524	schtasks.exe
		1104	schtasks.exe
		3992	schtasks.exe
		4484	schtasks.exe
		4420	schtasks.exe
		1768	schtasks.exe
		2028	schtasks.exe
		5068	schtasks.exe
File created	C:\Windows\Provisioning\56085415360792		baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
		388	schtasks.exe
		3084	schtasks.exe
		1668	schtasks.exe
		2800	schtasks.exe
		4160	schtasks.exe
		2896	schtasks.exe
		2856	schtasks.exe
		4508	schtasks.exe
		1320	schtasks.exe
		844	schtasks.exe
		5104	schtasks.exe
		1244	schtasks.exe
		2552	schtasks.exe
		3776	schtasks.exe
		3636	schtasks.exe
		3472	schtasks.exe
		2576	schtasks.exe
		2912	schtasks.exe
		4476	schtasks.exe
		2412	schtasks.exe
		2400	schtasks.exe
		4128	schtasks.exe
		1660	schtasks.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\e1ef82546f0b02		baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
		1560	schtasks.exe
		3544	schtasks.exe
		2088	schtasks.exe
		2376	schtasks.exe
		2172	schtasks.exe
		3136	schtasks.exe
		2368	schtasks.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\eddb19405b7ce1		baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\Common Files\aa97147c4c782d		baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
		4676	schtasks.exe
		840	schtasks.exe
		3912	schtasks.exe
		2860	schtasks.exe
		2664	schtasks.exe
		664	schtasks.exe
		3912	schtasks.exe
		4956	schtasks.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\eddb19405b7ce1		baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
		4200	schtasks.exe
		948	schtasks.exe
		4536	schtasks.exe
		3664	schtasks.exe
		4996	schtasks.exe
		880	schtasks.exe
		1992	schtasks.exe
		396	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4692	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4128	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3544	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4156	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3776	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3420	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4420	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	528	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	2144	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2144	schtasks.exe	85

UAC bypass 3 TTPs 9 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	powershell.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/844-1-0x0000000000320000-0x000000000041C000-memory.dmp	dcrat
behavioral2/files/0x0007000000023cc9-25.dat	dcrat
behavioral2/files/0x000b000000023cbd-97.dat	dcrat
behavioral2/files/0x000c000000023cbd-107.dat	dcrat
behavioral2/files/0x0007000000023ce1-143.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2344	powershell.exe
740	powershell.exe
4520	powershell.exe
4988	powershell.exe
2632	powershell.exe
4952	powershell.exe
872	powershell.exe
3932	powershell.exe
1944	powershell.exe
4508	powershell.exe
1564	powershell.exe
2816	powershell.exe
2560	powershell.exe
3240	powershell.exe
4496	powershell.exe
840	powershell.exe
4228	powershell.exe
624	powershell.exe
4660	powershell.exe
3096	powershell.exe
4924	powershell.exe
2264	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe

Executes dropped EXE 2 IoCs

pid	Process
2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
1792	powershell.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Drops file in Program Files directory 50 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\OfficeClickToRun.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\backgroundTaskHost.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\eddb19405b7ce1	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\Registry.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\backgroundTaskHost.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\eddb19405b7ce1	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files (x86)\Common Files\RCXDFFB.tmp	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\SppExtComObj.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\csrss.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\886983d96e3d3e	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\Windows Defender\powershell.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\backgroundTaskHost.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\backgroundTaskHost.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\csrss.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files\Windows Portable Devices\9e8d7a4ca61bd9	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\RCXEA73.tmp	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files\Windows Media Player\Skins\ea1d8f6d871115	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\Windows Media Player\conhost.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\powershell.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\Common Files\aa97147c4c782d	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\e1ef82546f0b02	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\RCXD6AB.tmp	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files (x86)\Windows NT\conhost.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\eddb19405b7ce1	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\SppExtComObj.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\backgroundTaskHost.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files\Windows Portable Devices\e6c9b481da804f	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files\7-Zip\Lang\e6c9b481da804f	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\Windows NT\088424020bedd6	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files\Windows Media Player\Skins\upfc.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\Common Files\MusNotification.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\RCXEA04.tmp	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\Windows Media Player\088424020bedd6	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\Windows NT\conhost.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files\7-Zip\Lang\OfficeClickToRun.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\RCXD6AC.tmp	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files (x86)\Common Files\MusNotification.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\Common Files\Services\Registry.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files\Windows Media Player\Skins\upfc.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\Windows Defender\e978f868350d50	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\conhost.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files (x86)\Common Files\RCXDF8D.tmp	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\RCXE782.tmp	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\RCXE783.tmp	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\Common Files\Services\ee2ad38f3d4382	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\backgroundTaskHost.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Provisioning\wininit.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Windows\schemas\CodeIntegrity\ExamplePolicies\fontdrvhost.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Windows\Provisioning\wininit.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Windows\Provisioning\56085415360792	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Windows\Containers\serviced\RCXD8B1.tmp	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Windows\Containers\serviced\RCXD8C1.tmp	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Windows\Provisioning\RCXDD68.tmp	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Windows\Provisioning\RCXDD78.tmp	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Windows\Containers\serviced\MusNotification.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Windows\Containers\serviced\aa97147c4c782d	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File opened for modification	C:\Windows\Containers\serviced\MusNotification.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Windows\schemas\CodeIntegrity\ExamplePolicies\fontdrvhost.exe	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
File created	C:\Windows\schemas\CodeIntegrity\ExamplePolicies\5b884080fd4f94	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2896	schtasks.exe
2376	schtasks.exe
1228	schtasks.exe
2552	schtasks.exe
2368	schtasks.exe
3420	schtasks.exe
2616	schtasks.exe
2856	schtasks.exe
528	schtasks.exe
1356	schtasks.exe
4156	schtasks.exe
2388	schtasks.exe
3664	schtasks.exe
1668	schtasks.exe
3136	schtasks.exe
4956	schtasks.exe
3636	schtasks.exe
4536	schtasks.exe
1528	schtasks.exe
2576	schtasks.exe
2912	schtasks.exe
3636	schtasks.exe
840	schtasks.exe
1244	schtasks.exe
1352	schtasks.exe
4128	schtasks.exe
3992	schtasks.exe
4420	schtasks.exe
3472	schtasks.exe
844	schtasks.exe
948	schtasks.exe
4692	schtasks.exe
4956	schtasks.exe
1992	schtasks.exe
2172	schtasks.exe
3912	schtasks.exe
2464	schtasks.exe
1320	schtasks.exe
4996	schtasks.exe
1560	schtasks.exe
4536	schtasks.exe
4484	schtasks.exe
388	schtasks.exe
1760	schtasks.exe
4056	schtasks.exe
1520	schtasks.exe
2828	schtasks.exe
1844	schtasks.exe
3776	schtasks.exe
2436	schtasks.exe
664	schtasks.exe
5068	schtasks.exe
3912	schtasks.exe
2088	schtasks.exe
872	schtasks.exe
5104	schtasks.exe
1768	schtasks.exe
4476	schtasks.exe
2664	schtasks.exe
4508	schtasks.exe
2400	schtasks.exe
1104	schtasks.exe
2028	schtasks.exe
2372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
3932	powershell.exe
3932	powershell.exe
4508	powershell.exe
4508	powershell.exe
4520	powershell.exe
4520	powershell.exe
3240	powershell.exe
3240	powershell.exe
2264	powershell.exe
2264	powershell.exe
2560	powershell.exe
2560	powershell.exe
4924	powershell.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	3240	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	3096	powershell.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeDebugPrivilege	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Token: SeDebugPrivilege	872	powershell.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	740	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	4988	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 624	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	123
PID 844 wrote to memory of 624	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	123
PID 844 wrote to memory of 4924	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	124
PID 844 wrote to memory of 4924	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	124
PID 844 wrote to memory of 2560	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	125
PID 844 wrote to memory of 2560	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	125
PID 844 wrote to memory of 4660	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	126
PID 844 wrote to memory of 4660	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	126
PID 844 wrote to memory of 3096	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	127
PID 844 wrote to memory of 3096	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	127
PID 844 wrote to memory of 2264	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	128
PID 844 wrote to memory of 2264	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	128
PID 844 wrote to memory of 3932	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	129
PID 844 wrote to memory of 3932	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	129
PID 844 wrote to memory of 1944	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	130
PID 844 wrote to memory of 1944	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	130
PID 844 wrote to memory of 4520	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	131
PID 844 wrote to memory of 4520	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	131
PID 844 wrote to memory of 4508	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	132
PID 844 wrote to memory of 4508	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	132
PID 844 wrote to memory of 3240	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	133
PID 844 wrote to memory of 3240	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	133
PID 844 wrote to memory of 2656	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	145
PID 844 wrote to memory of 2656	844	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	145
PID 2656 wrote to memory of 4988	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	202
PID 2656 wrote to memory of 4988	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	202
PID 2656 wrote to memory of 2632	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	203
PID 2656 wrote to memory of 2632	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	203
PID 2656 wrote to memory of 4496	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	204
PID 2656 wrote to memory of 4496	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	204
PID 2656 wrote to memory of 4952	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	205
PID 2656 wrote to memory of 4952	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	205
PID 2656 wrote to memory of 1564	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	206
PID 2656 wrote to memory of 1564	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	206
PID 2656 wrote to memory of 840	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	207
PID 2656 wrote to memory of 840	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	207
PID 2656 wrote to memory of 2816	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	208
PID 2656 wrote to memory of 2816	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	208
PID 2656 wrote to memory of 872	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	209
PID 2656 wrote to memory of 872	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	209
PID 2656 wrote to memory of 2344	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	210
PID 2656 wrote to memory of 2344	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	210
PID 2656 wrote to memory of 740	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	211
PID 2656 wrote to memory of 740	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	211
PID 2656 wrote to memory of 4228	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	212
PID 2656 wrote to memory of 4228	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	212
PID 2656 wrote to memory of 412	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	224
PID 2656 wrote to memory of 412	2656	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe	224
PID 412 wrote to memory of 4596	412	cmd.exe	226
PID 412 wrote to memory of 4596	412	cmd.exe	226
PID 412 wrote to memory of 1792	412	cmd.exe	228
PID 412 wrote to memory of 1792	412	cmd.exe	228

System policy modification 1 TTPs 9 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
"C:\Users\Admin\AppData\Local\Temp\baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe"
1⤵
- DcRat
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3240
- C:\Users\Admin\AppData\Local\Temp\baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe
  "C:\Users\Admin\AppData\Local\Temp\baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4228
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3CX563UFPi.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:4596
  - - C:\Users\All Users\Documents\powershell.exe
      "C:\Users\All Users\Documents\powershell.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 12 /tr "'C:\Windows\Containers\serviced\MusNotification.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\MusNotification.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 12 /tr "'C:\Windows\Containers\serviced\MusNotification.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Windows\Provisioning\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Provisioning\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\Provisioning\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\MusNotification.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Media Player\Network Sharing\SppExtComObj.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Network Sharing\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\Network Sharing\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Windows\schemas\CodeIntegrity\ExamplePolicies\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\schemas\CodeIntegrity\ExamplePolicies\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\schemas\CodeIntegrity\ExamplePolicies\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Music\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Users\Default\Music\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Music\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\Lang\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Lang\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Services\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Services\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Documents\powershell.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Users\All Users\Documents\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Documents\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\Skins\upfc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Skins\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\Skins\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\csrss.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\unsecapp.exe'" /f
1⤵
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Default User\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\conhost.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\powershell.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\conhost.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\conhost.exe'" /rl HIGHEST /f
1⤵
PID:3856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\conhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\MusNotification.exe

Filesize
984KB

MD5
c7c936018ed654eb04b5134b6254af77

SHA1
051a69111ace14b75dc7a1efb75d573ded9bf65c

SHA256
baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad

SHA512
72bebc9aadd789ceed81aa7110524fbf841e791af46e5b57b3235d4da6266f19ff608b4fac97b3d397e39b939aa55f671301b30b1a6b7d6d0b709da945a6a6ae

Download Submit
C:\Program Files (x86)\Common Files\MusNotification.exe

Filesize
984KB

MD5
66da93f149faac422787af8138b9925e

SHA1
d5a6c51f72779a4fb9acb45820b400d47b27b44d

SHA256
502e351211fdcb9d262138902f4e121daebf4ed279897df63bbfba10f5e57e49

SHA512
664538d3f8747398a2f61df489679992e1b2885142549c893027f2009231af8c286e1fa97d0956de7a3d667b899b7e993ad4b8326bd0c2d74836f1c732c210f5

Download Submit
C:\Program Files\Windows Media Player\Network Sharing\SppExtComObj.exe

Filesize
984KB

MD5
f7921869e96bf3bc2f237495eca1b0d2

SHA1
49422e732e87744c71de2abbcbac614dc8435faf

SHA256
1ec431137a24204ff7a5700f56a16e342fabe786526efa7a49fdba640ee1ea9b

SHA512
95384629fed1cf01fdd80f34c036966481efc99534c682d934a20c516e4e1313cfa7f277b6d98515b866e8132e92363dfa454558152611f03ca1cf4cb5bf1f3a

Download Submit
C:\Recovery\WindowsRE\9e8d7a4ca61bd9

Filesize
421B

MD5
1a8d5f4b212a5ea5e542b8d5c6e5527b

SHA1
cd0f50fbf47847a49bf71818b6be41c9fbc96804

SHA256
7653adce99d7ad7451584edd673b4ecea963cada01b3a859d7282d7682795374

SHA512
0994574e1ef2749815ea7e25d0f6414f7d0a0c857109f22ce5cb9736867b379d384254832a408741ecc3330244c683ebf97b75888048cf3a23cf5f2f04cadd84

Download Submit
C:\Recovery\WindowsRE\csrss.exe

Filesize
984KB

MD5
d5d705cb39cd3172b348a823957462df

SHA1
e392de6407a53b17e2efb98e337f508a94606356

SHA256
148d59363056e386d44cc9d4b21c89da399d38b7a709820086bf45698e0bbaae

SHA512
e09265fd2aa7c2de77309519685187dd7a70a91378a9b41dd9dbdaef585d1308e235dbabd2e60ce4f33acf90b956997fa9f5a20ea1ec2a43a4da0c49aa421b54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\baa24da08c1fa8c1493de69e06c6d27479f7bddec69219ae7449ea0831dafaad.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4d8567f2d1c8a09bbfe613145bf78577

SHA1
f2af10d629e6d7d2ecec76c34bd755ecf61be931

SHA256
7437b098af4618fbcefe7522942c862aeaf39a0b82ce05b0797185c552f22a3c

SHA512
89130e5c514e33f5108e308f300614dc63989f3e6a4e762a12982af341ab1c5748dd93fd185698dcf6d3a1ea7234228d04ad962e4ee0a15a683e988f115a84ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0fd3f36f28a947bdd05f1e05acf24489

SHA1
cf12e091a80740df2201c5b47049dd231c530ad3

SHA256
d36c21211f297a74a801881707690fa7a0a0a31addd3c7ba1522275b8848ab50

SHA512
5f132308b06e621aace1091f523649bcb5d1823b478691799791f4154cb96b9897f563eed8ad8db4a03714d815246479372e0920c659eb3fd9006271e58429ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9405862a3b15dc34824f6a0e5f077f4f

SHA1
bbe0000e06be94fa61d6e223fb38b1289908723d

SHA256
0a0869426bca171c080316948a4638a7152018ea5e07de97b2d51e0d90905210

SHA512
fc7ae988b81dec5b13ae9878350cd9d063538bfb2bc14f099087836ed54cd77a36bc7c4276fa075a80a3cd20e7620fa2ba5a8b5b7bf98698b10752749187148d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0ecb4c8cbf1b907ee900de4fc708d5a1

SHA1
7a1c83f2d215a1390a6d8fb92f06b48f54b718d8

SHA256
cfc485d9de147f1655a260504eb69d24f4d85e335f0ce712cfe750bf697456d7

SHA512
8ef2478b6e75143c40f20c86f523d23ab6319d8613381d2d15c789e9e7c4bb6683926ce94a165d4697acbb9ecbed5d7c3293d4a0501bcd7ab5d36a29dbc14cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0517d7daa86e87ab93c37adcb931f498

SHA1
6b243308a84f033c4943c7f63c0f824d8db31a13

SHA256
3a962e5df85eedfa6b55bc984b49cf87f3ee67b81b849121f05defb6cafcad28

SHA512
a573701c9048be1cc7562d76ad5c5ec3be0928d476bcd2deb18e7585391d5d239dea81b528279f2d97c9dff6c08e1c10251b8e7ac162e6b57e602d2d9818593b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3c625954a51c4bbd8141206b00f6fc0a

SHA1
4128cb2f9d2984844e303e2e330e448334e5c273

SHA256
952515feb4929cfad2435c679a5fad19242e938e8a7c97afebb1f3d996bd3ec4

SHA512
3f7c4ea0551de5b6237ca13419413e6e73e85632e9bb09b5354d6310b5969f9c3a2dc27142e75e8572c2c65b2bc7615269fad27dcea2f91c389b6758e2630517

Download Submit
C:\Users\Admin\AppData\Local\Temp\3CX563UFPi.bat

Filesize
208B

MD5
783fc1e6b6ca90f248865b7dab03c667

SHA1
45d6bc2af01a4d8e5cbc24c40baabdbb71d89f1e

SHA256
ae7aba8bfd2ca8d811aa3f39fcb165cb5ebe1f61e64356fdb72905c746868808

SHA512
8b4b236da73b59abc7a5be1953c5dbb68274a100c15c19157a30b2f24c8696b2bca754714549b684ac85a65d9839edae6caed43fb2e198b30531d3d3c3b6a0ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u0qis0ii.sry.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/740-469-0x000001C1EE1E0000-0x000001C1EE34A000-memory.dmp

Filesize
1.4MB

Download
memory/840-484-0x000001F96E4A0000-0x000001F96E60A000-memory.dmp

Filesize
1.4MB

Download
memory/844-257-0x00007FF840FE0000-0x00007FF841AA1000-memory.dmp

Filesize
10.8MB

Download
memory/844-5-0x000000001B030000-0x000000001B040000-memory.dmp

Filesize
64KB

Download
memory/844-159-0x00007FF840FE0000-0x00007FF841AA1000-memory.dmp

Filesize
10.8MB

Download
memory/844-254-0x00007FF840FE0000-0x00007FF841AA1000-memory.dmp

Filesize
10.8MB

Download
memory/844-134-0x00007FF840FE3000-0x00007FF840FE5000-memory.dmp

Filesize
8KB

Download
memory/844-18-0x00007FF840FE0000-0x00007FF841AA1000-memory.dmp

Filesize
10.8MB

Download
memory/844-14-0x000000001B0C0000-0x000000001B0CC000-memory.dmp

Filesize
48KB

Download
memory/844-17-0x00007FF840FE0000-0x00007FF841AA1000-memory.dmp

Filesize
10.8MB

Download
memory/844-11-0x000000001B090000-0x000000001B098000-memory.dmp

Filesize
32KB

Download
memory/844-12-0x000000001B0A0000-0x000000001B0AE000-memory.dmp

Filesize
56KB

Download
memory/844-13-0x000000001B0B0000-0x000000001B0BC000-memory.dmp

Filesize
48KB

Download
memory/844-9-0x000000001B080000-0x000000001B08C000-memory.dmp

Filesize
48KB

Download
memory/844-10-0x000000001B210000-0x000000001B21C000-memory.dmp

Filesize
48KB

Download
memory/844-8-0x000000001B070000-0x000000001B07C000-memory.dmp

Filesize
48KB

Download
memory/844-4-0x0000000002540000-0x0000000002548000-memory.dmp

Filesize
32KB

Download
memory/844-158-0x00007FF840FE0000-0x00007FF841AA1000-memory.dmp

Filesize
10.8MB

Download
memory/844-0-0x00007FF840FE3000-0x00007FF840FE5000-memory.dmp

Filesize
8KB

Download
memory/844-1-0x0000000000320000-0x000000000041C000-memory.dmp

Filesize
1008KB

Download
memory/844-6-0x000000001B040000-0x000000001B056000-memory.dmp

Filesize
88KB

Download
memory/844-7-0x000000001B060000-0x000000001B06A000-memory.dmp

Filesize
40KB

Download
memory/844-3-0x0000000002530000-0x000000000253E000-memory.dmp

Filesize
56KB

Download
memory/844-2-0x00007FF840FE0000-0x00007FF841AA1000-memory.dmp

Filesize
10.8MB

Download
memory/872-458-0x0000020E9B2A0000-0x0000020E9B40A000-memory.dmp

Filesize
1.4MB

Download
memory/1564-472-0x00000283EEAE0000-0x00000283EEC4A000-memory.dmp

Filesize
1.4MB

Download
memory/2344-480-0x0000020DBE140000-0x0000020DBE2AA000-memory.dmp

Filesize
1.4MB

Download
memory/2632-467-0x000002DB3CFA0000-0x000002DB3D10A000-memory.dmp

Filesize
1.4MB

Download
memory/2816-460-0x00000282B8170000-0x00000282B82DA000-memory.dmp

Filesize
1.4MB

Download
memory/4228-481-0x00000240536A0000-0x000002405380A000-memory.dmp

Filesize
1.4MB

Download
memory/4496-468-0x0000011D59C00000-0x0000011D59D6A000-memory.dmp

Filesize
1.4MB

Download
memory/4508-177-0x00000176FE270000-0x00000176FE292000-memory.dmp

Filesize
136KB

Download
memory/4952-475-0x000002A9777E0000-0x000002A97794A000-memory.dmp

Filesize
1.4MB

Download
memory/4988-459-0x000001867D2B0000-0x000001867D41A000-memory.dmp

Filesize
1.4MB

Download