dcrat | 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0

Analysis

max time kernel
70s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14/01/2025, 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
Size

3.6MB
MD5

f2997dfb6f126670204c83344b678f0e
SHA1

fb1a90117ff594cac3b2cebbbbd072674f246ce3
SHA256

73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0
SHA512

20bd6c2e2aebf5e96f8d9497880538061f23ed8b925cf916749da16db6339a2dd2ff5166aa0c096e23f7654e5b2959d9af108cf5ccf68291cc80f8c7c2d235ad
SSDEEP

98304:NzRppqmmRX+6fo6du/5P2nPNWNG5trztTgyz+65WzU:NzRppqVDqOnVWNG5bR+65WzU

Score

10^/10

dcrat neshta discovery execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Detect Neshta payload 8 IoCs

resource	yara_rule
behavioral1/files/0x0001000000010314-12.dat	family_neshta
behavioral1/memory/1492-134-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1492-238-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1492-242-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1492-265-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1492-266-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1492-267-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1492-269-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	1040	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	1040	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	1040	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	1040	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	1040	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	1040	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	1040	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	1040	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1420	1040	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	1040	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	1040	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	1040	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	1040	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	1040	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	1040	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	1040	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	108	1040	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	1040	schtasks.exe	31

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
888	powershell.exe
1288	powershell.exe
2632	powershell.exe
796	powershell.exe
364	powershell.exe
1772	powershell.exe
1176	powershell.exe
548	powershell.exe
1720	powershell.exe
1588	powershell.exe
944	powershell.exe
2024	powershell.exe
2116	powershell.exe
2008	powershell.exe
2276	powershell.exe
2648	powershell.exe
1156	powershell.exe
1520	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
1948	smss.exe

Loads dropped DLL 3 IoCs

pid	Process
1492	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
1492	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
1492	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File created	C:\Windows\L2Schemas\explorer.exe	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
File created	C:\Windows\L2Schemas\7a0fd90576e088	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2932	PING.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2932	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1420	schtasks.exe
1172	schtasks.exe
2692	schtasks.exe
1980	schtasks.exe
2708	schtasks.exe
1532	schtasks.exe
2480	schtasks.exe
2672	schtasks.exe
1324	schtasks.exe
2136	schtasks.exe
1328	schtasks.exe
1756	schtasks.exe
1576	schtasks.exe
108	schtasks.exe
952	schtasks.exe
2428	schtasks.exe
2080	schtasks.exe
1408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
Token: SeDebugPrivilege	796	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	944	powershell.exe
Token: SeDebugPrivilege	1176	powershell.exe
Token: SeDebugPrivilege	888	powershell.exe
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeDebugPrivilege	1772	powershell.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeDebugPrivilege	364	powershell.exe
Token: SeDebugPrivilege	1288	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	1720	powershell.exe
Token: SeDebugPrivilege	1948	smss.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1948	smss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2320	1492	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	30
PID 1492 wrote to memory of 2320	1492	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	30
PID 1492 wrote to memory of 2320	1492	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	30
PID 1492 wrote to memory of 2320	1492	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	30
PID 2320 wrote to memory of 1176	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	50
PID 2320 wrote to memory of 1176	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	50
PID 2320 wrote to memory of 1176	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	50
PID 2320 wrote to memory of 944	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	51
PID 2320 wrote to memory of 944	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	51
PID 2320 wrote to memory of 944	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	51
PID 2320 wrote to memory of 2008	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	53
PID 2320 wrote to memory of 2008	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	53
PID 2320 wrote to memory of 2008	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	53
PID 2320 wrote to memory of 2024	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	55
PID 2320 wrote to memory of 2024	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	55
PID 2320 wrote to memory of 2024	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	55
PID 2320 wrote to memory of 1288	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	57
PID 2320 wrote to memory of 1288	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	57
PID 2320 wrote to memory of 1288	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	57
PID 2320 wrote to memory of 548	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	58
PID 2320 wrote to memory of 548	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	58
PID 2320 wrote to memory of 548	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	58
PID 2320 wrote to memory of 2632	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	59
PID 2320 wrote to memory of 2632	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	59
PID 2320 wrote to memory of 2632	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	59
PID 2320 wrote to memory of 796	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	61
PID 2320 wrote to memory of 796	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	61
PID 2320 wrote to memory of 796	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	61
PID 2320 wrote to memory of 364	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	63
PID 2320 wrote to memory of 364	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	63
PID 2320 wrote to memory of 364	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	63
PID 2320 wrote to memory of 2276	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	64
PID 2320 wrote to memory of 2276	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	64
PID 2320 wrote to memory of 2276	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	64
PID 2320 wrote to memory of 1520	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	65
PID 2320 wrote to memory of 1520	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	65
PID 2320 wrote to memory of 1520	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	65
PID 2320 wrote to memory of 888	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	66
PID 2320 wrote to memory of 888	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	66
PID 2320 wrote to memory of 888	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	66
PID 2320 wrote to memory of 1772	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	68
PID 2320 wrote to memory of 1772	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	68
PID 2320 wrote to memory of 1772	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	68
PID 2320 wrote to memory of 2116	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	69
PID 2320 wrote to memory of 2116	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	69
PID 2320 wrote to memory of 2116	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	69
PID 2320 wrote to memory of 1156	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	70
PID 2320 wrote to memory of 1156	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	70
PID 2320 wrote to memory of 1156	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	70
PID 2320 wrote to memory of 2648	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	72
PID 2320 wrote to memory of 2648	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	72
PID 2320 wrote to memory of 2648	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	72
PID 2320 wrote to memory of 1588	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	73
PID 2320 wrote to memory of 1588	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	73
PID 2320 wrote to memory of 1588	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	73
PID 2320 wrote to memory of 1720	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	74
PID 2320 wrote to memory of 1720	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	74
PID 2320 wrote to memory of 1720	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	74
PID 2320 wrote to memory of 2972	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	81
PID 2320 wrote to memory of 2972	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	81
PID 2320 wrote to memory of 2972	2320	73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe	81
PID 2972 wrote to memory of 680	2972	cmd.exe	88
PID 2972 wrote to memory of 680	2972	cmd.exe	88
PID 2972 wrote to memory of 680	2972	cmd.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
"C:\Users\Admin\AppData\Local\Temp\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\explorer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\Sample Pictures\smss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\winlogon.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Templates\WmiPrvSE.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1720
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m7kuOebR2S.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:680
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2932
  - - C:\Users\Public\Pictures\Sample Pictures\smss.exe
      "C:\Users\Public\Pictures\Sample Pictures\smss.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Windows\L2Schemas\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\L2Schemas\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\L2Schemas\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Pictures\Sample Pictures\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Pictures\Sample Pictures\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Templates\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\Templates\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Templates\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c07" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c07" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\Users\Admin\AppData\Local\Temp\m7kuOebR2S.bat

Filesize
177B

MD5
8820377596f1f02328bfcaab5c7e7944

SHA1
56418e020c0aa61545d3ac4c6c9a5e9e2007eedb

SHA256
a2d578cc25c3dc5762a3b3de5da70474f1268f9b252df9596f43ecdab86177dc

SHA512
64387b8770b17ea2d1556ca3b300fd0cea5e054e2accb21363cc8e5ea84c884fba64900a71c82968f106d63821accbef69992ea53ce0774e3b6c2fdbcfe98064

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4cb08af7460082c48a62789a4155ed02

SHA1
a3508deb3a79613c882f65f9fd96cef2cfad38e7

SHA256
297e483d85b14082d5b385483ecdf8662e8d511d5aed9a06f33b6560807997e5

SHA512
2dcbe031029a5c2f99ffe702da5b6320ff8f6ab312bd43ba8bcaf17fddea28528f9b7763db0b1ca4d3c400baedd01582782b0f3c8a15bb7143e2e8cfb595fdf4

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe

Filesize
3.5MB

MD5
3e3fe7663181211e5983da48431ddf33

SHA1
0bea67a96dba0798541ea15426fb0ac38c10ff06

SHA256
cc398c54d30b3c0c1ff1d54f03fb157578346d088c9ce38fc6347698f25fc166

SHA512
80056c508dade773729c239bd0b43d92c9e6d8de513b19776bf28665e37e44d022fd6c5f33ebfa3fe31b9480ce0705e9581d872b8e79703931da459d4f5922a0

Download Submit
memory/796-172-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download
memory/796-171-0x000000001B1A0000-0x000000001B482000-memory.dmp

Filesize
2.9MB

Download
memory/1492-267-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1492-238-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1492-242-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1492-265-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1492-266-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1492-134-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1492-269-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1948-241-0x0000000001210000-0x000000000159E000-memory.dmp

Filesize
3.6MB

Download
memory/2320-99-0x00000000024E0000-0x00000000024F8000-memory.dmp

Filesize
96KB

Download
memory/2320-135-0x000007FEF6003000-0x000007FEF6004000-memory.dmp

Filesize
4KB

Download
memory/2320-111-0x0000000002540000-0x0000000002556000-memory.dmp

Filesize
88KB

Download
memory/2320-113-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/2320-115-0x0000000002500000-0x000000000250E000-memory.dmp

Filesize
56KB

Download
memory/2320-117-0x0000000002510000-0x0000000002520000-memory.dmp

Filesize
64KB

Download
memory/2320-119-0x0000000002580000-0x0000000002590000-memory.dmp

Filesize
64KB

Download
memory/2320-121-0x0000000002710000-0x000000000276A000-memory.dmp

Filesize
360KB

Download
memory/2320-123-0x0000000002610000-0x000000000261E000-memory.dmp

Filesize
56KB

Download
memory/2320-125-0x0000000002620000-0x0000000002630000-memory.dmp

Filesize
64KB

Download
memory/2320-127-0x0000000002630000-0x000000000263E000-memory.dmp

Filesize
56KB

Download
memory/2320-129-0x0000000002660000-0x0000000002678000-memory.dmp

Filesize
96KB

Download
memory/2320-131-0x0000000002640000-0x000000000264C000-memory.dmp

Filesize
48KB

Download
memory/2320-133-0x000000001B440000-0x000000001B48E000-memory.dmp

Filesize
312KB

Download
memory/2320-107-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download
memory/2320-109-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/2320-147-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2320-105-0x0000000000C90000-0x0000000000C9E000-memory.dmp

Filesize
56KB

Download
memory/2320-103-0x0000000000C80000-0x0000000000C90000-memory.dmp

Filesize
64KB

Download
memory/2320-101-0x0000000000490000-0x00000000004A0000-memory.dmp

Filesize
64KB

Download
memory/2320-174-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2320-97-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/2320-201-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2320-95-0x0000000000CA0000-0x0000000000CBC000-memory.dmp

Filesize
112KB

Download
memory/2320-93-0x00000000001F0000-0x00000000001FE000-memory.dmp

Filesize
56KB

Download
memory/2320-91-0x0000000000C50000-0x0000000000C76000-memory.dmp

Filesize
152KB

Download
memory/2320-17-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2320-16-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2320-15-0x0000000000D50000-0x00000000010DE000-memory.dmp

Filesize
3.6MB

Download
memory/2320-14-0x000007FEF6003000-0x000007FEF6004000-memory.dmp

Filesize
4KB

Download