dcrat | 26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2025 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
Size

984KB
MD5

b813c234f84296fc8c62e48152bf2d20
SHA1

6448ce15c36cdd80c54a3921a0250c7d4567b343
SHA256

26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8
SHA512

1b7a317447a1ad86db00d29e9a247555e8cf748369ba35851001fd04501bb01bac69ad6474ed219e530822be7544849b087aa3102cd6d96e9c1cb2f3606b24cc
SSDEEP

12288:MyEIOYTNEIf5AycvEhKIV6tEcln0Ai2a61h3cQ9Fk+ntGoWuzsx1oiLgo:MyErYT+PvXIUln/1GJgo

Score

10^/10

dcrat defense_evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 49 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1344	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3280	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	700	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4368	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3708	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3436	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3104	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3516	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4128	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3864	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4064	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3504	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	60	3904	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	3904	schtasks.exe	83

UAC bypass 3 TTPs 6 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3204-1-0x0000000000020000-0x000000000011C000-memory.dmp	dcrat
behavioral2/files/0x0007000000023c96-25.dat	dcrat
behavioral2/files/0x000f000000023cbd-134.dat	dcrat
behavioral2/files/0x0009000000023c9e-147.dat	dcrat
behavioral2/files/0x000a000000023ca7-205.dat	dcrat
behavioral2/files/0x0009000000023cad-216.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4440	powershell.exe
1672	powershell.exe
3868	powershell.exe
3104	powershell.exe
2472	powershell.exe
1880	powershell.exe
4112	powershell.exe
1908	powershell.exe
4952	powershell.exe
3220	powershell.exe
3216	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\Control Panel\International\Geo\Nation	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe

Executes dropped EXE 1 IoCs

pid	Process
60	sihost.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sihost.exe

Drops file in Program Files directory 36 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Program Files\Windows NT\TableTextService\e6c9b481da804f	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\66fc9ff0ee96c2	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCXAF3D.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Program Files\Internet Explorer\7a0fd90576e088	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Program Files\Windows Defender\es-ES\RuntimeBroker.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Program Files\Windows NT\TableTextService\OfficeClickToRun.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\Internet Explorer\RCXA221.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\es-ES\RCXA64B.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCXAECE.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\7-Zip\RCXB5DA.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\RCXBF39.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Program Files\Windows NT\Accessories\es-ES\121e5b5079f7c0	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Program Files\Windows Defender\es-ES\9e8d7a4ca61bd9	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\Internet Explorer\RCXA220.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\RCXBA23.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\RuntimeBroker.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\OfficeClickToRun.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Program Files\ModifiableWindowsApps\Idle.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\7-Zip\RuntimeBroker.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\sihost.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Program Files\Internet Explorer\explorer.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Program Files\7-Zip\RuntimeBroker.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\sihost.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\Internet Explorer\explorer.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\7-Zip\RCXB5D9.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Program Files\Windows NT\Accessories\es-ES\sysmon.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\9e8d7a4ca61bd9	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\RCXBF18.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Program Files\7-Zip\9e8d7a4ca61bd9	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\es-ES\RCXA63B.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\es-ES\sysmon.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\RCXBA91.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\RCXBC96.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\RCXBD04.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ModemLogs\RCXAC5B.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Windows\AppReadiness\RCXC13E.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Windows\AppReadiness\Idle.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Windows\ModemLogs\explorer.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Windows\ModemLogs\7a0fd90576e088	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Windows\ShellComponents\e6c9b481da804f	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Windows\AppReadiness\6ccacd8608530f	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Windows\ModemLogs\explorer.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Windows\ShellComponents\OfficeClickToRun.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Windows\AppReadiness\RCXC13D.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Windows\ShellComponents\OfficeClickToRun.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File created	C:\Windows\AppReadiness\Idle.exe	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Windows\ModemLogs\RCXACCA.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Windows\ShellComponents\RCXB151.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
File opened for modification	C:\Windows\ShellComponents\RCXB152.tmp	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3504	schtasks.exe
1832	schtasks.exe
5068	schtasks.exe
1176	schtasks.exe
532	schtasks.exe
4920	schtasks.exe
2312	schtasks.exe
2456	schtasks.exe
4848	schtasks.exe
2368	schtasks.exe
4368	schtasks.exe
4592	schtasks.exe
5112	schtasks.exe
4648	schtasks.exe
4904	schtasks.exe
1244	schtasks.exe
208	schtasks.exe
3104	schtasks.exe
976	schtasks.exe
4128	schtasks.exe
2492	schtasks.exe
3700	schtasks.exe
2180	schtasks.exe
3516	schtasks.exe
4780	schtasks.exe
2316	schtasks.exe
4064	schtasks.exe
2000	schtasks.exe
3280	schtasks.exe
2348	schtasks.exe
3048	schtasks.exe
3708	schtasks.exe
3436	schtasks.exe
4840	schtasks.exe
2652	schtasks.exe
4448	schtasks.exe
2080	schtasks.exe
2468	schtasks.exe
540	schtasks.exe
4876	schtasks.exe
3160	schtasks.exe
3088	schtasks.exe
1792	schtasks.exe
60	schtasks.exe
3884	schtasks.exe
700	schtasks.exe
984	schtasks.exe
3864	schtasks.exe
4036	schtasks.exe
2908	schtasks.exe
1344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	3104	powershell.exe
Token: SeDebugPrivilege	3220	powershell.exe
Token: SeDebugPrivilege	4112	powershell.exe
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	60	sihost.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 2472	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	138
PID 3204 wrote to memory of 2472	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	138
PID 3204 wrote to memory of 1880	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	139
PID 3204 wrote to memory of 1880	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	139
PID 3204 wrote to memory of 4112	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	140
PID 3204 wrote to memory of 4112	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	140
PID 3204 wrote to memory of 1908	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	141
PID 3204 wrote to memory of 1908	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	141
PID 3204 wrote to memory of 4440	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	142
PID 3204 wrote to memory of 4440	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	142
PID 3204 wrote to memory of 4952	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	143
PID 3204 wrote to memory of 4952	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	143
PID 3204 wrote to memory of 1672	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	144
PID 3204 wrote to memory of 1672	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	144
PID 3204 wrote to memory of 3220	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	145
PID 3204 wrote to memory of 3220	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	145
PID 3204 wrote to memory of 3868	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	146
PID 3204 wrote to memory of 3868	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	146
PID 3204 wrote to memory of 3216	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	147
PID 3204 wrote to memory of 3216	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	147
PID 3204 wrote to memory of 3104	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	148
PID 3204 wrote to memory of 3104	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	148
PID 3204 wrote to memory of 60	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	160
PID 3204 wrote to memory of 60	3204	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe	160

System policy modification 1 TTPs 6 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe
"C:\Users\Admin\AppData\Local\Temp\26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8N.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3104
- C:\Program Files (x86)\MSBuild\Microsoft\sihost.exe
  "C:\Program Files (x86)\MSBuild\Microsoft\sihost.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:60

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Start Menu\dllhost.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\dllhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Start Menu\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\Accessories\es-ES\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\es-ES\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\Accessories\es-ES\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows\ModemLogs\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\ModemLogs\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Windows\ModemLogs\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Windows\ShellComponents\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\ShellComponents\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Windows\ShellComponents\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\7-Zip\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Pictures\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Public\Pictures\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\es-ES\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\TableTextService\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\TableTextService\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Windows\AppReadiness\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\AppReadiness\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Windows\AppReadiness\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:60

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe

Filesize
984KB

MD5
d8dd510e7b06b7bc3da5579acf9c5516

SHA1
c569d917159742837d4db6f122d2f4918c385aee

SHA256
b600958f50a11231b53ea688c1c337e578f9c63df56be226619e8d41f579e878

SHA512
2296db349797365cd8123eff4ca6a2f14347c12e5edd6d297f54820a5444156eb1cfd9e111c8242ffea42875d7275b8e8a3c6257a9f3ff86480db09b050f9a36

Download Submit
C:\Program Files\Windows Defender\es-ES\RuntimeBroker.exe

Filesize
984KB

MD5
4229a2fe8248dddfbddf8b0e72408fac

SHA1
3118f85c445aa8d5d56db6351f46a6f843d497ba

SHA256
00b37ab31d28f19c35eb2b45edf2c130376666e85b1776e7cb8e82be505fda2a

SHA512
2ee17d59095f007441ead3ecdf9f0ef5ef847d7a052f8831aebffa9acd1a6b558663b54070d22bf1fb4355c351f76169a988f3f35094829cc10b0473d3aa5c48

Download Submit
C:\Program Files\Windows NT\TableTextService\OfficeClickToRun.exe

Filesize
984KB

MD5
2389ad876a1df376b2b2f929814a497f

SHA1
7ed289403acc53e4dd315a217f6703b2ecfb017a

SHA256
4bc9d726c42a36af361bc215257a643ac3333c53a8ccd01b4c39ae587ef1313b

SHA512
a99a57ceef2b2fd08390f2fe16548e4d68d59c2d3fd5f5d3f21eb418fcca68d4f70fe8243c1389151387b6d31529eed4c6d8b78ca58ff3f5250c65d93ab0e505

Download Submit
C:\Recovery\WindowsRE\TextInputHost.exe

Filesize
984KB

MD5
b813c234f84296fc8c62e48152bf2d20

SHA1
6448ce15c36cdd80c54a3921a0250c7d4567b343

SHA256
26c6ef53b2879f9186b0d848992fd353adea2b66169eee692c14c8fde230bcc8

SHA512
1b7a317447a1ad86db00d29e9a247555e8cf748369ba35851001fd04501bb01bac69ad6474ed219e530822be7544849b087aa3102cd6d96e9c1cb2f3606b24cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6c47b3f4e68eebd47e9332eebfd2dd4e

SHA1
67f0b143336d7db7b281ed3de5e877fa87261834

SHA256
8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

SHA512
0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h3my1wxx.xop.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\ModemLogs\explorer.exe

Filesize
984KB

MD5
f5eb8fd2dd6cb9c3792d234803f60b15

SHA1
3188426806e03b6fa69f9ced3d0157725595b81a

SHA256
43732eaa6044987667e11261dbbf02f7d7f31c4d7fc3cf58849daa935defeffc

SHA512
8e170d03629a95fdce478ea7ffbac1fdfbbf2f53443dc79de248e7f3781e3256097e84c0c8190a1c456ef9a02b9b4a3cb0d8e94d7e445e122f78154768945650

Download Submit
memory/2472-312-0x000001149B9F0000-0x000001149BA12000-memory.dmp

Filesize
136KB

Download
memory/3204-18-0x00007FFA4CD80000-0x00007FFA4D841000-memory.dmp

Filesize
10.8MB

Download
memory/3204-8-0x000000001AE90000-0x000000001AE9C000-memory.dmp

Filesize
48KB

Download
memory/3204-11-0x000000001AEB0000-0x000000001AEB8000-memory.dmp

Filesize
32KB

Download
memory/3204-10-0x000000001B630000-0x000000001B63C000-memory.dmp

Filesize
48KB

Download
memory/3204-17-0x00007FFA4CD80000-0x00007FFA4D841000-memory.dmp

Filesize
10.8MB

Download
memory/3204-0-0x00007FFA4CD83000-0x00007FFA4CD85000-memory.dmp

Filesize
8KB

Download
memory/3204-12-0x000000001AEC0000-0x000000001AECE000-memory.dmp

Filesize
56KB

Download
memory/3204-13-0x000000001AED0000-0x000000001AEDC000-memory.dmp

Filesize
48KB

Download
memory/3204-9-0x000000001AEA0000-0x000000001AEAC000-memory.dmp

Filesize
48KB

Download
memory/3204-162-0x00007FFA4CD83000-0x00007FFA4CD85000-memory.dmp

Filesize
8KB

Download
memory/3204-186-0x00007FFA4CD80000-0x00007FFA4D841000-memory.dmp

Filesize
10.8MB

Download
memory/3204-14-0x000000001AEE0000-0x000000001AEEC000-memory.dmp

Filesize
48KB

Download
memory/3204-6-0x000000001AE70000-0x000000001AE86000-memory.dmp

Filesize
88KB

Download
memory/3204-224-0x00007FFA4CD80000-0x00007FFA4D841000-memory.dmp

Filesize
10.8MB

Download
memory/3204-7-0x000000001AD00000-0x000000001AD0A000-memory.dmp

Filesize
40KB

Download
memory/3204-4-0x00000000021F0000-0x00000000021F8000-memory.dmp

Filesize
32KB

Download
memory/3204-418-0x00007FFA4CD80000-0x00007FFA4D841000-memory.dmp

Filesize
10.8MB

Download
memory/3204-5-0x000000001ACF0000-0x000000001AD00000-memory.dmp

Filesize
64KB

Download
memory/3204-3-0x00000000021E0000-0x00000000021EE000-memory.dmp

Filesize
56KB

Download
memory/3204-2-0x00007FFA4CD80000-0x00007FFA4D841000-memory.dmp

Filesize
10.8MB

Download
memory/3204-1-0x0000000000020000-0x000000000011C000-memory.dmp

Filesize
1008KB

Download