Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
13/01/2025, 01:26
Behavioral task
behavioral1
Sample
74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe
Resource
win7-20241010-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe
-
Size
2.2MB
-
MD5
812ac1ea0b1d66a93d0beca70cc28cbe
-
SHA1
c5cff3dc9a2503521de74a7d4cda2f678f5bb575
-
SHA256
74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3
-
SHA512
01acc3b99130f0d263917e4e362caf25841b21e3a9a82ce40004db96239ebcc8762a57ebad020ed704213596a100d060475cd9fd61c5bd4df9a35ff14d4cc6f6
-
SSDEEP
49152:K31tZUmbFNH1wLJDPqTo9lIS/MXU2F4/1l5eQ7K6:KltZUE6NDyTo9lv2F+VvK6
Score
10/10
Malware Config
Signatures
-
DcRat 64 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process 1672 schtasks.exe 1608 schtasks.exe 2472 schtasks.exe 2180 schtasks.exe 776 schtasks.exe 2428 schtasks.exe 2852 schtasks.exe 2580 schtasks.exe 2988 schtasks.exe 2016 schtasks.exe 2468 schtasks.exe 1940 schtasks.exe 2536 schtasks.exe 1480 schtasks.exe 2516 schtasks.exe 2468 schtasks.exe 1132 schtasks.exe 1328 schtasks.exe 2284 schtasks.exe 896 schtasks.exe 2764 schtasks.exe 2232 schtasks.exe 2772 schtasks.exe 2636 schtasks.exe 1660 schtasks.exe 2168 schtasks.exe 1868 schtasks.exe 1916 schtasks.exe 2660 schtasks.exe 2548 schtasks.exe 2056 schtasks.exe 2712 schtasks.exe 1456 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 332 schtasks.exe 528 schtasks.exe 1148 schtasks.exe 2752 schtasks.exe 2456 schtasks.exe 1608 schtasks.exe 2096 schtasks.exe 1260 schtasks.exe 2432 schtasks.exe 1612 schtasks.exe 2908 schtasks.exe 1804 schtasks.exe 1284 schtasks.exe 1664 schtasks.exe 2284 schtasks.exe 2032 schtasks.exe 1496 schtasks.exe 2140 schtasks.exe 2360 schtasks.exe 1872 schtasks.exe 1864 schtasks.exe 2208 schtasks.exe 1204 schtasks.exe 1752 schtasks.exe 528 schtasks.exe 2652 schtasks.exe 2064 schtasks.exe 2908 schtasks.exe 1812 schtasks.exe 1900 schtasks.exe -
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\", \"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\", \"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\wininit.exe\", \"C:\\Users\\Default\\Pictures\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\taskhost.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\explorer.exe\", \"C:\\Windows\\CSC\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\smss.exe\", \"C:\\Windows\\Temp\\Crashpad\\attachments\\sppsvc.exe\", \"C:\\Users\\Public\\Videos\\smss.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\", \"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\wininit.exe\", \"C:\\Users\\Default\\Pictures\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\taskhost.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\", \"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\wininit.exe\", \"C:\\Users\\Default\\Pictures\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\taskhost.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\explorer.exe\", \"C:\\Windows\\CSC\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\smss.exe\", \"C:\\Windows\\Temp\\Crashpad\\attachments\\sppsvc.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\", \"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\wininit.exe\", \"C:\\Users\\Default\\Pictures\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\taskhost.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\explorer.exe\", \"C:\\Windows\\CSC\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\smss.exe\", \"C:\\Windows\\Temp\\Crashpad\\attachments\\sppsvc.exe\", \"C:\\Users\\Public\\Videos\\smss.exe\", \"C:\\Windows\\Logs\\Idle.exe\", \"C:\\Users\\Public\\Downloads\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Favorites\\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\", \"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\wininit.exe\", \"C:\\Users\\Default\\Pictures\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\taskhost.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\explorer.exe\", \"C:\\Windows\\CSC\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\smss.exe\", \"C:\\Windows\\Temp\\Crashpad\\attachments\\sppsvc.exe\", \"C:\\Users\\Public\\Videos\\smss.exe\", \"C:\\Windows\\Logs\\Idle.exe\", \"C:\\Users\\Public\\Downloads\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Favorites\\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\", \"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\wininit.exe\", \"C:\\Users\\Default\\Pictures\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\taskhost.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\explorer.exe\", \"C:\\Windows\\CSC\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\smss.exe\", \"C:\\Windows\\Temp\\Crashpad\\attachments\\sppsvc.exe\", \"C:\\Users\\Public\\Videos\\smss.exe\", \"C:\\Windows\\Logs\\Idle.exe\", \"C:\\Users\\Public\\Downloads\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Favorites\\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows Portable Devices\\lsass.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\", \"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\wininit.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\", \"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\wininit.exe\", \"C:\\Users\\Default\\Pictures\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\taskhost.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\explorer.exe\", \"C:\\Windows\\CSC\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\smss.exe\", \"C:\\Windows\\Temp\\Crashpad\\attachments\\sppsvc.exe\", \"C:\\Users\\Public\\Videos\\smss.exe\", \"C:\\Windows\\Logs\\Idle.exe\", \"C:\\Users\\Public\\Downloads\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Favorites\\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows Portable Devices\\lsass.exe\", \"C:\\Windows\\PolicyDefinitions\\dwm.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\", \"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\wininit.exe\", \"C:\\Users\\Default\\Pictures\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\taskhost.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\explorer.exe\", \"C:\\Windows\\CSC\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\smss.exe\", \"C:\\Windows\\Temp\\Crashpad\\attachments\\sppsvc.exe\", \"C:\\Users\\Public\\Videos\\smss.exe\", \"C:\\Windows\\Logs\\Idle.exe\", \"C:\\Users\\Public\\Downloads\\WmiPrvSE.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\", \"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\wininit.exe\", \"C:\\Users\\Default\\Pictures\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\taskhost.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\explorer.exe\", \"C:\\Windows\\CSC\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\smss.exe\", \"C:\\Windows\\Temp\\Crashpad\\attachments\\sppsvc.exe\", \"C:\\Users\\Public\\Videos\\smss.exe\", \"C:\\Windows\\Logs\\Idle.exe\", \"C:\\Users\\Public\\Downloads\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Favorites\\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows Portable Devices\\lsass.exe\", \"C:\\Windows\\PolicyDefinitions\\dwm.exe\", \"C:\\Windows\\PolicyDefinitions\\en-US\\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\lsass.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\", \"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\wininit.exe\", \"C:\\Users\\Default\\Pictures\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\taskhost.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\explorer.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\", \"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\wininit.exe\", \"C:\\Users\\Default\\Pictures\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\taskhost.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\explorer.exe\", \"C:\\Windows\\CSC\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\smss.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\", \"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\wininit.exe\", \"C:\\Users\\Default\\Pictures\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\taskhost.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\explorer.exe\", \"C:\\Windows\\CSC\\dllhost.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\", \"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\wininit.exe\", \"C:\\Users\\Default\\Pictures\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\taskhost.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\explorer.exe\", \"C:\\Windows\\CSC\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\smss.exe\", \"C:\\Windows\\Temp\\Crashpad\\attachments\\sppsvc.exe\", \"C:\\Users\\Public\\Videos\\smss.exe\", \"C:\\Windows\\Logs\\Idle.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\", \"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\wininit.exe\", \"C:\\Users\\Default\\Pictures\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\taskhost.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\explorer.exe\", \"C:\\Windows\\CSC\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\smss.exe\", \"C:\\Windows\\Temp\\Crashpad\\attachments\\sppsvc.exe\", \"C:\\Users\\Public\\Videos\\smss.exe\", \"C:\\Windows\\Logs\\Idle.exe\", \"C:\\Users\\Public\\Downloads\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Favorites\\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe\", \"C:\\Users\\Default User\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows Portable Devices\\lsass.exe\", \"C:\\Windows\\PolicyDefinitions\\dwm.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\", \"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\", \"C:\\Windows\\security\\logs\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\services.exe\", \"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\", \"C:\\Users\\All Users\\Templates\\wininit.exe\", \"C:\\Users\\Default\\Pictures\\sppsvc.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe -
Process spawned unexpected child process 64 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2752 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2064 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1456 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2908 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 528 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1496 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2140 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2580 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2360 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2284 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2660 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1940 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2764 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2988 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2168 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2180 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1812 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1900 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1608 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 332 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1260 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1480 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2652 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2472 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2516 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2432 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2468 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2232 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1612 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1672 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1132 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2548 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2536 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 528 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2056 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2772 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2908 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1456 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1328 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1148 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2016 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 776 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2416 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2428 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2712 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2032 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1804 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1872 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2456 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1864 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2284 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2852 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1608 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1916 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2096 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2208 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2636 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1204 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1284 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2468 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1752 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1868 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1536 2668 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1660 2668 schtasks.exe 30 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" WmiPrvSE.exe -
resource yara_rule behavioral1/memory/1600-1-0x0000000000930000-0x0000000000B5E000-memory.dmp dcrat behavioral1/files/0x000500000001939c-38.dat dcrat behavioral1/files/0x0007000000019490-77.dat dcrat behavioral1/files/0x000a00000001949d-170.dat dcrat behavioral1/files/0x00090000000194d0-179.dat dcrat behavioral1/memory/2812-192-0x00000000001A0000-0x00000000003CE000-memory.dmp dcrat behavioral1/memory/1988-244-0x0000000000E70000-0x000000000109E000-memory.dmp dcrat behavioral1/memory/3064-255-0x0000000001010000-0x000000000123E000-memory.dmp dcrat -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe -
Executes dropped EXE 4 IoCs
pid Process 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1988 WmiPrvSE.exe 3064 WmiPrvSE.exe 1916 WmiPrvSE.exe -
Adds Run key to start application 2 TTPs 44 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Temp\\Crashpad\\attachments\\sppsvc.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\PolicyDefinitions\\dwm.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\PolicyDefinitions\\dwm.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\All Users\\Templates\\wininit.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default\\Pictures\\sppsvc.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default\\Pictures\\sppsvc.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Microsoft Sync Framework\\smss.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\lsass.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\Logs\\Idle.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Windows Portable Devices\\lsass.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Default User\\WmiPrvSE.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Internet Explorer\\services.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\explorer.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Microsoft Sync Framework\\smss.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Public\\Videos\\smss.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Public\\Downloads\\WmiPrvSE.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\lsass.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\sppsvc.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\All Users\\Templates\\wininit.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\explorer.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Temp\\Crashpad\\attachments\\sppsvc.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Windows Portable Devices\\lsass.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Public\\Downloads\\WmiPrvSE.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3 = "\"C:\\Users\\Public\\Favorites\\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\security\\logs\\wininit.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\security\\logs\\wininit.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\taskhost.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\taskhost.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\CSC\\dllhost.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\lsass.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\Logs\\Idle.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3 = "\"C:\\Windows\\PolicyDefinitions\\en-US\\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3 = "\"C:\\Users\\Public\\Favorites\\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Default User\\WmiPrvSE.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\DigitalLocker\\ja-JP\\services.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Internet Explorer\\services.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Media Player\\Network Sharing\\wininit.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\CSC\\dllhost.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Public\\Videos\\smss.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3 = "\"C:\\Windows\\PolicyDefinitions\\en-US\\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe\"" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WmiPrvSE.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA WmiPrvSE.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WmiPrvSE.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WmiPrvSE.exe -
Drops file in Program Files directory 32 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wininit.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Program Files (x86)\Microsoft Sync Framework\69ddcba757bf72 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\0a1fd5f707cd16 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Program Files\Windows Media Player\Network Sharing\56085415360792 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\7a0fd90576e088 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX859C.tmp 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\RCX8A14.tmp 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Program Files (x86)\Internet Explorer\services.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Program Files (x86)\Internet Explorer\c5b4cb5e9653cc 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Program Files (x86)\Internet Explorer\RCX880F.tmp 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\RCX7F02.tmp 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\RCX9302.tmp 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\smss.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\sppsvc.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Program Files\Windows Media Player\Network Sharing\wininit.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Program Files (x86)\Internet Explorer\RCX880E.tmp 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\sppsvc.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Program Files (x86)\Internet Explorer\services.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Program Files (x86)\Microsoft Sync Framework\smss.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Program Files\Windows Portable Devices\lsass.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\RCX8A13.tmp 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\explorer.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Program Files\Windows Portable Devices\lsass.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Program Files\Windows Portable Devices\6203df4a6bafc7 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\explorer.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\RCX9293.tmp 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\6203df4a6bafc7 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\RCX7F01.tmp 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX859D.tmp 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe -
Drops file in Windows directory 24 IoCs
description ioc Process File opened for modification C:\Windows\CSC\RCX9574.tmp 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Windows\PolicyDefinitions\dwm.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Windows\PolicyDefinitions\en-US\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Windows\DigitalLocker\ja-JP\c5b4cb5e9653cc 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Windows\security\logs\wininit.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Windows\CSC\5940a34987c991 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Windows\DigitalLocker\ja-JP\RCX8174.tmp 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Windows\DigitalLocker\ja-JP\services.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Windows\security\logs\RCX8397.tmp 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Windows\PolicyDefinitions\en-US\8da2e5f9ab7abb 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Windows\PolicyDefinitions\dwm.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Windows\Logs\6ccacd8608530f 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Windows\PolicyDefinitions\6cb0b6c459d5d3 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Windows\Logs\Idle.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Windows\security\logs\56085415360792 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Windows\DigitalLocker\ja-JP\RCX8106.tmp 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Windows\security\logs\RCX8398.tmp 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Windows\CSC\RCX9505.tmp 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Windows\Logs\Idle.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Windows\PolicyDefinitions\en-US\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File created C:\Windows\CSC\dllhost.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Windows\DigitalLocker\ja-JP\services.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Windows\security\logs\wininit.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe File opened for modification C:\Windows\CSC\dllhost.exe 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1660 schtasks.exe 2056 schtasks.exe 2456 schtasks.exe 1804 schtasks.exe 1916 schtasks.exe 1536 schtasks.exe 2580 schtasks.exe 2432 schtasks.exe 1672 schtasks.exe 1132 schtasks.exe 2536 schtasks.exe 1868 schtasks.exe 2764 schtasks.exe 1204 schtasks.exe 2468 schtasks.exe 896 schtasks.exe 2064 schtasks.exe 528 schtasks.exe 2660 schtasks.exe 1328 schtasks.exe 2852 schtasks.exe 1608 schtasks.exe 2096 schtasks.exe 1284 schtasks.exe 1496 schtasks.exe 2652 schtasks.exe 2908 schtasks.exe 1872 schtasks.exe 1664 schtasks.exe 2772 schtasks.exe 1456 schtasks.exe 776 schtasks.exe 2516 schtasks.exe 2016 schtasks.exe 2428 schtasks.exe 2712 schtasks.exe 2284 schtasks.exe 2284 schtasks.exe 2168 schtasks.exe 2232 schtasks.exe 1612 schtasks.exe 2548 schtasks.exe 1148 schtasks.exe 528 schtasks.exe 1752 schtasks.exe 2988 schtasks.exe 2180 schtasks.exe 2468 schtasks.exe 1940 schtasks.exe 1812 schtasks.exe 1900 schtasks.exe 1260 schtasks.exe 2472 schtasks.exe 2752 schtasks.exe 2908 schtasks.exe 2140 schtasks.exe 2032 schtasks.exe 2208 schtasks.exe 332 schtasks.exe 2416 schtasks.exe 1864 schtasks.exe 1480 schtasks.exe 2636 schtasks.exe 1456 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Token: SeDebugPrivilege 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Token: SeDebugPrivilege 1988 WmiPrvSE.exe Token: SeDebugPrivilege 3064 WmiPrvSE.exe Token: SeDebugPrivilege 1916 WmiPrvSE.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1600 wrote to memory of 2672 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 64 PID 1600 wrote to memory of 2672 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 64 PID 1600 wrote to memory of 2672 1600 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 64 PID 2672 wrote to memory of 844 2672 cmd.exe 66 PID 2672 wrote to memory of 844 2672 cmd.exe 66 PID 2672 wrote to memory of 844 2672 cmd.exe 66 PID 2672 wrote to memory of 2812 2672 cmd.exe 67 PID 2672 wrote to memory of 2812 2672 cmd.exe 67 PID 2672 wrote to memory of 2812 2672 cmd.exe 67 PID 2812 wrote to memory of 1988 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 101 PID 2812 wrote to memory of 1988 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 101 PID 2812 wrote to memory of 1988 2812 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe 101 PID 1988 wrote to memory of 2504 1988 WmiPrvSE.exe 103 PID 1988 wrote to memory of 2504 1988 WmiPrvSE.exe 103 PID 1988 wrote to memory of 2504 1988 WmiPrvSE.exe 103 PID 1988 wrote to memory of 2784 1988 WmiPrvSE.exe 104 PID 1988 wrote to memory of 2784 1988 WmiPrvSE.exe 104 PID 1988 wrote to memory of 2784 1988 WmiPrvSE.exe 104 PID 2504 wrote to memory of 3064 2504 WScript.exe 105 PID 2504 wrote to memory of 3064 2504 WScript.exe 105 PID 2504 wrote to memory of 3064 2504 WScript.exe 105 PID 3064 wrote to memory of 2036 3064 WmiPrvSE.exe 106 PID 3064 wrote to memory of 2036 3064 WmiPrvSE.exe 106 PID 3064 wrote to memory of 2036 3064 WmiPrvSE.exe 106 PID 3064 wrote to memory of 2032 3064 WmiPrvSE.exe 107 PID 3064 wrote to memory of 2032 3064 WmiPrvSE.exe 107 PID 3064 wrote to memory of 2032 3064 WmiPrvSE.exe 107 PID 2036 wrote to memory of 1916 2036 WScript.exe 108 PID 2036 wrote to memory of 1916 2036 WScript.exe 108 PID 2036 wrote to memory of 1916 2036 WScript.exe 108 PID 1916 wrote to memory of 2584 1916 WmiPrvSE.exe 109 PID 1916 wrote to memory of 2584 1916 WmiPrvSE.exe 109 PID 1916 wrote to memory of 2584 1916 WmiPrvSE.exe 109 PID 1916 wrote to memory of 2264 1916 WmiPrvSE.exe 110 PID 1916 wrote to memory of 2264 1916 WmiPrvSE.exe 110 PID 1916 wrote to memory of 2264 1916 WmiPrvSE.exe 110 -
System policy modification 1 TTPs 15 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" WmiPrvSE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe"C:\Users\Admin\AppData\Local\Temp\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe"1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1600 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fpJnj91JYj.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:844
-
-
C:\Users\Admin\AppData\Local\Temp\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe"C:\Users\Admin\AppData\Local\Temp\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2812 -
C:\Users\Default User\WmiPrvSE.exe"C:\Users\Default User\WmiPrvSE.exe"4⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1988 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec06fbc8-bcc4-4da1-ab1c-bde9f35de460.vbs"5⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Default User\WmiPrvSE.exe"C:\Users\Default User\WmiPrvSE.exe"6⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3064 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a512786c-2099-41da-a026-4d888191e1b4.vbs"7⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Default User\WmiPrvSE.exe"C:\Users\Default User\WmiPrvSE.exe"8⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1916 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eccc6e67-44af-4c37-8c06-7c8f281ee8da.vbs"9⤵PID:2584
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10d92fc2-c7bb-418f-8b46-c7f66a357847.vbs"9⤵PID:2264
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\73bf45f9-79e6-4a67-b7ae-80b138998f3f.vbs"7⤵PID:2032
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2348bab9-65be-4933-be09-305e06cffec8.vbs"5⤵PID:2784
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\sppsvc.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Windows\DigitalLocker\ja-JP\services.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\ja-JP\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\ja-JP\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\security\logs\wininit.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\security\logs\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\security\logs\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
PID:2360
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\services.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\Network Sharing\wininit.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Network Sharing\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\Network Sharing\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Templates\wininit.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
PID:1608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Templates\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Templates\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1260
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Pictures\sppsvc.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Pictures\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Pictures\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\taskhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\taskhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\taskhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\explorer.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\explorer.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\explorer.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\CSC\dllhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1132
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\CSC\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\CSC\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\smss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\Temp\Crashpad\attachments\sppsvc.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Temp\Crashpad\attachments\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Windows\Temp\Crashpad\attachments\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Videos\smss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1148
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Videos\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Videos\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:776
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Windows\Logs\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Logs\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Windows\Logs\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Downloads\WmiPrvSE.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Public\Downloads\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Downloads\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e37" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Favorites\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3" /sc ONLOGON /tr "'C:\Users\Public\Favorites\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e37" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Favorites\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Portable Devices\lsass.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\PolicyDefinitions\dwm.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1204
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\PolicyDefinitions\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e37" /sc MINUTE /mo 13 /tr "'C:\Windows\PolicyDefinitions\en-US\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\en-US\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e37" /sc MINUTE /mo 8 /tr "'C:\Windows\PolicyDefinitions\en-US\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsass.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1664
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:896
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5812ac1ea0b1d66a93d0beca70cc28cbe
SHA1c5cff3dc9a2503521de74a7d4cda2f678f5bb575
SHA25674b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3
SHA51201acc3b99130f0d263917e4e362caf25841b21e3a9a82ce40004db96239ebcc8762a57ebad020ed704213596a100d060475cd9fd61c5bd4df9a35ff14d4cc6f6
-
Filesize
2.2MB
MD578210645bb7f1ac5c28fe4f9f148e866
SHA180cb7b76c11d399b8abf29f571124277a9abb1f7
SHA256852684c436ebdd7bd768f62e89323fa13ad798c2b964e13e7c66c099335cac2a
SHA51206e47f133b387bb147768000658ab5641085f202a797161792d2df8669ee91773d460805d0b9b89b3f1812d3f5ee684160c628beeea8b446638f4c193c815b2b
-
Filesize
486B
MD5c50c374c045aabcbc34eb93f6b6883e3
SHA14efe252ebd055d95257a93e7f32a87e7c81e1a39
SHA256ee24a0f1ad17fbfe5454c8240dc7e09c457e3303fd19221946a153962f6d2eb3
SHA5123466a2089dc025035d8e8a0432fd6dcff22ff9645d0bfecd1a83557c1a2cdcf7bea9d42bd3c04b7bdf996bde00ce66d6db8cb4baf0185ef4573cd0957dd2ec33
-
Filesize
710B
MD5f63d3497992fa7262c9249fc37a3b57f
SHA1abc92d86b2d92dc0274e4fa1d9acbb0b92379252
SHA2567f0b3514d1744d59da0ee93e115f7e819052add51c8ef614ca44b7dd18c74e41
SHA512847b02ec3499895d93a06e3aea516b781b4dc7fefa08efa02c8e41fb32db9c4ad213f3ee8eaa564b7c5ee8ed50b82be349703b8330f27da26d715b340a60f442
-
Filesize
710B
MD59b1de80b02905f298fc8b1b4394ef977
SHA1a6bc72e6f9de3d0622457d62ac0f6639ce609622
SHA256dc3a4f1c7f5249881a389321f7957236001273b7f0fe2cde8118f414dc8cb744
SHA512a040c900026026cfde10cba33a4ddca2797380b4ca653242271fc770996b0c90e0497ac32ca78b6f0e157df3e09e36ef49fe5482d1e87f5fc209830d983a9142
-
Filesize
710B
MD58efc90547392c99feecace007134f1e5
SHA13282b93e2d106d7fe2b894eeb1dbc3aae2b9fec5
SHA256785bb3a2338a361c31194d74a1308b05a240b3896147b6b7f1a929a7b78c2ffd
SHA512c02645d44f09b8e4b10f4753c0bb255151a45458047b14ad6e6b545ea89bcf5a557fee17a2ff789435fce41fab0d9d767ef6de38a6ddc540927449d89be3ac8a
-
Filesize
267B
MD5d01ebc18aed340249be869043ea1f1d8
SHA1783a37eca3e4c0ecca463a8d614e6008a4aaa2d1
SHA256cd1d341b5cd6d1130d8c517fa8a8a41c523d59c64d12b54ee309ea3d6fa6be46
SHA512e7df21a76a81c319cf3a5afa8d9c715883d36081785a317317b54508c155bbb9604829608b529374660009e3cb8bbeb4d929574c468ab680862a65f446638782
-
Filesize
2.2MB
MD50d7c14aadbecb63c01575806703869b0
SHA123ed811e342f5849a694cbd2ebd32baed4a7b13b
SHA25698d820f1a4d69dab034a7856e5613323ef3660a7baebb1ace55f23849a4cbc1e
SHA512c03e1c502387edc247bde2fbc199eea2f37ccd287a5b659a3ba196c374774c1ee317ba840c9555e2903e44a1c29559615af415ea266ef85b64cb5cabdbe94e97
-
Filesize
2.2MB
MD5c5dc6560c449e7b32fb4e20f5fb90f6f
SHA1841087ee7abfba0b63d4d4e5cba7e077f1a9693b
SHA25634b1d20da529970d67bde5c4df0ca509fb1949edb8f9400afd6ca764c67dd807
SHA512e8105b6109ece2524ed2c721ba71211557d6ac330f1cb6fa368e62c5f013eafc787afbbd1365ce5492fbf06239def340f84e1bdaca9bdb21ce18c9538a774309