dcrat | 0a0eebfca8553e921339c90b0060ceb6adcbc5f747696b1abecd376f50283911

Resubmissions

13-01-2025 04:05

250113-enzvbaxner 10

12-01-2025 14:56

250112-sa1fkszjhp 10

Analysis

max time kernel
899s
max time network
901s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-01-2025 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dabf40b2ed8d96638f713f6373ef64cb.exe
Size

2.5MB
MD5

dabf40b2ed8d96638f713f6373ef64cb
SHA1

4c9479e54b394722bdaeff1b36d903502cd1b1fe
SHA256

0a0eebfca8553e921339c90b0060ceb6adcbc5f747696b1abecd376f50283911
SHA512

0a9abca78917efea2b77dcccf862761e99001a26bba3de871c233b07500c7e414e32ebd41f93e23b332696db1d56aaa9e8357e60ac32efbf06c13bf40abf1fd0
SSDEEP

49152:UbA30QsSHlG56vO0T3/Nh/ptuw/C3TqGaDxr1NcWTMUvifV:UbcLlK6d3/Nh/bV/Oq3Dxp2RUGV

Score

10^/10

dcrat discovery evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 55 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		1840	schtasks.exe
		660	schtasks.exe
		1268	schtasks.exe
		1108	schtasks.exe
		2792	schtasks.exe
		1540	schtasks.exe
		1572	schtasks.exe
		2064	schtasks.exe
		1712	schtasks.exe
		464	schtasks.exe
		1844	schtasks.exe
		2432	schtasks.exe
		1956	schtasks.exe
		1120	schtasks.exe
		540	schtasks.exe
		1068	schtasks.exe
		1724	schtasks.exe
		2416	schtasks.exe
		1560	schtasks.exe
		1536	schtasks.exe
		2840	schtasks.exe
		2152	schtasks.exe
		2952	schtasks.exe
		2820	schtasks.exe
		1932	schtasks.exe
		2192	schtasks.exe
		2312	schtasks.exe
		2708	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		dabf40b2ed8d96638f713f6373ef64cb.exe
		2632	schtasks.exe
		264	schtasks.exe
		1812	schtasks.exe
		564	schtasks.exe
		2248	schtasks.exe
		2036	schtasks.exe
		2680	schtasks.exe
		1648	schtasks.exe
		2428	schtasks.exe
		1716	schtasks.exe
		2880	schtasks.exe
		900	schtasks.exe
		2576	schtasks.exe
		2148	schtasks.exe
		2216	schtasks.exe
		2268	schtasks.exe
		2964	schtasks.exe
		2420	schtasks.exe
		2412	schtasks.exe
		1516	schtasks.exe
		2132	schtasks.exe
		1996	schtasks.exe
		1528	schtasks.exe
		2560	schtasks.exe
		1688	schtasks.exe
		1728	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\Mssurrogatebrowserhostperf\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\conhost.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\Mssurrogatebrowserhostperf\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\conhost.exe\", \"C:\\Windows\\Tasks\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\lsm.exe\", \"C:\\Users\\Default\\Videos\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\spoolsv.exe\", \"C:\\Users\\Public\\Favorites\\dwm.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\", \"C:\\Windows\\DigitalLocker\\smss.exe\", \"C:\\Program Files\\Windows Photo Viewer\\ja-JP\\explorer.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\cmd.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\Mssurrogatebrowserhostperf\\csrss.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\Mssurrogatebrowserhostperf\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\conhost.exe\", \"C:\\Windows\\Tasks\\cmd.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\Mssurrogatebrowserhostperf\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\conhost.exe\", \"C:\\Windows\\Tasks\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\lsm.exe\", \"C:\\Users\\Default\\Videos\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\OSPPSVC.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\Mssurrogatebrowserhostperf\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\conhost.exe\", \"C:\\Windows\\Tasks\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\lsm.exe\", \"C:\\Users\\Default\\Videos\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\spoolsv.exe\", \"C:\\Users\\Public\\Favorites\\dwm.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\", \"C:\\Windows\\DigitalLocker\\smss.exe\", \"C:\\Program Files\\Windows Photo Viewer\\ja-JP\\explorer.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\Mssurrogatebrowserhostperf\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\conhost.exe\", \"C:\\Windows\\Tasks\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\lsm.exe\", \"C:\\Users\\Default\\Videos\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\spoolsv.exe\", \"C:\\Users\\Public\\Favorites\\dwm.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\Mssurrogatebrowserhostperf\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\conhost.exe\", \"C:\\Windows\\Tasks\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\lsm.exe\", \"C:\\Users\\Default\\Videos\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\spoolsv.exe\", \"C:\\Users\\Public\\Favorites\\dwm.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\Mssurrogatebrowserhostperf\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\conhost.exe\", \"C:\\Windows\\Tasks\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\lsm.exe\", \"C:\\Users\\Default\\Videos\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\services.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\Mssurrogatebrowserhostperf\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\conhost.exe\", \"C:\\Windows\\Tasks\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\lsm.exe\", \"C:\\Users\\Default\\Videos\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\dllhost.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\Mssurrogatebrowserhostperf\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\conhost.exe\", \"C:\\Windows\\Tasks\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\lsm.exe\", \"C:\\Users\\Default\\Videos\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\spoolsv.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\Mssurrogatebrowserhostperf\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\conhost.exe\", \"C:\\Windows\\Tasks\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\lsm.exe\", \"C:\\Users\\Default\\Videos\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\spoolsv.exe\", \"C:\\Users\\Public\\Favorites\\dwm.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\", \"C:\\Windows\\DigitalLocker\\smss.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\Mssurrogatebrowserhostperf\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\Mssurrogatebrowserhostperf\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\conhost.exe\", \"C:\\Windows\\Tasks\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\lsm.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\Mssurrogatebrowserhostperf\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\conhost.exe\", \"C:\\Windows\\Tasks\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\lsm.exe\", \"C:\\Users\\Default\\Videos\\csrss.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\Mssurrogatebrowserhostperf\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\conhost.exe\", \"C:\\Windows\\Tasks\\cmd.exe\", \"C:\\Mssurrogatebrowserhostperf\\lsm.exe\", \"C:\\Users\\Default\\Videos\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\spoolsv.exe\", \"C:\\Users\\Public\\Favorites\\dwm.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\", \"C:\\Windows\\DigitalLocker\\smss.exe\", \"C:\\Program Files\\Windows Photo Viewer\\ja-JP\\explorer.exe\""	Serverbroker.exe

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	264	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	464	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	564	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1120	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	2664	schtasks.exe	34

UAC bypass 3 TTPs 45 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Serverbroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Serverbroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Serverbroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe

DCRat payload 33 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016855-12.dat	dcrat
behavioral1/memory/2748-13-0x00000000011B0000-0x00000000013DE000-memory.dmp	dcrat
behavioral1/files/0x000700000001a4b8-101.dat	dcrat
behavioral1/files/0x0008000000018f53-278.dat	dcrat
behavioral1/memory/2964-283-0x0000000000930000-0x0000000000B5E000-memory.dmp	dcrat
behavioral1/memory/2432-294-0x00000000010F0000-0x000000000131E000-memory.dmp	dcrat
behavioral1/memory/2388-306-0x0000000000160000-0x000000000038E000-memory.dmp	dcrat
behavioral1/memory/2772-318-0x0000000000C80000-0x0000000000EAE000-memory.dmp	dcrat
behavioral1/memory/1028-343-0x0000000000AD0000-0x0000000000CFE000-memory.dmp	dcrat
behavioral1/memory/2996-345-0x0000000001180000-0x00000000013AE000-memory.dmp	dcrat
behavioral1/memory/1600-349-0x0000000000320000-0x000000000054E000-memory.dmp	dcrat
behavioral1/memory/2164-352-0x0000000001100000-0x000000000132E000-memory.dmp	dcrat
behavioral1/memory/2960-353-0x0000000000E30000-0x000000000105E000-memory.dmp	dcrat
behavioral1/files/0x0006000000019438-357.dat	dcrat
behavioral1/memory/276-365-0x0000000000AF0000-0x0000000000D1E000-memory.dmp	dcrat
behavioral1/memory/2724-380-0x0000000001320000-0x000000000154E000-memory.dmp	dcrat
behavioral1/memory/2124-381-0x00000000000A0000-0x00000000002CE000-memory.dmp	dcrat
behavioral1/files/0x0006000000019266-395.dat	dcrat
behavioral1/memory/1368-397-0x0000000000DB0000-0x0000000000FDE000-memory.dmp	dcrat
behavioral1/memory/648-398-0x0000000000260000-0x000000000048E000-memory.dmp	dcrat
behavioral1/memory/812-400-0x0000000000F30000-0x000000000115E000-memory.dmp	dcrat
behavioral1/memory/2808-413-0x00000000003E0000-0x000000000060E000-memory.dmp	dcrat
behavioral1/memory/2528-415-0x0000000001030000-0x000000000125E000-memory.dmp	dcrat
behavioral1/memory/2276-427-0x0000000000C00000-0x0000000000E2E000-memory.dmp	dcrat
behavioral1/memory/2352-428-0x00000000000E0000-0x000000000030E000-memory.dmp	dcrat
behavioral1/memory/2372-436-0x00000000010F0000-0x000000000131E000-memory.dmp	dcrat
behavioral1/memory/2140-437-0x0000000001390000-0x00000000015BE000-memory.dmp	dcrat
behavioral1/memory/1656-438-0x00000000012E0000-0x000000000150E000-memory.dmp	dcrat
behavioral1/memory/612-439-0x0000000001340000-0x000000000156E000-memory.dmp	dcrat
behavioral1/memory/936-447-0x0000000000390000-0x00000000005BE000-memory.dmp	dcrat
behavioral1/memory/1964-448-0x0000000000140000-0x000000000036E000-memory.dmp	dcrat
behavioral1/memory/2132-456-0x0000000000130000-0x000000000035E000-memory.dmp	dcrat
behavioral1/memory/2928-464-0x00000000000D0000-0x00000000002FE000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Serverbroker.exe

Executes dropped EXE 34 IoCs

pid	Process
2748	Serverbroker.exe
2964	OSPPSVC.exe
2432	OSPPSVC.exe
2388	OSPPSVC.exe
2772	OSPPSVC.exe
1664	OSPPSVC.exe
1028	explorer.exe
2996	OSPPSVC.exe
1600	OSPPSVC.exe
2164	spoolsv.exe
2960	audiodg.exe
276	OSPPSVC.exe
2124	lsm.exe
2724	conhost.exe
1584	OSPPSVC.exe
1368	dwm.exe
648	dllhost.exe
812	OSPPSVC.exe
2808	smss.exe
2528	OSPPSVC.exe
2276	explorer.exe
2352	OSPPSVC.exe
1656	csrss.exe
2372	cmd.exe
2140	services.exe
612	OSPPSVC.exe
936	spoolsv.exe
2684	audiodg.exe
2688	OSPPSVC.exe
3064	OSPPSVC.exe
564	conhost.exe
1964	lsm.exe
2132	lsm.exe
2928	explorer.exe

Loads dropped DLL 2 IoCs

pid	Process
840	cmd.exe
840	cmd.exe

Adds Run key to start application 2 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Mssurrogatebrowserhostperf\\conhost.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files\\7-Zip\\Lang\\OSPPSVC.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\spoolsv.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\DigitalLocker\\smss.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\Videos\\csrss.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files\\7-Zip\\Lang\\OSPPSVC.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\dllhost.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Microsoft Sync Framework\\services.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\dllhost.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Windows Photo Viewer\\ja-JP\\explorer.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files\\Uninstall Information\\lsm.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Mssurrogatebrowserhostperf\\csrss.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\Videos\\csrss.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\spoolsv.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Users\\Admin\\Start Menu\\cmd.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Public\\Favorites\\dwm.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Windows\\Tasks\\cmd.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Mssurrogatebrowserhostperf\\lsm.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Mssurrogatebrowserhostperf\\lsm.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Microsoft Sync Framework\\services.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Mssurrogatebrowserhostperf\\conhost.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Users\\Admin\\Start Menu\\cmd.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Windows\\Tasks\\cmd.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\DigitalLocker\\smss.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Windows Photo Viewer\\ja-JP\\explorer.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Users\\Public\\audiodg.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Users\\Public\\audiodg.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files\\Uninstall Information\\lsm.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Mssurrogatebrowserhostperf\\csrss.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Public\\Favorites\\dwm.exe\""	Serverbroker.exe

Checks whether UAC is enabled 1 TTPs 30 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Serverbroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Serverbroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Sync Framework\c5b4cb5e9653cc	Serverbroker.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\spoolsv.exe	Serverbroker.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\f3b6ecef712a24	Serverbroker.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\explorer.exe	Serverbroker.exe
File opened for modification	C:\Program Files\Uninstall Information\lsm.exe	Serverbroker.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCXC7F3.tmp	Serverbroker.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCXC861.tmp	Serverbroker.exe
File created	C:\Program Files\Uninstall Information\lsm.exe	Serverbroker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\spoolsv.exe	Serverbroker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\RCXCAD2.tmp	Serverbroker.exe
File created	C:\Program Files\7-Zip\Lang\1610b97d3ab4a7	Serverbroker.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\services.exe	Serverbroker.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXB87B.tmp	Serverbroker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\RCXCAD3.tmp	Serverbroker.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\RCXD911.tmp	Serverbroker.exe
File created	C:\Program Files\7-Zip\Lang\OSPPSVC.exe	Serverbroker.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\RCXD912.tmp	Serverbroker.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\explorer.exe	Serverbroker.exe
File opened for modification	C:\Program Files\7-Zip\Lang\OSPPSVC.exe	Serverbroker.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\OSPPSVC.exe	Serverbroker.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\7a0fd90576e088	Serverbroker.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXB87A.tmp	Serverbroker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\services.exe	Serverbroker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\RCXCF49.tmp	Serverbroker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\RCXCF4A.tmp	Serverbroker.exe
File created	C:\Program Files\Uninstall Information\101b941d020240	Serverbroker.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\cmd.exe	Serverbroker.exe
File created	C:\Windows\DigitalLocker\69ddcba757bf72	Serverbroker.exe
File opened for modification	C:\Windows\Tasks\RCXC1E6.tmp	Serverbroker.exe
File opened for modification	C:\Windows\Tasks\cmd.exe	Serverbroker.exe
File opened for modification	C:\Windows\DigitalLocker\RCXD70C.tmp	Serverbroker.exe
File opened for modification	C:\Windows\DigitalLocker\RCXD70D.tmp	Serverbroker.exe
File created	C:\Windows\Tasks\ebf1f9fa8afd6d	Serverbroker.exe
File created	C:\Windows\DigitalLocker\smss.exe	Serverbroker.exe
File opened for modification	C:\Windows\Tasks\RCXC1E5.tmp	Serverbroker.exe
File opened for modification	C:\Windows\DigitalLocker\smss.exe	Serverbroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dabf40b2ed8d96638f713f6373ef64cb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2036	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2632	schtasks.exe
1528	schtasks.exe
1932	schtasks.exe
2952	schtasks.exe
540	schtasks.exe
2880	schtasks.exe
2192	schtasks.exe
1560	schtasks.exe
1516	schtasks.exe
900	schtasks.exe
1844	schtasks.exe
1688	schtasks.exe
2152	schtasks.exe
564	schtasks.exe
1724	schtasks.exe
264	schtasks.exe
1812	schtasks.exe
1712	schtasks.exe
1540	schtasks.exe
2560	schtasks.exe
2840	schtasks.exe
2036	schtasks.exe
1648	schtasks.exe
2312	schtasks.exe
464	schtasks.exe
2708	schtasks.exe
2064	schtasks.exe
660	schtasks.exe
2416	schtasks.exe
2680	schtasks.exe
1996	schtasks.exe
2792	schtasks.exe
2248	schtasks.exe
2576	schtasks.exe
2412	schtasks.exe
1108	schtasks.exe
2820	schtasks.exe
1536	schtasks.exe
1068	schtasks.exe
2148	schtasks.exe
1716	schtasks.exe
2216	schtasks.exe
2432	schtasks.exe
1572	schtasks.exe
2964	schtasks.exe
2132	schtasks.exe
1120	schtasks.exe
2268	schtasks.exe
1956	schtasks.exe
1268	schtasks.exe
2420	schtasks.exe
1840	schtasks.exe
2428	schtasks.exe
1728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2748	Serverbroker.exe
2964	OSPPSVC.exe
2964	OSPPSVC.exe
2964	OSPPSVC.exe
2964	OSPPSVC.exe
2964	OSPPSVC.exe
2964	OSPPSVC.exe
2964	OSPPSVC.exe
2964	OSPPSVC.exe
2964	OSPPSVC.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	Serverbroker.exe
Token: SeDebugPrivilege	2964	OSPPSVC.exe
Token: SeDebugPrivilege	2432	OSPPSVC.exe
Token: SeDebugPrivilege	2388	OSPPSVC.exe
Token: SeDebugPrivilege	2772	OSPPSVC.exe
Token: SeDebugPrivilege	1664	OSPPSVC.exe
Token: SeDebugPrivilege	1028	explorer.exe
Token: SeDebugPrivilege	2996	OSPPSVC.exe
Token: SeDebugPrivilege	1600	OSPPSVC.exe
Token: SeDebugPrivilege	2164	spoolsv.exe
Token: SeDebugPrivilege	2960	audiodg.exe
Token: SeDebugPrivilege	276	OSPPSVC.exe
Token: SeDebugPrivilege	2724	conhost.exe
Token: SeDebugPrivilege	2124	lsm.exe
Token: SeDebugPrivilege	1584	OSPPSVC.exe
Token: SeDebugPrivilege	1368	dwm.exe
Token: SeDebugPrivilege	648	dllhost.exe
Token: SeDebugPrivilege	812	OSPPSVC.exe
Token: SeDebugPrivilege	2808	smss.exe
Token: SeDebugPrivilege	2528	OSPPSVC.exe
Token: SeDebugPrivilege	2276	explorer.exe
Token: SeDebugPrivilege	2352	OSPPSVC.exe
Token: SeDebugPrivilege	2372	cmd.exe
Token: SeDebugPrivilege	2140	services.exe
Token: SeDebugPrivilege	1656	csrss.exe
Token: SeDebugPrivilege	612	OSPPSVC.exe
Token: SeDebugPrivilege	936	spoolsv.exe
Token: SeDebugPrivilege	2684	audiodg.exe
Token: SeDebugPrivilege	2688	OSPPSVC.exe
Token: SeDebugPrivilege	3064	OSPPSVC.exe
Token: SeDebugPrivilege	1964	lsm.exe
Token: SeDebugPrivilege	564	conhost.exe
Token: SeDebugPrivilege	2132	lsm.exe
Token: SeDebugPrivilege	2928	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2520	2372	dabf40b2ed8d96638f713f6373ef64cb.exe	30
PID 2372 wrote to memory of 2520	2372	dabf40b2ed8d96638f713f6373ef64cb.exe	30
PID 2372 wrote to memory of 2520	2372	dabf40b2ed8d96638f713f6373ef64cb.exe	30
PID 2372 wrote to memory of 2520	2372	dabf40b2ed8d96638f713f6373ef64cb.exe	30
PID 2520 wrote to memory of 840	2520	WScript.exe	31
PID 2520 wrote to memory of 840	2520	WScript.exe	31
PID 2520 wrote to memory of 840	2520	WScript.exe	31
PID 2520 wrote to memory of 840	2520	WScript.exe	31
PID 840 wrote to memory of 2748	840	cmd.exe	33
PID 840 wrote to memory of 2748	840	cmd.exe	33
PID 840 wrote to memory of 2748	840	cmd.exe	33
PID 840 wrote to memory of 2748	840	cmd.exe	33
PID 2748 wrote to memory of 2964	2748	Serverbroker.exe	90
PID 2748 wrote to memory of 2964	2748	Serverbroker.exe	90
PID 2748 wrote to memory of 2964	2748	Serverbroker.exe	90
PID 840 wrote to memory of 2036	840	cmd.exe	91
PID 840 wrote to memory of 2036	840	cmd.exe	91
PID 840 wrote to memory of 2036	840	cmd.exe	91
PID 840 wrote to memory of 2036	840	cmd.exe	91
PID 2964 wrote to memory of 2476	2964	OSPPSVC.exe	92
PID 2964 wrote to memory of 2476	2964	OSPPSVC.exe	92
PID 2964 wrote to memory of 2476	2964	OSPPSVC.exe	92
PID 2964 wrote to memory of 2420	2964	OSPPSVC.exe	93
PID 2964 wrote to memory of 2420	2964	OSPPSVC.exe	93
PID 2964 wrote to memory of 2420	2964	OSPPSVC.exe	93
PID 2476 wrote to memory of 2432	2476	WScript.exe	94
PID 2476 wrote to memory of 2432	2476	WScript.exe	94
PID 2476 wrote to memory of 2432	2476	WScript.exe	94
PID 2432 wrote to memory of 2164	2432	OSPPSVC.exe	95
PID 2432 wrote to memory of 2164	2432	OSPPSVC.exe	95
PID 2432 wrote to memory of 2164	2432	OSPPSVC.exe	95
PID 2432 wrote to memory of 2908	2432	OSPPSVC.exe	96
PID 2432 wrote to memory of 2908	2432	OSPPSVC.exe	96
PID 2432 wrote to memory of 2908	2432	OSPPSVC.exe	96
PID 2164 wrote to memory of 2388	2164	WScript.exe	97
PID 2164 wrote to memory of 2388	2164	WScript.exe	97
PID 2164 wrote to memory of 2388	2164	WScript.exe	97
PID 2388 wrote to memory of 2128	2388	OSPPSVC.exe	98
PID 2388 wrote to memory of 2128	2388	OSPPSVC.exe	98
PID 2388 wrote to memory of 2128	2388	OSPPSVC.exe	98
PID 2388 wrote to memory of 2700	2388	OSPPSVC.exe	99
PID 2388 wrote to memory of 2700	2388	OSPPSVC.exe	99
PID 2388 wrote to memory of 2700	2388	OSPPSVC.exe	99
PID 2128 wrote to memory of 2772	2128	WScript.exe	100
PID 2128 wrote to memory of 2772	2128	WScript.exe	100
PID 2128 wrote to memory of 2772	2128	WScript.exe	100
PID 2772 wrote to memory of 2660	2772	OSPPSVC.exe	101
PID 2772 wrote to memory of 2660	2772	OSPPSVC.exe	101
PID 2772 wrote to memory of 2660	2772	OSPPSVC.exe	101
PID 2772 wrote to memory of 868	2772	OSPPSVC.exe	102
PID 2772 wrote to memory of 868	2772	OSPPSVC.exe	102
PID 2772 wrote to memory of 868	2772	OSPPSVC.exe	102
PID 2660 wrote to memory of 1664	2660	WScript.exe	103
PID 2660 wrote to memory of 1664	2660	WScript.exe	103
PID 2660 wrote to memory of 1664	2660	WScript.exe	103
PID 1664 wrote to memory of 1544	1664	OSPPSVC.exe	104
PID 1664 wrote to memory of 1544	1664	OSPPSVC.exe	104
PID 1664 wrote to memory of 1544	1664	OSPPSVC.exe	104
PID 1664 wrote to memory of 2136	1664	OSPPSVC.exe	105
PID 1664 wrote to memory of 2136	1664	OSPPSVC.exe	105
PID 1664 wrote to memory of 2136	1664	OSPPSVC.exe	105
PID 2188 wrote to memory of 1028	2188	taskeng.exe	107
PID 2188 wrote to memory of 1028	2188	taskeng.exe	107
PID 2188 wrote to memory of 1028	2188	taskeng.exe	107

System policy modification 1 TTPs 45 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Serverbroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Serverbroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Serverbroker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dabf40b2ed8d96638f713f6373ef64cb.exe
C:\Users\Admin\AppData\Local\Temp\dabf40b2ed8d96638f713f6373ef64cb.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"
1⤵
- DcRat
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Mssurrogatebrowserhostperf\8kPsHmvrEcJwjafU40gzsGMXV7Gtxc.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Mssurrogatebrowserhostperf\SmjPROQS4143k.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Mssurrogatebrowserhostperf\Serverbroker.exe
      "C:\Mssurrogatebrowserhostperf\Serverbroker.exe"
      4⤵
      Modifies WinLogon for persistence
      UAC bypass
      Drops file in Drivers directory
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2748
    - - C:\Program Files\7-Zip\Lang\OSPPSVC.exe
        
        "C:\Program Files\7-Zip\Lang\OSPPSVC.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2964
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f7d5e75a-45c2-44a8-bcf6-b4e7f778c483.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Program Files\7-Zip\Lang\OSPPSVC.exe
        
        "C:\Program Files\7-Zip\Lang\OSPPSVC.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9911b3e7-83c8-4e4b-b3fa-9d51403fddec.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Program Files\7-Zip\Lang\OSPPSVC.exe
        
        "C:\Program Files\7-Zip\Lang\OSPPSVC.exe"
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2388
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\561692f8-04de-4d1c-bce6-4cd466b7ecc0.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Program Files\7-Zip\Lang\OSPPSVC.exe
        
        "C:\Program Files\7-Zip\Lang\OSPPSVC.exe"
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2772
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4c94a08c-7944-417d-a842-493aef615c0d.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Program Files\7-Zip\Lang\OSPPSVC.exe
        
        "C:\Program Files\7-Zip\Lang\OSPPSVC.exe"
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1664
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c7d0b987-f63e-4cb0-b58b-4c4a2a01c7af.vbs"
        14⤵
        
        PID:1544
        
        C:\Program Files\7-Zip\Lang\OSPPSVC.exe
        
        "C:\Program Files\7-Zip\Lang\OSPPSVC.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d18f5003-18cb-473f-833a-72d1eeebcddc.vbs"
        14⤵
        
        PID:2136
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a590be0a-8289-44ea-ad00-048f8d48ef92.vbs"
        12⤵
        
        PID:868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\19476b80-e2cb-414f-a689-6e3f35eb6aa0.vbs"
        10⤵
        
        PID:2700
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\50731987-3051-471a-876d-dad6e43faa73.vbs"
        8⤵
        
        PID:2908
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1cbc276-44ef-40a2-885b-04fd270f96e4.vbs"
        6⤵
        
        PID:2420
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Users\Public\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Public\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Users\Public\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Mssurrogatebrowserhostperf\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Mssurrogatebrowserhostperf\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Mssurrogatebrowserhostperf\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\cmd.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Mssurrogatebrowserhostperf\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Mssurrogatebrowserhostperf\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Mssurrogatebrowserhostperf\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Windows\Tasks\cmd.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Tasks\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Windows\Tasks\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Mssurrogatebrowserhostperf\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Mssurrogatebrowserhostperf\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Mssurrogatebrowserhostperf\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Videos\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Videos\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Videos\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Program Files\7-Zip\Lang\OSPPSVC.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Favorites\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Favorites\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Favorites\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\DigitalLocker\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\DigitalLocker\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Start Menu\cmd.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Start Menu\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\taskeng.exe
taskeng.exe {B32E3057-7D13-4B9B-BC82-9F991168E66B} S-1-5-21-1846800975-3917212583-2893086201-1000:ZQABOPWE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files\Windows Photo Viewer\ja-JP\explorer.exe
  "C:\Program Files\Windows Photo Viewer\ja-JP\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1028
- C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\spoolsv.exe
  "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\spoolsv.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2164
- C:\Program Files\7-Zip\Lang\OSPPSVC.exe
  "C:\Program Files\7-Zip\Lang\OSPPSVC.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:1600
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2bb53b5f-9231-4513-928e-5629c85ef7e6.vbs"
    3⤵
    PID:2044
  - - C:\Program Files\7-Zip\Lang\OSPPSVC.exe
      "C:\Program Files\7-Zip\Lang\OSPPSVC.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:276
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1b5b6753-4344-417a-98cc-df5d194341a2.vbs"
        5⤵
        
        PID:1500
      - C:\Program Files\7-Zip\Lang\OSPPSVC.exe
        
        "C:\Program Files\7-Zip\Lang\OSPPSVC.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\272d3a21-72e1-4a1f-bf42-b2aa37a45b48.vbs"
        7⤵
        
        PID:2524
        
        C:\Program Files\7-Zip\Lang\OSPPSVC.exe
        
        "C:\Program Files\7-Zip\Lang\OSPPSVC.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:812
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\99b588fd-7099-4485-a65f-c01855270c32.vbs"
        9⤵
        
        PID:1752
        
        C:\Program Files\7-Zip\Lang\OSPPSVC.exe
        
        "C:\Program Files\7-Zip\Lang\OSPPSVC.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2528
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8143388e-4dfd-47ec-96ca-75485da58a5a.vbs"
        11⤵
        
        PID:2580
        
        C:\Program Files\7-Zip\Lang\OSPPSVC.exe
        
        "C:\Program Files\7-Zip\Lang\OSPPSVC.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2352
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c9811ed-aee3-4f08-8715-0d160ce3da54.vbs"
        13⤵
        
        PID:2912
        
        C:\Program Files\7-Zip\Lang\OSPPSVC.exe
        
        "C:\Program Files\7-Zip\Lang\OSPPSVC.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc46c8cf-22b7-4417-94cb-e514e583dad3.vbs"
        15⤵
        
        PID:1480
        
        C:\Program Files\7-Zip\Lang\OSPPSVC.exe
        
        "C:\Program Files\7-Zip\Lang\OSPPSVC.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df33ea55-746a-48cc-90fd-695cc5e62119.vbs"
        15⤵
        
        PID:2232
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a54e8720-11bd-4775-a112-a8384415bb80.vbs"
        13⤵
        
        PID:1796
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52acfa56-f85f-443f-8df3-faa21149e5fd.vbs"
        11⤵
        
        PID:548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\74982970-8372-48c1-a20a-72f1cf0f2cd8.vbs"
        9⤵
        
        PID:2812
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d51e0b13-83c9-45e4-bb4d-da4d09f476aa.vbs"
        7⤵
        
        PID:2052
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08ca8976-0619-49f6-8f0a-20672280ec89.vbs"
        5⤵
        
        PID:1536
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aee46c45-1550-4cb8-bb8a-b40b7ced274d.vbs"
    3⤵
    PID:2560
- C:\Users\Public\audiodg.exe
  C:\Users\Public\audiodg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2960
- C:\Mssurrogatebrowserhostperf\conhost.exe
  C:\Mssurrogatebrowserhostperf\conhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Mssurrogatebrowserhostperf\lsm.exe
  C:\Mssurrogatebrowserhostperf\lsm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Users\Public\Favorites\dwm.exe
  C:\Users\Public\Favorites\dwm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1368
- C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe
  "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:648
- C:\Windows\DigitalLocker\smss.exe
  C:\Windows\DigitalLocker\smss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Program Files\Windows Photo Viewer\ja-JP\explorer.exe
  "C:\Program Files\Windows Photo Viewer\ja-JP\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2276
- C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe
  C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1656
- C:\Users\Admin\Start Menu\cmd.exe
  "C:\Users\Admin\Start Menu\cmd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Program Files (x86)\Microsoft Sync Framework\services.exe
  "C:\Program Files (x86)\Microsoft Sync Framework\services.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\spoolsv.exe
  "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\spoolsv.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:936
- C:\Program Files\7-Zip\Lang\OSPPSVC.exe
  "C:\Program Files\7-Zip\Lang\OSPPSVC.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Users\Public\audiodg.exe
  C:\Users\Public\audiodg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Mssurrogatebrowserhostperf\conhost.exe
  C:\Mssurrogatebrowserhostperf\conhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:564
- C:\Mssurrogatebrowserhostperf\lsm.exe
  C:\Mssurrogatebrowserhostperf\lsm.exe
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:1964
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\169106b3-6cdc-4df4-8d45-37348184090a.vbs"
    3⤵
    PID:812
  - - C:\Mssurrogatebrowserhostperf\lsm.exe
      C:\Mssurrogatebrowserhostperf\lsm.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:2132
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\901f87ca-bd48-42c7-b92c-be2a3f3a9188.vbs"
        5⤵
        
        PID:1368
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\472d37f4-9519-4040-82a1-eeb2c9e6dbc3.vbs"
        5⤵
        
        PID:2480
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9fc80efe-e4de-47d1-9c91-803cb80c314e.vbs"
    3⤵
    PID:1876
- C:\Program Files\Windows Photo Viewer\ja-JP\explorer.exe
  "C:\Program Files\Windows Photo Viewer\ja-JP\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Mssurrogatebrowserhostperf\8kPsHmvrEcJwjafU40gzsGMXV7Gtxc.vbe

Filesize
216B

MD5
a7e0475eb8e2e26e457a4c752dc26444

SHA1
060c460c794a47f44686b717eb8d15f1945edb58

SHA256
8ece9e304ffb5cba5d51cb2187907d4910167fca5f67a59d316fd9d2ce47ae52

SHA512
9d7cac7d9fd93e3b88c1ea7663af7687ae08e8ee39dcc1549c4fb25d7342f3a9774b7f8e7c1b50ab96b09629ab4c587548a5b1063c843132277c7baa2069cad6

Download Submit
C:\Mssurrogatebrowserhostperf\Serverbroker.exe

Filesize
2.2MB

MD5
67f998093c11d8a104aef7a92a2d5b26

SHA1
cea4392bfb620e2d5b303c7f39fe68a30080a771

SHA256
f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1

SHA512
e3572eaf810f95944206728a83c822244afd079f59cef2911e11dddd85216a09663edbd8041fe5281c0ca9a6182bc5b70d77cbcc403baccbfbdc1d9c6a137e92

Download Submit
C:\Mssurrogatebrowserhostperf\SmjPROQS4143k.bat

Filesize
160B

MD5
fa37ae621180833b315a091613c1540f

SHA1
88d6ec7192566b085231e6a6f05f813a8355514d

SHA256
f3f37ca346054c66639f1320cccc5b8f618ce747c5f9086bd18376a9a42a3484

SHA512
d77768e84e9e01e3e64e00914c5e8f1067796a369c71939641f052c9f9b7d17aef5c9b5e96449d610976f45e291b567c49fc374099a9284c8045ca51d51c9bd0

Download Submit
C:\Program Files\7-Zip\Lang\OSPPSVC.exe

Filesize
2.2MB

MD5
93cb1ef2a84c5b2705b5ff4c183e7a76

SHA1
5d7ff4ee651cca4e7738f50d2cc03ca01d0eed34

SHA256
bd18470960eaea5e387e68aefb4f98e699b1fa91e2f9d83f72a65d6563d801eb

SHA512
aa00bc4ca6da4fed51044128d92c578ab9002c085be37e876e6ce7691fc64acbfe593246241d647bb9c5f502545a159bdb205f359d32b8171f03ae8b33d3f1c9

Download Submit
C:\Program Files\Uninstall Information\RCXB87B.tmp

Filesize
2.2MB

MD5
70f35d04041d9c029d59586fc6aa3819

SHA1
a9f37462584d22bad8909ffc1c047cdfee84f049

SHA256
517ef97c6f4481e5d6eac2ebd79fbbfe34c9dbe59a0f775c0c2a3e3b942aaae6

SHA512
1739c6ce05e4fbee9d2829a95b3ca910b28a0f853d2a6e11e779fae7b419c46b7fd22641f28c2b91b826dd3905e478a23fa1e55c31665adea3f6a042d7078f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\1b5b6753-4344-417a-98cc-df5d194341a2.vbs

Filesize
714B

MD5
f14d535bd26869ecc19e332b88b5f5c3

SHA1
f14135f9ed5f00d65ea922f98845ba09ea549ce4

SHA256
ef10109382280192ac175361e653f7db15979443a5b635b1d9b13f3b36f768bc

SHA512
429c8844f5d162eb08a476decff5474f3f49b866ddb14c5ee4c761dd465f553c963ff5811da5129fce8a08d59dd610697a21d71264b29ad845083055a0a5d725

Download Submit
C:\Users\Admin\AppData\Local\Temp\272d3a21-72e1-4a1f-bf42-b2aa37a45b48.vbs

Filesize
715B

MD5
8830b693c0779acf7520fbfbbdb2629c

SHA1
193ea64f0563309e7673967fbc399b7136278ed8

SHA256
5a0b374fb92072c72cbd19bc9b51ff87d52161311c93637db6398afc8ffb9341

SHA512
aea2f4e3e39a74369ab2c2459e3bcfade198676c963b2abb851b77312060a22fb8e7c2a269ea9f0e541a42065e67de90d1165dac075af9e18f99280cc45f75b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2bb53b5f-9231-4513-928e-5629c85ef7e6.vbs

Filesize
715B

MD5
081ec095a7f78e1fc60298577cd96fd3

SHA1
29ead2ca5f909de3c716f2becdef4ebc63dd4ae4

SHA256
8a241be2637730ad08d99e89e386e666812ce196a7679cbef018bba63053f47d

SHA512
7fd9d458738d5c617ffc7e0947c6adc6b362859ffe7a40e5c09dbdb55b878737cfd8293f69fa4afa32813708e9bce12dfe0ebef2e419fb393d612b3244bb0b31

Download Submit
C:\Users\Admin\AppData\Local\Temp\472d37f4-9519-4040-82a1-eeb2c9e6dbc3.vbs

Filesize
489B

MD5
45e82df8157501cad00ed3814171872f

SHA1
ccc064f70e8c52d469807d99cd3f4b1d1e656784

SHA256
db1468723b6d59a38e9691b2f36e9d9fddf70895451b821a4cd13d643e9ed610

SHA512
6bdccfccc05ffb77cf93fdecf93a3ce586bc843c42fc3f8b313a4ae13e548a31844edd40b6f7fb0b913d15b8489749c3667d59e924b0b09e3e1ce50651556373

Download Submit
C:\Users\Admin\AppData\Local\Temp\4c94a08c-7944-417d-a842-493aef615c0d.vbs

Filesize
715B

MD5
09fe50f6b97822d3053c114d57ba66f5

SHA1
7d5bddddc126a5faed6398bf9d1adacd055fcec1

SHA256
a1cb8c4abd0887b0426c40671ade506dcd73d8a5ccbbd166f86acff55399fade

SHA512
e082a1f73f0bdad1059d0547e577d503187f96ab4b0e4a5f70ac39470ab6278fcbadd5dd22fad4822ebb9126dc1bc4c137fa8ab08969293b48b71b7fffc0efc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\561692f8-04de-4d1c-bce6-4cd466b7ecc0.vbs

Filesize
715B

MD5
30f94755deefc54ac2e0e00acefba113

SHA1
94e1fd058c8fefe1d94b3251ec97fb85fd3aa6b5

SHA256
99becb8b7e43fd79cbc3fba8dccd3bdcecb592f6d1ef1cc7f197cbae631eee1d

SHA512
d47641a0d73416c803053667c3fe4a6357a44e356632b57628b351aec88956ef42789b473c081606e4e51943a5fc38acc6e0cf98bc5a8190fad17b00be7d5381

Download Submit
C:\Users\Admin\AppData\Local\Temp\8143388e-4dfd-47ec-96ca-75485da58a5a.vbs

Filesize
715B

MD5
0245dc48d5090bf2b83bab8161606d76

SHA1
56cfcfba33456f2eab935fb6ba5344084f4a94e5

SHA256
31809a7bbf993351ce5c70c3a46a815da0eb140968df3f0a25a473af9087e319

SHA512
52c59ac612ed2cc25ef51b67acb40ad0e274e763b667a20af8aaa1b307f376e24c76e2a251cd0a36effee4bbbf17564981d34b578aa9850d3e55d8140141b64c

Download Submit
C:\Users\Admin\AppData\Local\Temp\8cfa5d0cbff348e40bcb01de7b34993e01bb2942.exe

Filesize
2.2MB

MD5
1f6a136b34fc862f272e7aaf0cb76c5d

SHA1
d82f56ed7d8aa97995f65a80d563cba5c8a9f6a4

SHA256
20acfab8488bf9f1c2460204f81c56d208c490de2a239ad93f37493cf6ee504b

SHA512
c491c6f0d6188e7e12823be214b666322300511a1b2690ee7c6652362016f1c6f0867ad99f618b5f0a747637f9fbeb7f16ed153427cd759482547ecd384e643b

Download Submit
C:\Users\Admin\AppData\Local\Temp\9911b3e7-83c8-4e4b-b3fa-9d51403fddec.vbs

Filesize
715B

MD5
6a990ef523d47bc9a5980d71f80c4522

SHA1
ad5b3f97ac8992714a398d14c5cb7cc9c56684e7

SHA256
ece3ed0dc6c4d643859555b9d2448ea350173374bb8ea63335be06666d59842e

SHA512
46ddfeceb4fe82094af6d46c39a8aebe4fe55ae9deacfcac59d7ea93f177b41f26a826a3ff81070c0ca9a329b5cdb0aad092f1b78a0ffc2c2c96f90db8c93b49

Download Submit
C:\Users\Admin\AppData\Local\Temp\99b588fd-7099-4485-a65f-c01855270c32.vbs

Filesize
714B

MD5
92be591eee0eee4c1ac1170a1f2f1fa0

SHA1
fbdb2d1fa13321f8b5070073b9529f2f28141dc4

SHA256
2b3691a7c1e468bd2ab794d7c029b8ab3893cbf329fdbb86a468f4c944e72ff2

SHA512
c5b328c9290b02f868d59e0232cad1216a65d6a3080e0952ca38a4039c0fe2b03084a6fde8ac22e71eadccdda7532c73cab5148b7a9ba75ae8d05901d206fa5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\a1cbc276-44ef-40a2-885b-04fd270f96e4.vbs

Filesize
491B

MD5
c2229a019a2e5fd71267c02e798b3a60

SHA1
e9bd42653b6b4280aac8178e20ce76283badc2e9

SHA256
9f186820be9420022b1614215928c7b28a4eff80b4aadbc84f9ba79d7965948f

SHA512
73f8c5754668595bce97bbaf7381abe2778f885a0b0da55ed75a2d7b68ea95900b92c26b596589d3229511f7033f8ca083e1e4a3b9dc33c513406a4c10e055eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\c7d0b987-f63e-4cb0-b58b-4c4a2a01c7af.vbs

Filesize
715B

MD5
c157ad7484c5cb22c2ee9c938984224e

SHA1
b91b8879fe683791d525197d4452ae84706393b1

SHA256
42047a048cd7785013396550d38c9beb313ea3e9a6de922f5251c83b7b8752db

SHA512
6be796d22eb591a3e7074c98a8708c38caab420338faaa14af2d081f6a81a53226afbbfa56661234bd459f2d39c79c5b110708ae4d9db0f25a2ae44b9ee22ac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\f7d5e75a-45c2-44a8-bcf6-b4e7f778c483.vbs

Filesize
715B

MD5
d2c1cd732e0211c79c47eeec0a1f1f66

SHA1
345734a675cab32878d49b216f2f4c5ff1b8ec15

SHA256
2fa3849e079641e1d789468520de3f6c9d394943dca7e6765d17c47c2f6c0972

SHA512
a531dfd1d602ed6c70cf6a44f56d097edbd43129aecb8aaf6bb73a3e3c8b453c987894bbfdfb8bdf93afc5046847e8b47207daa3f9f0eb0c61be01bd1929933e

Download Submit
C:\Users\Public\Favorites\dwm.exe

Filesize
2.2MB

MD5
fdd321cafddf2b291544fcd9bcc23ced

SHA1
de33a4c644f9d24ea523ea303020fb9df2aa34d4

SHA256
64c17cde2090acdfcf84fa207e619bdf3119a9d458470e394bb58eab5bbe1412

SHA512
8897496fb175cd90406cf6284d32432b3350b2c3b00194cd25132bc469e093988c6b0f6e0bb6132d8aef476d642962f725c070f09c773a09ea13ad237933f800

Download Submit
memory/276-365-0x0000000000AF0000-0x0000000000D1E000-memory.dmp

Filesize
2.2MB

Download
memory/612-439-0x0000000001340000-0x000000000156E000-memory.dmp

Filesize
2.2MB

Download
memory/648-398-0x0000000000260000-0x000000000048E000-memory.dmp

Filesize
2.2MB

Download
memory/812-400-0x0000000000F30000-0x000000000115E000-memory.dmp

Filesize
2.2MB

Download
memory/936-447-0x0000000000390000-0x00000000005BE000-memory.dmp

Filesize
2.2MB

Download
memory/1028-343-0x0000000000AD0000-0x0000000000CFE000-memory.dmp

Filesize
2.2MB

Download
memory/1368-397-0x0000000000DB0000-0x0000000000FDE000-memory.dmp

Filesize
2.2MB

Download
memory/1600-349-0x0000000000320000-0x000000000054E000-memory.dmp

Filesize
2.2MB

Download
memory/1656-438-0x00000000012E0000-0x000000000150E000-memory.dmp

Filesize
2.2MB

Download
memory/1664-330-0x0000000000C70000-0x0000000000C82000-memory.dmp

Filesize
72KB

Download
memory/1964-448-0x0000000000140000-0x000000000036E000-memory.dmp

Filesize
2.2MB

Download
memory/2124-381-0x00000000000A0000-0x00000000002CE000-memory.dmp

Filesize
2.2MB

Download
memory/2132-456-0x0000000000130000-0x000000000035E000-memory.dmp

Filesize
2.2MB

Download
memory/2140-437-0x0000000001390000-0x00000000015BE000-memory.dmp

Filesize
2.2MB

Download
memory/2164-352-0x0000000001100000-0x000000000132E000-memory.dmp

Filesize
2.2MB

Download
memory/2276-427-0x0000000000C00000-0x0000000000E2E000-memory.dmp

Filesize
2.2MB

Download
memory/2352-428-0x00000000000E0000-0x000000000030E000-memory.dmp

Filesize
2.2MB

Download
memory/2372-436-0x00000000010F0000-0x000000000131E000-memory.dmp

Filesize
2.2MB

Download
memory/2388-306-0x0000000000160000-0x000000000038E000-memory.dmp

Filesize
2.2MB

Download
memory/2432-294-0x00000000010F0000-0x000000000131E000-memory.dmp

Filesize
2.2MB

Download
memory/2528-415-0x0000000001030000-0x000000000125E000-memory.dmp

Filesize
2.2MB

Download
memory/2724-380-0x0000000001320000-0x000000000154E000-memory.dmp

Filesize
2.2MB

Download
memory/2748-25-0x0000000000B80000-0x0000000000B88000-memory.dmp

Filesize
32KB

Download
memory/2748-38-0x0000000000CE0000-0x0000000000CE8000-memory.dmp

Filesize
32KB

Download
memory/2748-13-0x00000000011B0000-0x00000000013DE000-memory.dmp

Filesize
2.2MB

Download
memory/2748-21-0x0000000000B40000-0x0000000000B48000-memory.dmp

Filesize
32KB

Download
memory/2748-31-0x0000000000C70000-0x0000000000C7C000-memory.dmp

Filesize
48KB

Download
memory/2748-32-0x0000000000C80000-0x0000000000C8C000-memory.dmp

Filesize
48KB

Download
memory/2748-20-0x00000000005B0000-0x00000000005BC000-memory.dmp

Filesize
48KB

Download
memory/2748-19-0x0000000000600000-0x0000000000616000-memory.dmp

Filesize
88KB

Download
memory/2748-23-0x0000000000B50000-0x0000000000B5A000-memory.dmp

Filesize
40KB

Download
memory/2748-18-0x0000000000490000-0x00000000004A0000-memory.dmp

Filesize
64KB

Download
memory/2748-24-0x0000000000B60000-0x0000000000B6C000-memory.dmp

Filesize
48KB

Download
memory/2748-30-0x0000000000C60000-0x0000000000C6C000-memory.dmp

Filesize
48KB

Download
memory/2748-17-0x0000000000450000-0x0000000000458000-memory.dmp

Filesize
32KB

Download
memory/2748-16-0x0000000000470000-0x000000000048C000-memory.dmp

Filesize
112KB

Download
memory/2748-26-0x0000000000B90000-0x0000000000B9C000-memory.dmp

Filesize
48KB

Download
memory/2748-33-0x0000000000C90000-0x0000000000C9A000-memory.dmp

Filesize
40KB

Download
memory/2748-27-0x0000000000BA0000-0x0000000000BA8000-memory.dmp

Filesize
32KB

Download
memory/2748-15-0x0000000000440000-0x000000000044E000-memory.dmp

Filesize
56KB

Download
memory/2748-34-0x0000000000CA0000-0x0000000000CAE000-memory.dmp

Filesize
56KB

Download
memory/2748-29-0x0000000000BB0000-0x0000000000BC2000-memory.dmp

Filesize
72KB

Download
memory/2748-14-0x0000000000430000-0x000000000043E000-memory.dmp

Filesize
56KB

Download
memory/2748-39-0x0000000000CF0000-0x0000000000CFC000-memory.dmp

Filesize
48KB

Download
memory/2748-22-0x0000000000B70000-0x0000000000B80000-memory.dmp

Filesize
64KB

Download
memory/2748-37-0x0000000000CD0000-0x0000000000CDC000-memory.dmp

Filesize
48KB

Download
memory/2748-36-0x0000000000CC0000-0x0000000000CCE000-memory.dmp

Filesize
56KB

Download
memory/2748-35-0x0000000000CB0000-0x0000000000CB8000-memory.dmp

Filesize
32KB

Download
memory/2772-318-0x0000000000C80000-0x0000000000EAE000-memory.dmp

Filesize
2.2MB

Download
memory/2808-413-0x00000000003E0000-0x000000000060E000-memory.dmp

Filesize
2.2MB

Download
memory/2928-464-0x00000000000D0000-0x00000000002FE000-memory.dmp

Filesize
2.2MB

Download
memory/2960-353-0x0000000000E30000-0x000000000105E000-memory.dmp

Filesize
2.2MB

Download
memory/2964-283-0x0000000000930000-0x0000000000B5E000-memory.dmp

Filesize
2.2MB

Download
memory/2996-345-0x0000000001180000-0x00000000013AE000-memory.dmp

Filesize
2.2MB

Download