dcrat | 4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-02-2025 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Size

1.8MB
MD5

2a6e3f3275d854bf07aba2427baa6610
SHA1

37d6411844b5d8a9d997f38f7718168b33cbc564
SHA256

4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b
SHA512

a6054ab62fc7415dafaca1dc273b42edd9680541e964b7b20d6b7ed07d65fb2ee01ea833bfedec9abc3687814449bb65f7c041ba462aed5cc44397e0ae2d4ef0
SSDEEP

24576:4p8qWcx5AkyZrtziLafchZChMHTzC6SXYdzNyCzrgEctNjfRn5rEQi:wcJQLa0hs2HTbbtNhzrgZnp5rE

Score

10^/10

dcrat execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\services.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\services.exe\", \"C:\\Users\\Default User\\taskhost.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\services.exe\", \"C:\\Users\\Default User\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\OSPPSVC.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\services.exe\", \"C:\\Users\\Default User\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\OSPPSVC.exe\", \"C:\\Users\\Default User\\winlogon.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\services.exe\", \"C:\\Users\\Default User\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\OSPPSVC.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Program Files\\Windows Sidebar\\dllhost.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\services.exe\", \"C:\\Users\\Default User\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\OSPPSVC.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Program Files\\Windows Sidebar\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2700	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2700	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	2700	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2700	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2700	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	2700	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	2700	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2700	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	2700	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2700	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2700	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	2700	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	2700	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	2700	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	2700	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	2700	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	2700	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	2700	schtasks.exe	30

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2932	powershell.exe
2944	powershell.exe
2232	powershell.exe
844	powershell.exe
288	powershell.exe
2912	powershell.exe
2916	powershell.exe
2840	powershell.exe
2692	powershell.exe
2636	powershell.exe
2200	powershell.exe
1752	powershell.exe
2984	powershell.exe
2168	powershell.exe
2980	powershell.exe
2204	powershell.exe
2216	powershell.exe
2928	powershell.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\services.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Default User\\taskhost.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\OSPPSVC.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Default User\\winlogon.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Windows Sidebar\\dllhost.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\services.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Default User\\taskhost.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\OSPPSVC.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Default User\\winlogon.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Windows Sidebar\\dllhost.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe\""	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ipinfo.io
8	ipinfo.io

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCCEC79B4C2E7C4A2C9C4A14F5C5DDB84E.TMP	csc.exe
File created	\??\c:\Windows\System32\byyuy-.exe	csc.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\services.exe	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\c5b4cb5e9653cc	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
File created	C:\Program Files\Windows Sidebar\dllhost.exe	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
File opened for modification	C:\Program Files\Windows Sidebar\dllhost.exe	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
File created	C:\Program Files\Windows Sidebar\5940a34987c991	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\OSPPSVC.exe	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\1610b97d3ab4a7	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1156	schtasks.exe
2724	schtasks.exe
1948	schtasks.exe
1444	schtasks.exe
1920	schtasks.exe
2696	schtasks.exe
1504	schtasks.exe
2412	schtasks.exe
1252	schtasks.exe
1060	schtasks.exe
2876	schtasks.exe
2600	schtasks.exe
812	schtasks.exe
1848	schtasks.exe
2660	schtasks.exe
1560	schtasks.exe
1312	schtasks.exe
864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
Token: SeDebugPrivilege	288	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	1752	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	844	powershell.exe
Token: SeDebugPrivilege	2132	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2848	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	34
PID 2384 wrote to memory of 2848	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	34
PID 2384 wrote to memory of 2848	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	34
PID 2848 wrote to memory of 2732	2848	csc.exe	36
PID 2848 wrote to memory of 2732	2848	csc.exe	36
PID 2848 wrote to memory of 2732	2848	csc.exe	36
PID 2384 wrote to memory of 288	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	52
PID 2384 wrote to memory of 288	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	52
PID 2384 wrote to memory of 288	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	52
PID 2384 wrote to memory of 1752	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	53
PID 2384 wrote to memory of 1752	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	53
PID 2384 wrote to memory of 1752	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	53
PID 2384 wrote to memory of 2932	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	54
PID 2384 wrote to memory of 2932	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	54
PID 2384 wrote to memory of 2932	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	54
PID 2384 wrote to memory of 2916	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	55
PID 2384 wrote to memory of 2916	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	55
PID 2384 wrote to memory of 2916	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	55
PID 2384 wrote to memory of 2912	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	56
PID 2384 wrote to memory of 2912	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	56
PID 2384 wrote to memory of 2912	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	56
PID 2384 wrote to memory of 2944	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	57
PID 2384 wrote to memory of 2944	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	57
PID 2384 wrote to memory of 2944	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	57
PID 2384 wrote to memory of 2928	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	58
PID 2384 wrote to memory of 2928	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	58
PID 2384 wrote to memory of 2928	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	58
PID 2384 wrote to memory of 2840	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	59
PID 2384 wrote to memory of 2840	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	59
PID 2384 wrote to memory of 2840	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	59
PID 2384 wrote to memory of 2984	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	60
PID 2384 wrote to memory of 2984	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	60
PID 2384 wrote to memory of 2984	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	60
PID 2384 wrote to memory of 2692	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	61
PID 2384 wrote to memory of 2692	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	61
PID 2384 wrote to memory of 2692	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	61
PID 2384 wrote to memory of 2636	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	62
PID 2384 wrote to memory of 2636	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	62
PID 2384 wrote to memory of 2636	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	62
PID 2384 wrote to memory of 2168	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	63
PID 2384 wrote to memory of 2168	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	63
PID 2384 wrote to memory of 2168	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	63
PID 2384 wrote to memory of 2980	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	64
PID 2384 wrote to memory of 2980	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	64
PID 2384 wrote to memory of 2980	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	64
PID 2384 wrote to memory of 2204	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	65
PID 2384 wrote to memory of 2204	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	65
PID 2384 wrote to memory of 2204	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	65
PID 2384 wrote to memory of 2200	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	66
PID 2384 wrote to memory of 2200	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	66
PID 2384 wrote to memory of 2200	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	66
PID 2384 wrote to memory of 2232	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	67
PID 2384 wrote to memory of 2232	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	67
PID 2384 wrote to memory of 2232	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	67
PID 2384 wrote to memory of 2216	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	68
PID 2384 wrote to memory of 2216	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	68
PID 2384 wrote to memory of 2216	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	68
PID 2384 wrote to memory of 844	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	69
PID 2384 wrote to memory of 844	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	69
PID 2384 wrote to memory of 844	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	69
PID 2384 wrote to memory of 3020	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	77
PID 2384 wrote to memory of 3020	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	77
PID 2384 wrote to memory of 3020	2384	4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe	77
PID 3020 wrote to memory of 1880	3020	cmd.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
"C:\Users\Admin\AppData\Local\Temp\4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xqjrlbx5\xqjrlbx5.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBE8E.tmp" "c:\Windows\System32\CSCCEC79B4C2E7C4A2C9C4A14F5C5DDB84E.TMP"
    3⤵
    PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\taskhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\de-DE\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1yxBWcZbA8.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1880
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2664
- - C:\Users\Admin\AppData\Local\Temp\4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe
    "C:\Users\Admin\AppData\Local\Temp\4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe"
    3⤵
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b4" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b4" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\services.exe

Filesize
1.8MB

MD5
2a6e3f3275d854bf07aba2427baa6610

SHA1
37d6411844b5d8a9d997f38f7718168b33cbc564

SHA256
4aa398eb330d666b85164e1fdc28802c585071870e09576109523cdafc10ee7b

SHA512
a6054ab62fc7415dafaca1dc273b42edd9680541e964b7b20d6b7ed07d65fb2ee01ea833bfedec9abc3687814449bb65f7c041ba462aed5cc44397e0ae2d4ef0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1yxBWcZbA8.bat

Filesize
278B

MD5
cdda133d7770fb8f575f64c51a5bcead

SHA1
d18f0c1519a919a6120eaa68d8dd820e7a3777a1

SHA256
46272e48d84cefea2e216ca4489d709315641f72aef7a4490ce2d89fa9e7cacc

SHA512
2d10e011c6b9ac8e273ed66228516a6ea558a92caa3ed955d269a51ac3a35452233bc7798a0e2325d143a42a5e83756b34311d6dcf014a69648d6d392b44d1ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBE8E.tmp

Filesize
1KB

MD5
4ef5c4bab103493a0f4cf47bedd30539

SHA1
ccd88420f0b652a83f670020a13f21bd5d519eb5

SHA256
0049bafbabeb81285e3dda69b6612081124bc123590d7c4b131db40d27399ef3

SHA512
0f467d134d619f69c8fadb7bf762e5120d96ef643449b7c9ec8c144b13483dd36415d4dd7b92426f8cecc3d796099a615f97f113a35681bcad87dcda4edd72d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
ad8f9958a6c39055784a6fbda16fe230

SHA1
70e465e70485fa4a9fd704e55df1ddd2e001705d

SHA256
a0d900d35d95e503f7c5331ee05a5f08fb3e3890b2f1d9f87fb49a1e88858d66

SHA512
b2d68de6e96f6fd190d8d4df03b5e544e500d67571e5e79013418456ed971271c6eac29afb37d1eddf4f3c32eb421ba2f814a01ca02feab2d847335788078a9a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xqjrlbx5\xqjrlbx5.0.cs

Filesize
418B

MD5
cfe1abfd25a38691a275abc2d7c7041b

SHA1
567f0098f5ce733048486231544cdfa37c6820a3

SHA256
9e62368dd1fab25af85174cba66161c0a1bada24cd256c92f80cf7d16ac001b5

SHA512
3411c41d387404a3b8281b170431f257a17835c7e72dfc77280d81c60a88d0fbe68ee528434b673ee79598a88ac3fc52bbbde7744b47f6235bfb29dcc7f4946a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xqjrlbx5\xqjrlbx5.cmdline

Filesize
235B

MD5
2203b49481a50226037113d1884d5d17

SHA1
b9209c3a80daab33478c21ce974370de76f1a978

SHA256
fed07aa7ec0f5d36e62b00805cc33b50ce4b2c07efbfe8a8bb91c967450e05b8

SHA512
976bc46e409bb77299ad54b30a5bd33f9ef52fec8666ad689d19416550089e2aa7313d6d8fd474eff77514a98bc891c52f7b95c538c230850e86da6e3d141fb4

Download Submit
\??\c:\Windows\System32\CSCCEC79B4C2E7C4A2C9C4A14F5C5DDB84E.TMP

Filesize
1KB

MD5
078586b266e519b5c113064d7a0bf45c

SHA1
a9395c0ef35add5c75591ebb94c85c1f33f408bf

SHA256
ccf292ff9f142b204ad4f4481a044ba8f9ab274305dcb604bf0b8ae91819ab1e

SHA512
5b8eb6aad62657309088c4668d633c2aa6324d4824ec32c3c5e133df0a5493a4342c980e077ba565f3aab29c58f95c8db7195415a1e554384405c1457730f959

Download Submit
memory/288-59-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/288-61-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/2132-135-0x0000000000DC0000-0x0000000000F88000-memory.dmp

Filesize
1.8MB

Download
memory/2384-7-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/2384-8-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/2384-17-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/2384-13-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/2384-28-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/2384-12-0x0000000000420000-0x0000000000428000-memory.dmp

Filesize
32KB

Download
memory/2384-10-0x0000000000440000-0x000000000045C000-memory.dmp

Filesize
112KB

Download
memory/2384-15-0x0000000000430000-0x000000000043C000-memory.dmp

Filesize
48KB

Download
memory/2384-0-0x000007FEF5E43000-0x000007FEF5E44000-memory.dmp

Filesize
4KB

Download
memory/2384-6-0x0000000000410000-0x000000000041E000-memory.dmp

Filesize
56KB

Download
memory/2384-4-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/2384-3-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/2384-2-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/2384-129-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/2384-1-0x0000000000880000-0x0000000000A48000-memory.dmp

Filesize
1.8MB

Download