dcrat | 8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Size

1.5MB
MD5

24a6fbff4c43f3aafd8906724ab7a21e
SHA1

c0f99114a21e322eabc8ee370993ecb09e984121
SHA256

8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354
SHA512

7daf7fd2890acad093bc7f71db825a9e13eb60fe188d3cd2de44d7994db25e71576f721005fdc9cde0263aa3fb25319235fd9611862ede7f6dff0c0d00286a4a
SSDEEP

24576:0NNUtQhWhtqDfDXQdy+N+gfQqRsgFlDRluQ70eJiVbWpR:EzhWhCXQFN+0IEuQgyiVK

Score

10^/10

dcrat evasion execution infostealer persistence rat trojan

Malware Config

Signatures

DcRat 15 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		1652	schtasks.exe
		1804	schtasks.exe
		4724	schtasks.exe
		4140	schtasks.exe
		3960	schtasks.exe
		3732	schtasks.exe
		3136	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
		4596	schtasks.exe
		4856	schtasks.exe
		4460	schtasks.exe
		2132	schtasks.exe
		1528	schtasks.exe
		1488	schtasks.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0\e6c9b481da804f		8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 13 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0\\OfficeClickToRun.exe\", \"C:\\Windows\\win\\explorer.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\", \"C:\\PerfLogs\\dllhost.exe\", \"C:\\Windows\\System32\\KBDA3\\conhost.exe\", \"C:\\PerfLogs\\Idle.exe\", \"C:\\Documents and Settings\\csrss.exe\", \"C:\\Windows\\System32\\SensorsApi\\spoolsv.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0\\OfficeClickToRun.exe\", \"C:\\Windows\\win\\explorer.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\", \"C:\\PerfLogs\\dllhost.exe\", \"C:\\Windows\\System32\\KBDA3\\conhost.exe\", \"C:\\PerfLogs\\Idle.exe\", \"C:\\Documents and Settings\\csrss.exe\", \"C:\\Windows\\System32\\SensorsApi\\spoolsv.exe\", \"C:\\Windows\\System32\\resutils\\dllhost.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0\\OfficeClickToRun.exe\", \"C:\\Windows\\win\\explorer.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\", \"C:\\PerfLogs\\dllhost.exe\", \"C:\\Windows\\System32\\KBDA3\\conhost.exe\", \"C:\\PerfLogs\\Idle.exe\", \"C:\\Documents and Settings\\csrss.exe\", \"C:\\Windows\\System32\\SensorsApi\\spoolsv.exe\", \"C:\\Windows\\System32\\resutils\\dllhost.exe\", \"C:\\Windows\\System32\\IumSdk\\lsass.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0\\OfficeClickToRun.exe\", \"C:\\Windows\\win\\explorer.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\", \"C:\\PerfLogs\\dllhost.exe\", \"C:\\Windows\\System32\\KBDA3\\conhost.exe\", \"C:\\PerfLogs\\Idle.exe\", \"C:\\Documents and Settings\\csrss.exe\", \"C:\\Windows\\System32\\SensorsApi\\spoolsv.exe\", \"C:\\Windows\\System32\\resutils\\dllhost.exe\", \"C:\\Windows\\System32\\IumSdk\\lsass.exe\", \"C:\\Windows\\System32\\srmtrace\\WaaSMedicAgent.exe\", \"C:\\Windows\\System32\\odbcconf\\sihost.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0\\OfficeClickToRun.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0\\OfficeClickToRun.exe\", \"C:\\Windows\\win\\explorer.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\", \"C:\\PerfLogs\\dllhost.exe\", \"C:\\Windows\\System32\\KBDA3\\conhost.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0\\OfficeClickToRun.exe\", \"C:\\Windows\\win\\explorer.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\", \"C:\\PerfLogs\\dllhost.exe\", \"C:\\Windows\\System32\\KBDA3\\conhost.exe\", \"C:\\PerfLogs\\Idle.exe\", \"C:\\Documents and Settings\\csrss.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0\\OfficeClickToRun.exe\", \"C:\\Windows\\win\\explorer.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\", \"C:\\PerfLogs\\dllhost.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0\\OfficeClickToRun.exe\", \"C:\\Windows\\win\\explorer.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\", \"C:\\PerfLogs\\dllhost.exe\", \"C:\\Windows\\System32\\KBDA3\\conhost.exe\", \"C:\\PerfLogs\\Idle.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0\\OfficeClickToRun.exe\", \"C:\\Windows\\win\\explorer.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\", \"C:\\PerfLogs\\dllhost.exe\", \"C:\\Windows\\System32\\KBDA3\\conhost.exe\", \"C:\\PerfLogs\\Idle.exe\", \"C:\\Documents and Settings\\csrss.exe\", \"C:\\Windows\\System32\\SensorsApi\\spoolsv.exe\", \"C:\\Windows\\System32\\resutils\\dllhost.exe\", \"C:\\Windows\\System32\\IumSdk\\lsass.exe\", \"C:\\Windows\\System32\\srmtrace\\WaaSMedicAgent.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0\\OfficeClickToRun.exe\", \"C:\\Windows\\win\\explorer.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0\\OfficeClickToRun.exe\", \"C:\\Windows\\win\\explorer.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0\\OfficeClickToRun.exe\", \"C:\\Windows\\win\\explorer.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe

Process spawned unexpected child process 13 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	3956	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	3956	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	3956	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	3956	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	3956	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	3956	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	3956	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	3956	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	3956	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	3956	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	3956	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	3956	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	3956	schtasks.exe	83

UAC bypass 3 TTPs 51 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4884	powershell.exe
4092	powershell.exe
4480	powershell.exe
4560	powershell.exe
3632	powershell.exe
872	powershell.exe
4408	powershell.exe
4504	powershell.exe
224	powershell.exe
2760	powershell.exe
4812	powershell.exe
4088	powershell.exe
2980	powershell.exe
404	powershell.exe
1908	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	lsass.exe

Executes dropped EXE 16 IoCs

pid	Process
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4060	lsass.exe
2184	lsass.exe
4804	lsass.exe
3876	lsass.exe
2448	lsass.exe
2664	lsass.exe
2592	lsass.exe
4724	lsass.exe
2188	lsass.exe
3564	lsass.exe
3444	lsass.exe
3696	lsass.exe
2468	lsass.exe
3632	lsass.exe
1320	lsass.exe

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0\\OfficeClickToRun.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\PerfLogs\\dllhost.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Documents and Settings\\csrss.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\System32\\odbcconf\\sihost.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\winlogon.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\PerfLogs\\dllhost.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\System32\\KBDA3\\conhost.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\PerfLogs\\Idle.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Windows\\System32\\srmtrace\\WaaSMedicAgent.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\System32\\odbcconf\\sihost.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0\\OfficeClickToRun.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\PerfLogs\\Idle.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Documents and Settings\\csrss.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\resutils\\dllhost.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\IumSdk\\lsass.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Windows\\System32\\srmtrace\\WaaSMedicAgent.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\resutils\\dllhost.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\IumSdk\\lsass.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\win\\explorer.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\win\\explorer.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\System32\\KBDA3\\conhost.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\SensorsApi\\spoolsv.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\SensorsApi\\spoolsv.exe\""	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe

Checks whether UAC is enabled 1 TTPs 34 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\KBDA3\conhost.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Windows\System32\resutils\dllhost.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Windows\System32\IumSdk\lsass.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Windows\System32\odbcconf\sihost.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File opened for modification	C:\Windows\System32\srmtrace\WaaSMedicAgent.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Windows\System32\KBDA3\088424020bedd6	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File opened for modification	C:\Windows\System32\SensorsApi\spoolsv.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File opened for modification	C:\Windows\System32\IumSdk\lsass.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Windows\System32\KBDA3\conhost.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Windows\System32\SensorsApi\spoolsv.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Windows\System32\IumSdk\6203df4a6bafc7	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Windows\System32\srmtrace\WaaSMedicAgent.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Windows\System32\srmtrace\c82b8037eab33d	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Windows\System32\SensorsApi\f3b6ecef712a24	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Windows\System32\resutils\5940a34987c991	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Windows\System32\odbcconf\66fc9ff0ee96c2	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File opened for modification	C:\Windows\System32\resutils\dllhost.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File opened for modification	C:\Windows\System32\odbcconf\sihost.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\smss.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\winlogon.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\cc11b995f2a76d	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0\RCX9905.tmp	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\smss.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCXA00D.tmp	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0\OfficeClickToRun.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0\e6c9b481da804f	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\RCX9D8B.tmp	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\winlogon.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0\OfficeClickToRun.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\69ddcba757bf72	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\win\explorer.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File created	C:\Windows\win\7a0fd90576e088	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File opened for modification	C:\Windows\win\RCX9B09.tmp	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
File opened for modification	C:\Windows\win\explorer.exe	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	lsass.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1528	schtasks.exe
1804	schtasks.exe
3136	schtasks.exe
4856	schtasks.exe
1488	schtasks.exe
2132	schtasks.exe
1652	schtasks.exe
3732	schtasks.exe
4724	schtasks.exe
4460	schtasks.exe
4140	schtasks.exe
3960	schtasks.exe
4596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
404	powershell.exe
4504	powershell.exe
4560	powershell.exe
4092	powershell.exe
4480	powershell.exe
4560	powershell.exe
4088	powershell.exe
404	powershell.exe
4480	powershell.exe
4504	powershell.exe
4092	powershell.exe
4088	powershell.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
872	powershell.exe
872	powershell.exe
3632	powershell.exe
3632	powershell.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Token: SeDebugPrivilege	404	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	4092	powershell.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Token: SeDebugPrivilege	872	powershell.exe
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	4812	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	224	powershell.exe
Token: SeDebugPrivilege	4060	lsass.exe
Token: SeDebugPrivilege	2184	lsass.exe
Token: SeDebugPrivilege	4804	lsass.exe
Token: SeDebugPrivilege	3876	lsass.exe
Token: SeDebugPrivilege	2448	lsass.exe
Token: SeDebugPrivilege	2664	lsass.exe
Token: SeDebugPrivilege	2592	lsass.exe
Token: SeDebugPrivilege	4724	lsass.exe
Token: SeDebugPrivilege	2188	lsass.exe
Token: SeDebugPrivilege	3564	lsass.exe
Token: SeDebugPrivilege	3444	lsass.exe
Token: SeDebugPrivilege	3696	lsass.exe
Token: SeDebugPrivilege	2468	lsass.exe
Token: SeDebugPrivilege	3632	lsass.exe
Token: SeDebugPrivilege	1320	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 4088	1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	90
PID 1876 wrote to memory of 4088	1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	90
PID 1876 wrote to memory of 4092	1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	91
PID 1876 wrote to memory of 4092	1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	91
PID 1876 wrote to memory of 404	1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	92
PID 1876 wrote to memory of 404	1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	92
PID 1876 wrote to memory of 4480	1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	93
PID 1876 wrote to memory of 4480	1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	93
PID 1876 wrote to memory of 4560	1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	94
PID 1876 wrote to memory of 4560	1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	94
PID 1876 wrote to memory of 4504	1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	95
PID 1876 wrote to memory of 4504	1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	95
PID 1876 wrote to memory of 2724	1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	101
PID 1876 wrote to memory of 2724	1876	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	101
PID 2724 wrote to memory of 4352	2724	cmd.exe	104
PID 2724 wrote to memory of 4352	2724	cmd.exe	104
PID 2724 wrote to memory of 4796	2724	cmd.exe	111
PID 2724 wrote to memory of 4796	2724	cmd.exe	111
PID 4796 wrote to memory of 224	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	126
PID 4796 wrote to memory of 224	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	126
PID 4796 wrote to memory of 3632	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	127
PID 4796 wrote to memory of 3632	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	127
PID 4796 wrote to memory of 2980	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	128
PID 4796 wrote to memory of 2980	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	128
PID 4796 wrote to memory of 2760	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	129
PID 4796 wrote to memory of 2760	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	129
PID 4796 wrote to memory of 872	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	130
PID 4796 wrote to memory of 872	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	130
PID 4796 wrote to memory of 4408	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	131
PID 4796 wrote to memory of 4408	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	131
PID 4796 wrote to memory of 1908	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	132
PID 4796 wrote to memory of 1908	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	132
PID 4796 wrote to memory of 4812	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	133
PID 4796 wrote to memory of 4812	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	133
PID 4796 wrote to memory of 4884	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	134
PID 4796 wrote to memory of 4884	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	134
PID 4796 wrote to memory of 2968	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	144
PID 4796 wrote to memory of 2968	4796	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe	144
PID 2968 wrote to memory of 228	2968	cmd.exe	146
PID 2968 wrote to memory of 228	2968	cmd.exe	146
PID 2968 wrote to memory of 4060	2968	cmd.exe	148
PID 2968 wrote to memory of 4060	2968	cmd.exe	148
PID 4060 wrote to memory of 4204	4060	lsass.exe	149
PID 4060 wrote to memory of 4204	4060	lsass.exe	149
PID 4060 wrote to memory of 2144	4060	lsass.exe	150
PID 4060 wrote to memory of 2144	4060	lsass.exe	150
PID 4204 wrote to memory of 2184	4204	WScript.exe	153
PID 4204 wrote to memory of 2184	4204	WScript.exe	153
PID 2184 wrote to memory of 4064	2184	lsass.exe	155
PID 2184 wrote to memory of 4064	2184	lsass.exe	155
PID 2184 wrote to memory of 3556	2184	lsass.exe	156
PID 2184 wrote to memory of 3556	2184	lsass.exe	156
PID 4064 wrote to memory of 4804	4064	WScript.exe	157
PID 4064 wrote to memory of 4804	4064	WScript.exe	157
PID 4804 wrote to memory of 2564	4804	lsass.exe	158
PID 4804 wrote to memory of 2564	4804	lsass.exe	158
PID 4804 wrote to memory of 2508	4804	lsass.exe	159
PID 4804 wrote to memory of 2508	4804	lsass.exe	159
PID 2564 wrote to memory of 3876	2564	WScript.exe	160
PID 2564 wrote to memory of 3876	2564	WScript.exe	160
PID 3876 wrote to memory of 3620	3876	lsass.exe	161
PID 3876 wrote to memory of 3620	3876	lsass.exe	161
PID 3876 wrote to memory of 1936	3876	lsass.exe	162
PID 3876 wrote to memory of 1936	3876	lsass.exe	162

System policy modification 1 TTPs 51 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
"C:\Users\Admin\AppData\Local\Temp\8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0\OfficeClickToRun.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\win\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PerfLogs\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4NpcD11qco.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4352
- - C:\Users\Admin\AppData\Local\Temp\8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe
    "C:\Users\Admin\AppData\Local\Temp\8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\KBDA3\conhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PerfLogs\Idle.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Documents and Settings\csrss.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\SensorsApi\spoolsv.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\resutils\dllhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\IumSdk\lsass.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\srmtrace\WaaSMedicAgent.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\odbcconf\sihost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4884
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JdMTxOovBw.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:228
    - - C:\Windows\System32\IumSdk\lsass.exe
        
        "C:\Windows\System32\IumSdk\lsass.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4060
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7767b6d9-b937-4037-be66-e8e0695a6c97.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Windows\System32\IumSdk\lsass.exe
        
        C:\Windows\System32\IumSdk\lsass.exe
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2184
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4e8c8cf5-0ea8-47b0-8711-be71f58dc331.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\System32\IumSdk\lsass.exe
        
        C:\Windows\System32\IumSdk\lsass.exe
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4804
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b8240f9-cd9c-45b6-bcd6-15d79149399b.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\System32\IumSdk\lsass.exe
        
        C:\Windows\System32\IumSdk\lsass.exe
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3876
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\33d43482-5db3-4365-92ab-49ffe511f934.vbs"
        12⤵
        
        PID:3620
        
        C:\Windows\System32\IumSdk\lsass.exe
        
        C:\Windows\System32\IumSdk\lsass.exe
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2448
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15063293-1f48-4f05-991f-be8cb9d9578d.vbs"
        14⤵
        
        PID:3456
        
        C:\Windows\System32\IumSdk\lsass.exe
        
        C:\Windows\System32\IumSdk\lsass.exe
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2664
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e9f9bad6-b953-48f4-8335-cf36154f9597.vbs"
        16⤵
        
        PID:4892
        
        C:\Windows\System32\IumSdk\lsass.exe
        
        C:\Windows\System32\IumSdk\lsass.exe
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7506390-242e-43c6-8cfa-e2cc3a425a66.vbs"
        18⤵
        
        PID:4712
        
        C:\Windows\System32\IumSdk\lsass.exe
        
        C:\Windows\System32\IumSdk\lsass.exe
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4724
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\50d2cb25-7bd8-4013-82c7-185c308a0256.vbs"
        20⤵
        
        PID:1136
        
        C:\Windows\System32\IumSdk\lsass.exe
        
        C:\Windows\System32\IumSdk\lsass.exe
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2188
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aba0b29d-7343-4791-b84d-b28ffef2e82e.vbs"
        22⤵
        
        PID:1004
        
        C:\Windows\System32\IumSdk\lsass.exe
        
        C:\Windows\System32\IumSdk\lsass.exe
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3564
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1695a1da-385f-40a1-80b1-47f7e074fe3b.vbs"
        24⤵
        
        PID:1364
        
        C:\Windows\System32\IumSdk\lsass.exe
        
        C:\Windows\System32\IumSdk\lsass.exe
        25⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac6d56bc-5158-41c2-985d-c341459b3cfb.vbs"
        26⤵
        
        PID:396
        
        C:\Windows\System32\IumSdk\lsass.exe
        
        C:\Windows\System32\IumSdk\lsass.exe
        27⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\93553afd-dd78-48cb-a8b4-17bfd1b246b1.vbs"
        28⤵
        
        PID:1792
        
        C:\Windows\System32\IumSdk\lsass.exe
        
        C:\Windows\System32\IumSdk\lsass.exe
        29⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2468
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9975add2-a337-4f06-aeef-46ed80ab0bee.vbs"
        30⤵
        
        PID:2148
        
        C:\Windows\System32\IumSdk\lsass.exe
        
        C:\Windows\System32\IumSdk\lsass.exe
        31⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3632
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e911eeb-ce68-4ded-9c7e-fff6c1f208d5.vbs"
        32⤵
        
        PID:632
        
        C:\Windows\System32\IumSdk\lsass.exe
        
        C:\Windows\System32\IumSdk\lsass.exe
        33⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1320
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44e87c13-bb76-459c-9215-7614831b16e7.vbs"
        34⤵
        
        PID:5056
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f92f460c-7065-4cbd-9c84-825c67d43092.vbs"
        34⤵
        
        PID:3404
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6202d20e-45e9-4b41-a3d9-ed98730391aa.vbs"
        32⤵
        
        PID:2644
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad9c07c2-d4ef-4595-ac51-60e4addf1e37.vbs"
        30⤵
        
        PID:4888
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f2587b9-ba56-44f2-9e04-06b60a171da0.vbs"
        28⤵
        
        PID:1232
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5254188f-d327-4102-b7b4-1a0978e56da4.vbs"
        26⤵
        
        PID:2560
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a985242-d3aa-4bb1-b066-875a5fb7fc31.vbs"
        24⤵
        
        PID:4088
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\017b473b-6017-45ec-87a2-ab35f92fa7cf.vbs"
        22⤵
        
        PID:4352
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\094226bb-4375-43e9-a624-5460a3ff9405.vbs"
        20⤵
        
        PID:408
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\57bb5d09-b6be-4f43-87c3-79ccdcfba6ca.vbs"
        18⤵
        
        PID:4260
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\56460253-3abd-470a-9493-eb0dadc6b505.vbs"
        16⤵
        
        PID:4028
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38b1558a-1b11-4fce-9af8-583a470370b6.vbs"
        14⤵
        
        PID:1532
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f9a0fb20-7506-4fda-a10e-cf649261d3c6.vbs"
        12⤵
        
        PID:1936
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d774462e-15cb-4a93-9607-2e5e99f9c1e9.vbs"
        10⤵
        
        PID:2508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2c10a6dc-fb2a-4c91-bb49-b472907c828a.vbs"
        8⤵
        
        PID:3556
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cd832f1b-7530-4313-aeb3-7f915f7858be.vbs"
        6⤵
        
        PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\win\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\PerfLogs\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\KBDA3\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\PerfLogs\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Documents and Settings\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\SensorsApi\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\resutils\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\IumSdk\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Windows\System32\srmtrace\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\System32\odbcconf\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\dllhost.exe

Filesize
1.5MB

MD5
24a6fbff4c43f3aafd8906724ab7a21e

SHA1
c0f99114a21e322eabc8ee370993ecb09e984121

SHA256
8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354

SHA512
7daf7fd2890acad093bc7f71db825a9e13eb60fe188d3cd2de44d7994db25e71576f721005fdc9cde0263aa3fb25319235fd9611862ede7f6dff0c0d00286a4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\8db947ca9c4f9a44d65dd0b7b9ab04023b925bd79fc5e0ea89f8d905bccc5354.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\lsass.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4c557aa00dc4a6ff86db4be1735e9d30

SHA1
7c155ad08e280926832bdad0aa948843de2ce5a2

SHA256
aad198f453bdcef5e479c7e622c005782f94d0b391798245284aad9506fa7e48

SHA512
2c311b272941308197e3f2fe9d961dda9682dfd514cc48bc63b156afb0d18cace8635f0d080b9f77ed43e67b551232a6fb5b86e88c2414f8bd2f32cbe5521ae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
60945d1a2e48da37d4ce8d9c56b6845a

SHA1
83e80a6acbeb44b68b0da00b139471f428a9d6c1

SHA256
314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3

SHA512
5d068f1d6443e26ae3cad1c80f969e50e5860967b314153c4d3b6efd1cfa39f0907c6427bec7fa43db079f258b6357e4e9a1b0b1a36b1481d2049ea0e67909ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
40fdb5644dee90b80ae15832b95acc3a

SHA1
7c2d4c82de09b1c48d4d5086c6e1eb00a3aecdba

SHA256
8085e921842e274c7fee9730a274c85f42dbde9b20d6c8708bd682b2c95cdb08

SHA512
59e75b50eea0b6e661d3cbb09e067534fab67038ac89e551afa512a970ccaa5fc5bb4be3fbb56b1a3f785285b3acc3d30d8d71dda479f66b8d69d2301e6855c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
dcee2c4799aaf7d786c7a18e235934c4

SHA1
92b08222812d2c4392cd5babf316c6509a1d202c

SHA256
33fb8b90e373768d57f2726dc808e2a6319dcea75ed4be819316a4bc3c2f85c1

SHA512
05986414ab12b9b52335528dc4dc1ef6fee378afa09a2858b0ea77cb0c9aaf4339ccae272bbc760ff63d31ad27e8a8206ae0152be82015f49c177cb62b515f32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
575c67abdb0b2c72de0d9dd38b94d791

SHA1
27783f259ffd096b21c02c70cb999bf860183124

SHA256
fdf985fb9c56b4462675c41f68555f8762dd7043b15750968208b88be87252bc

SHA512
61b23a15b52cf51b525993e8cfc0b9fd41d1bb28501c96a35f776bfa738390783ad266c2d0383a53770f3662dd118a45114d92afee63b4673e88008a6559b774

Download Submit
C:\Users\Admin\AppData\Local\Temp\0b8240f9-cd9c-45b6-bcd6-15d79149399b.vbs

Filesize
712B

MD5
e521abc1b003a4563bfabb435851f8bd

SHA1
6fedfce541038571a5a4abb4c7c56a2824a66273

SHA256
f37a6ea6b5656e18f34f8177a339be38012c83fcd0ea2157b21b0b72e22ed829

SHA512
50f18941f71694e87c06600d65b1b865624973b8ad40b6e16a2feff8dc2dd5640d47291277c47f8fc6f6bb41a0e8df25efe9b1c08be1419c87f1d415cd39199a

Download Submit
C:\Users\Admin\AppData\Local\Temp\15063293-1f48-4f05-991f-be8cb9d9578d.vbs

Filesize
712B

MD5
dfb3f30a61a1b23ebf2106a8ad7696c6

SHA1
4b875eef8f78bc5fa96cab7b58c2aa521f51fd28

SHA256
64e90f154702d40ff40868bdf3773f9b219aa972e4cd40ef5747fad3499880dc

SHA512
898cd43d02572fe199a6c32cbdaa9640f79ed2de623d50e7e0f741bac07d8c6c0ad0b1cff855743eebb7ea57c4ae1e1aae40afa9b1165711455cfbe9af0db15f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1695a1da-385f-40a1-80b1-47f7e074fe3b.vbs

Filesize
712B

MD5
ccfb7eb3040ea4906b94724b1a178d5d

SHA1
bc1ce66e7efbb846985fba54e6cad4ecc273b9cc

SHA256
e7537ba2f66cb0d43f61b37af2ae63ab1b682dbc522810e63be4dad09e2535c7

SHA512
1a2adda5bac460444e18e7101c8a0db6cd2f055431eb450162f35d962ac7ff573728e2ea20f572cd967cc426beb91049ba5f32b28081a06b6c8651dd4a7541ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\33d43482-5db3-4365-92ab-49ffe511f934.vbs

Filesize
712B

MD5
7658017ed0b13e54882099cf87089c59

SHA1
afade8ce9b3a44816f18bc869ae46c442fba59cf

SHA256
615fdc31822e6effe134e2707d6335c88c506ceb9c9d8753dbd76d5c7c1fb1de

SHA512
5291b4866d29e6254b964f7a61dcd6e65e131df9d7698889a14ae95d33582df0f0e4157cc0b59e64757beb872269513ee01a257f44d41c0c31ea1756951a39a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\4NpcD11qco.bat

Filesize
266B

MD5
654418874f9fd7483e34fd56384379ca

SHA1
146de7e0448bbcb10453f9a0daa97aa0264ab965

SHA256
7d6e6699265234a2571819c3d09041b059e57be5251602c01e10af67a2ba4fc7

SHA512
edb4f8241eb1ada9d06a20506395088157b61e1e65edeed1cf508e34256335e9285dea2c47f51ffdaef56d490fcbad2518d8a049f12ec35d1ab2df3de5f99fc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\4e8c8cf5-0ea8-47b0-8711-be71f58dc331.vbs

Filesize
712B

MD5
26f64c045a266ce969c4d962ac4980b4

SHA1
57951991786b8fad6942471139418087664fc818

SHA256
b287264310476a2efec6adbe709c5123d19e010e7f5fc3e78c88f596749a05f4

SHA512
a264c696ce440bdc3b6fd80d57b058b26e24d23d591f8a30d548d635b488a9aa4b2464c902361f53b19a31066fc2a205be9f9aa1bf711681e3b0a3878a0de6f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\50d2cb25-7bd8-4013-82c7-185c308a0256.vbs

Filesize
712B

MD5
3cbeed41135be1b54bd524e8229698d5

SHA1
9f7bd389da59a91b35897a5e3281b288ad8e4878

SHA256
62235a171e2e2b79905dd9b5fb045ddc0ff3be547059a5682c02eca194755fda

SHA512
1fc434a44c81bff34beaa849430864b9196427151591895ae7b720c875495b6d349a60bd1eb4a79df93968e1d31ae61bba8054de2da85ac351db12cf2ee97921

Download Submit
C:\Users\Admin\AppData\Local\Temp\7767b6d9-b937-4037-be66-e8e0695a6c97.vbs

Filesize
712B

MD5
ed4039a95e43ab4d74f223ecb53f45ba

SHA1
4d8728b24833b86cb36d424b0e7e66ec84fc2595

SHA256
4e093274a2bd820fbdfcf49e9565f0a8dce883d6bddcb355f2cc734583472152

SHA512
dffa40472ae6d88f6446dff9f5829b5d6f43a48987155ba4894c4240ff15ceded45fc65b7888c7d2fce8fd66eb5746646df56f79e381bc5313f93e6fcaadc55d

Download Submit
C:\Users\Admin\AppData\Local\Temp\JdMTxOovBw.bat

Filesize
200B

MD5
073871350ab5cd978dff9aa6fe8de02a

SHA1
51a65dd4aefc5d3c0e4e5e3d5025ff24990ac767

SHA256
8f6e8bd6cd39c6a74cffc53e527f2c7e138d6eb7858d8c51a5ebbbdb4b4f94d9

SHA512
3abd6adf92e2b42ec31fa78ec76b798f16f764c3bf1b1b088b86e8073753ff92a73d82a6e73aa7b2b8b5568da3063b67c0183a0d9d82274a72ccfd1ccd5c8ab9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1mbdsqss.1s2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\aba0b29d-7343-4791-b84d-b28ffef2e82e.vbs

Filesize
712B

MD5
8d628085a93ec4f348b00c65200743c3

SHA1
b761fbb4021c0d43a2dd78aa9bf10e072702f07e

SHA256
4c9c50af317ed789d7ffa7435d34857641a04efc2f777a7c6a717c7d2fe5ee3a

SHA512
a6c6cb07863ea8e88d1461d2f2b4805c580b623ee4f28dd4eb67482172999f56ee301c8b41d7a4c6709888d3e0ddc66c7c97a007b0b68973e20e44e4af984c0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ac6d56bc-5158-41c2-985d-c341459b3cfb.vbs

Filesize
712B

MD5
f9e6046d4c49b9ab33e1fd1af585a72a

SHA1
4a437300fb0b1ded20bd9b206b7329206743ba03

SHA256
c4bebc55a7a6b6e0ff29608bb66e0f914351b364f48d20eab7942cb338e497fd

SHA512
2c9e7eb2e9895f8dfaf626b7cea0d0bc4556ea17c043257b19aea325d1e9a8461db5648dd21d75c71b17a1744c5848c2eb5bf25b6ff3312d8e028f82607da6cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\b7506390-242e-43c6-8cfa-e2cc3a425a66.vbs

Filesize
712B

MD5
8dc38327963054b909d13e48515a1112

SHA1
af985d39803f3e28631616f8b7ba2c688d1a4461

SHA256
d2adef9e53903af09fd37fc786211a751a911840979c58ca3d06d527ebf417f2

SHA512
2e6dbcc825f4c636b07ee0bee0935697a6e15641c64be8c3b5890e95c4cf67bd23fb5d329d4a67c5747231cab1eec2135880a227b709d1db06571e0e0efbae53

Download Submit
C:\Users\Admin\AppData\Local\Temp\cd832f1b-7530-4313-aeb3-7f915f7858be.vbs

Filesize
488B

MD5
918dc854b354a375d9518fc823d9b2ee

SHA1
da035a3e15ad6ee66388b0861a3d73a80c5c4247

SHA256
a83029bf5f00813ecbdfa73336de021c7b6f8a29a6b3ef52a8048d55beb6a947

SHA512
83fed2dcb3176ac78638075fb8da69104f9333f73bce2155c5cb72fb1c7fd0dc3909b91d30caa204027a2f9e30a1e9a2ba389e502517b9e6e499cfdb3ed497ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\e9f9bad6-b953-48f4-8335-cf36154f9597.vbs

Filesize
712B

MD5
c794f8c5ec682907037e893fb695e0d8

SHA1
757d20c1efbf88a776311d3dd16c0151e24ede28

SHA256
7eb93628ce3a79afde6a5e5086207d10aba31858f33045707edcd5922cffd1ca

SHA512
92bd6141c1a8e90662f7a859a468e07aa06e63530513453315033a4080184676d9c9b7507910e8fc8ea3480a76baba97bc4009e59e85f2b23fb9422c209f9fec

Download Submit
C:\Users\Admin\AppData\Local\Temp\f36c19c0594ebb886dc55e1e2a7040ff3f1e38e04.5.273f27bd703f4f26926fc190021d65d71a2f1b9eab

Filesize
616B

MD5
7cc04377493d4621abebfc910560a423

SHA1
010c99f38efb2acf2c09b78988e4aa03e06ca4b6

SHA256
5318b20da29acec3ca32a02ee4690cea2d9de73cca2ffc3c03318a85ef165e6b

SHA512
d80fe3eed55926b4f3b999d408be0fbd169f31bd863adc352026e45c1a359a4f574d98898a1d07972f941b0e495c798ce543bea7ba538e92e505c892ebda315e

Download Submit
memory/404-90-0x000001FCD4C10000-0x000001FCD4C32000-memory.dmp

Filesize
136KB

Download
memory/1876-10-0x000000001B4D0000-0x000000001B4E0000-memory.dmp

Filesize
64KB

Download
memory/1876-18-0x000000001BBA0000-0x000000001BBA8000-memory.dmp

Filesize
32KB

Download
memory/1876-14-0x000000001BB60000-0x000000001BB6C000-memory.dmp

Filesize
48KB

Download
memory/1876-24-0x00007FFAC2650000-0x00007FFAC3111000-memory.dmp

Filesize
10.8MB

Download
memory/1876-16-0x000000001BB80000-0x000000001BB88000-memory.dmp

Filesize
32KB

Download
memory/1876-17-0x000000001BB90000-0x000000001BB9C000-memory.dmp

Filesize
48KB

Download
memory/1876-13-0x000000001BB50000-0x000000001BB5A000-memory.dmp

Filesize
40KB

Download
memory/1876-12-0x000000001BB40000-0x000000001BB48000-memory.dmp

Filesize
32KB

Download
memory/1876-11-0x000000001BB30000-0x000000001BB40000-memory.dmp

Filesize
64KB

Download
memory/1876-25-0x00007FFAC2650000-0x00007FFAC3111000-memory.dmp

Filesize
10.8MB

Download
memory/1876-9-0x000000001B4C0000-0x000000001B4CC000-memory.dmp

Filesize
48KB

Download
memory/1876-1-0x0000000000720000-0x000000000089E000-memory.dmp

Filesize
1.5MB

Download
memory/1876-0-0x00007FFAC2653000-0x00007FFAC2655000-memory.dmp

Filesize
8KB

Download
memory/1876-15-0x000000001BB70000-0x000000001BB7A000-memory.dmp

Filesize
40KB

Download
memory/1876-8-0x0000000002A80000-0x0000000002A88000-memory.dmp

Filesize
32KB

Download
memory/1876-80-0x00007FFAC2650000-0x00007FFAC3111000-memory.dmp

Filesize
10.8MB

Download
memory/1876-7-0x0000000002A70000-0x0000000002A7C000-memory.dmp

Filesize
48KB

Download
memory/1876-2-0x00007FFAC2650000-0x00007FFAC3111000-memory.dmp

Filesize
10.8MB

Download
memory/1876-6-0x00000000011A0000-0x00000000011AA000-memory.dmp

Filesize
40KB

Download
memory/1876-5-0x0000000002A60000-0x0000000002A6C000-memory.dmp

Filesize
48KB

Download
memory/1876-4-0x0000000001180000-0x0000000001192000-memory.dmp

Filesize
72KB

Download
memory/1876-3-0x0000000001170000-0x0000000001178000-memory.dmp

Filesize
32KB

Download
memory/1876-20-0x000000001BBB0000-0x000000001BBBC000-memory.dmp

Filesize
48KB

Download
memory/1876-21-0x000000001BC30000-0x000000001BC38000-memory.dmp

Filesize
32KB

Download
memory/2184-298-0x000000001C760000-0x000000001C772000-memory.dmp

Filesize
72KB

Download
memory/4060-285-0x000000001BBF0000-0x000000001BC02000-memory.dmp

Filesize
72KB

Download
memory/4796-147-0x0000000000D10000-0x0000000000D22000-memory.dmp

Filesize
72KB

Download
memory/4804-310-0x000000001B9F0000-0x000000001BA02000-memory.dmp

Filesize
72KB

Download