dcrat | 35916e8b40ec27b8f3a931566a94f5a464dc9e5783c7fca1bdd194e7193bf0d7

Analysis

max time kernel
150s
max time network
158s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d61876ddede62df51f22178f3f3810d3.exe
Size

1.1MB
MD5

d61876ddede62df51f22178f3f3810d3
SHA1

f61526c97f574e637c624293249c612894a3706e
SHA256

db703d6a45db327d773c77238bed0a9905bb2c2a049bd4467fc43ab0df12e735
SHA512

4b909d0c38361a5daa93b89c84182f48bb3f0352d72a40917700e0de83cd9ef7ae399487b50cb2bb44a1066aac91750b5aac44c2c681f20d4848f609800dbfa4
SSDEEP

12288:6mc4TfAkdN7TPPl2Eh8Nv6L1FMCubuoGTeh46qTnnCPQeB89hNuD1hOp1i3l10gR:6h4TbLUEhZL/GspeYhkc9Soh2SfwJ

Score

10^/10

dcrat defense_evasion execution infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\mfc120jpn\\lsass.exe\", \"C:\\Windows\\System32\\NlsData000f\\services.exe\", \"C:\\Windows\\System32\\resmon\\dllhost.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\mfc120jpn\\lsass.exe\", \"C:\\Windows\\System32\\NlsData000f\\services.exe\", \"C:\\Windows\\System32\\resmon\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\lsass.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\mfc120jpn\\lsass.exe\", \"C:\\Windows\\System32\\NlsData000f\\services.exe\", \"C:\\Windows\\System32\\resmon\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Program Files\\Java\\jdk1.7.0_80\\lib\\visualvm\\visualvm\\update_tracking\\dllhost.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\mfc120jpn\\lsass.exe\", \"C:\\Windows\\System32\\NlsData000f\\services.exe\", \"C:\\Windows\\System32\\resmon\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Program Files\\Java\\jdk1.7.0_80\\lib\\visualvm\\visualvm\\update_tracking\\dllhost.exe\", \"C:\\Windows\\System32\\wbem\\WMI_Tracing\\WmiPrvSE.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\mfc120jpn\\lsass.exe\", \"C:\\Windows\\System32\\NlsData000f\\services.exe\", \"C:\\Windows\\System32\\resmon\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Program Files\\Java\\jdk1.7.0_80\\lib\\visualvm\\visualvm\\update_tracking\\dllhost.exe\", \"C:\\Windows\\System32\\wbem\\WMI_Tracing\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\wersvc\\sppsvc.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\mfc120jpn\\lsass.exe\", \"C:\\Windows\\System32\\NlsData000f\\services.exe\", \"C:\\Windows\\System32\\resmon\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Program Files\\Java\\jdk1.7.0_80\\lib\\visualvm\\visualvm\\update_tracking\\dllhost.exe\", \"C:\\Windows\\System32\\wbem\\WMI_Tracing\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\wersvc\\sppsvc.exe\", \"C:\\Windows\\System32\\wbem\\WLanHC\\WmiPrvSE.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\mfc120jpn\\lsass.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\mfc120jpn\\lsass.exe\", \"C:\\Windows\\System32\\NlsData000f\\services.exe\""	d61876ddede62df51f22178f3f3810d3.exe

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2768	schtasks.exe	30

UAC bypass 3 TTPs 42 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d61876ddede62df51f22178f3f3810d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d61876ddede62df51f22178f3f3810d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d61876ddede62df51f22178f3f3810d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2108	powershell.exe
1208	powershell.exe
1508	powershell.exe
2508	powershell.exe
2440	powershell.exe
2140	powershell.exe
2284	powershell.exe
1832	powershell.exe
2296	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	d61876ddede62df51f22178f3f3810d3.exe

Executes dropped EXE 13 IoCs

pid	Process
1720	dllhost.exe
2632	dllhost.exe
1572	dllhost.exe
1944	dllhost.exe
1700	dllhost.exe
1776	dllhost.exe
1552	dllhost.exe
588	dllhost.exe
1848	dllhost.exe
1468	dllhost.exe
1776	dllhost.exe
2188	dllhost.exe
1672	dllhost.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\System32\\NlsData000f\\services.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\lsass.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\lsass.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\WMI_Tracing\\WmiPrvSE.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\wersvc\\sppsvc.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\WMI_Tracing\\WmiPrvSE.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\WLanHC\\WmiPrvSE.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\System32\\NlsData000f\\services.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\resmon\\dllhost.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\wersvc\\sppsvc.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\mfc120jpn\\lsass.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\resmon\\dllhost.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Java\\jdk1.7.0_80\\lib\\visualvm\\visualvm\\update_tracking\\dllhost.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Java\\jdk1.7.0_80\\lib\\visualvm\\visualvm\\update_tracking\\dllhost.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\WLanHC\\WmiPrvSE.exe\""	d61876ddede62df51f22178f3f3810d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\mfc120jpn\\lsass.exe\""	d61876ddede62df51f22178f3f3810d3.exe

Checks whether UAC is enabled 1 TTPs 28 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d61876ddede62df51f22178f3f3810d3.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d61876ddede62df51f22178f3f3810d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File created	C:\Windows\System32\wbem\WLanHC\24dbde2999530e	d61876ddede62df51f22178f3f3810d3.exe
File opened for modification	C:\Windows\System32\mfc120jpn\RCXA008.tmp	d61876ddede62df51f22178f3f3810d3.exe
File opened for modification	C:\Windows\System32\resmon\RCXA40F.tmp	d61876ddede62df51f22178f3f3810d3.exe
File opened for modification	C:\Windows\System32\wbem\WMI_Tracing\WmiPrvSE.exe	d61876ddede62df51f22178f3f3810d3.exe
File opened for modification	C:\Windows\System32\mfc120jpn\lsass.exe	d61876ddede62df51f22178f3f3810d3.exe
File created	C:\Windows\System32\resmon\dllhost.exe	d61876ddede62df51f22178f3f3810d3.exe
File created	C:\Windows\System32\wersvc\sppsvc.exe	d61876ddede62df51f22178f3f3810d3.exe
File created	C:\Windows\System32\wersvc\0a1fd5f707cd16	d61876ddede62df51f22178f3f3810d3.exe
File opened for modification	C:\Windows\System32\wersvc\RCXAD85.tmp	d61876ddede62df51f22178f3f3810d3.exe
File opened for modification	C:\Windows\System32\wersvc\sppsvc.exe	d61876ddede62df51f22178f3f3810d3.exe
File opened for modification	C:\Windows\System32\wbem\WLanHC\WmiPrvSE.exe	d61876ddede62df51f22178f3f3810d3.exe
File created	C:\Windows\System32\NlsData000f\services.exe	d61876ddede62df51f22178f3f3810d3.exe
File created	C:\Windows\System32\wbem\WMI_Tracing\WmiPrvSE.exe	d61876ddede62df51f22178f3f3810d3.exe
File opened for modification	C:\Windows\System32\NlsData000f\RCXA20B.tmp	d61876ddede62df51f22178f3f3810d3.exe
File opened for modification	C:\Windows\System32\NlsData000f\services.exe	d61876ddede62df51f22178f3f3810d3.exe
File created	C:\Windows\System32\mfc120jpn\6203df4a6bafc7	d61876ddede62df51f22178f3f3810d3.exe
File created	C:\Windows\System32\NlsData000f\c5b4cb5e9653cc	d61876ddede62df51f22178f3f3810d3.exe
File created	C:\Windows\System32\resmon\5940a34987c991	d61876ddede62df51f22178f3f3810d3.exe
File created	C:\Windows\System32\wbem\WMI_Tracing\24dbde2999530e	d61876ddede62df51f22178f3f3810d3.exe
File opened for modification	C:\Windows\System32\resmon\dllhost.exe	d61876ddede62df51f22178f3f3810d3.exe
File opened for modification	C:\Windows\System32\wbem\WMI_Tracing\RCXAAF5.tmp	d61876ddede62df51f22178f3f3810d3.exe
File opened for modification	C:\Windows\System32\wbem\WLanHC\RCXAF89.tmp	d61876ddede62df51f22178f3f3810d3.exe
File created	C:\Windows\System32\mfc120jpn\lsass.exe	d61876ddede62df51f22178f3f3810d3.exe
File created	C:\Windows\System32\wbem\WLanHC\WmiPrvSE.exe	d61876ddede62df51f22178f3f3810d3.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe	d61876ddede62df51f22178f3f3810d3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\5940a34987c991	d61876ddede62df51f22178f3f3810d3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\RCXA884.tmp	d61876ddede62df51f22178f3f3810d3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe	d61876ddede62df51f22178f3f3810d3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2792	schtasks.exe
2664	schtasks.exe
2788	schtasks.exe
1852	schtasks.exe
2872	schtasks.exe
2916	schtasks.exe
2648	schtasks.exe
2756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2532	d61876ddede62df51f22178f3f3810d3.exe
2440	powershell.exe
1508	powershell.exe
1832	powershell.exe
1208	powershell.exe
2140	powershell.exe
2284	powershell.exe
2508	powershell.exe
2296	powershell.exe
2108	powershell.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe
1720	dllhost.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	d61876ddede62df51f22178f3f3810d3.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	1720	dllhost.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	2632	dllhost.exe
Token: SeDebugPrivilege	1572	dllhost.exe
Token: SeDebugPrivilege	1944	dllhost.exe
Token: SeDebugPrivilege	1700	dllhost.exe
Token: SeDebugPrivilege	1776	dllhost.exe
Token: SeDebugPrivilege	1552	dllhost.exe
Token: SeDebugPrivilege	588	dllhost.exe
Token: SeDebugPrivilege	1848	dllhost.exe
Token: SeDebugPrivilege	1468	dllhost.exe
Token: SeDebugPrivilege	1776	dllhost.exe
Token: SeDebugPrivilege	2188	dllhost.exe
Token: SeDebugPrivilege	1672	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2508	2532	d61876ddede62df51f22178f3f3810d3.exe	39
PID 2532 wrote to memory of 2508	2532	d61876ddede62df51f22178f3f3810d3.exe	39
PID 2532 wrote to memory of 2508	2532	d61876ddede62df51f22178f3f3810d3.exe	39
PID 2532 wrote to memory of 2440	2532	d61876ddede62df51f22178f3f3810d3.exe	40
PID 2532 wrote to memory of 2440	2532	d61876ddede62df51f22178f3f3810d3.exe	40
PID 2532 wrote to memory of 2440	2532	d61876ddede62df51f22178f3f3810d3.exe	40
PID 2532 wrote to memory of 1832	2532	d61876ddede62df51f22178f3f3810d3.exe	42
PID 2532 wrote to memory of 1832	2532	d61876ddede62df51f22178f3f3810d3.exe	42
PID 2532 wrote to memory of 1832	2532	d61876ddede62df51f22178f3f3810d3.exe	42
PID 2532 wrote to memory of 1508	2532	d61876ddede62df51f22178f3f3810d3.exe	44
PID 2532 wrote to memory of 1508	2532	d61876ddede62df51f22178f3f3810d3.exe	44
PID 2532 wrote to memory of 1508	2532	d61876ddede62df51f22178f3f3810d3.exe	44
PID 2532 wrote to memory of 1208	2532	d61876ddede62df51f22178f3f3810d3.exe	46
PID 2532 wrote to memory of 1208	2532	d61876ddede62df51f22178f3f3810d3.exe	46
PID 2532 wrote to memory of 1208	2532	d61876ddede62df51f22178f3f3810d3.exe	46
PID 2532 wrote to memory of 2284	2532	d61876ddede62df51f22178f3f3810d3.exe	47
PID 2532 wrote to memory of 2284	2532	d61876ddede62df51f22178f3f3810d3.exe	47
PID 2532 wrote to memory of 2284	2532	d61876ddede62df51f22178f3f3810d3.exe	47
PID 2532 wrote to memory of 2108	2532	d61876ddede62df51f22178f3f3810d3.exe	48
PID 2532 wrote to memory of 2108	2532	d61876ddede62df51f22178f3f3810d3.exe	48
PID 2532 wrote to memory of 2108	2532	d61876ddede62df51f22178f3f3810d3.exe	48
PID 2532 wrote to memory of 2296	2532	d61876ddede62df51f22178f3f3810d3.exe	49
PID 2532 wrote to memory of 2296	2532	d61876ddede62df51f22178f3f3810d3.exe	49
PID 2532 wrote to memory of 2296	2532	d61876ddede62df51f22178f3f3810d3.exe	49
PID 2532 wrote to memory of 2140	2532	d61876ddede62df51f22178f3f3810d3.exe	50
PID 2532 wrote to memory of 2140	2532	d61876ddede62df51f22178f3f3810d3.exe	50
PID 2532 wrote to memory of 2140	2532	d61876ddede62df51f22178f3f3810d3.exe	50
PID 2532 wrote to memory of 1720	2532	d61876ddede62df51f22178f3f3810d3.exe	57
PID 2532 wrote to memory of 1720	2532	d61876ddede62df51f22178f3f3810d3.exe	57
PID 2532 wrote to memory of 1720	2532	d61876ddede62df51f22178f3f3810d3.exe	57
PID 1720 wrote to memory of 2816	1720	dllhost.exe	58
PID 1720 wrote to memory of 2816	1720	dllhost.exe	58
PID 1720 wrote to memory of 2816	1720	dllhost.exe	58
PID 1720 wrote to memory of 2812	1720	dllhost.exe	59
PID 1720 wrote to memory of 2812	1720	dllhost.exe	59
PID 1720 wrote to memory of 2812	1720	dllhost.exe	59
PID 2816 wrote to memory of 2632	2816	WScript.exe	61
PID 2816 wrote to memory of 2632	2816	WScript.exe	61
PID 2816 wrote to memory of 2632	2816	WScript.exe	61
PID 2632 wrote to memory of 2312	2632	dllhost.exe	62
PID 2632 wrote to memory of 2312	2632	dllhost.exe	62
PID 2632 wrote to memory of 2312	2632	dllhost.exe	62
PID 2632 wrote to memory of 1892	2632	dllhost.exe	63
PID 2632 wrote to memory of 1892	2632	dllhost.exe	63
PID 2632 wrote to memory of 1892	2632	dllhost.exe	63
PID 2312 wrote to memory of 1572	2312	WScript.exe	64
PID 2312 wrote to memory of 1572	2312	WScript.exe	64
PID 2312 wrote to memory of 1572	2312	WScript.exe	64
PID 1572 wrote to memory of 936	1572	dllhost.exe	65
PID 1572 wrote to memory of 936	1572	dllhost.exe	65
PID 1572 wrote to memory of 936	1572	dllhost.exe	65
PID 1572 wrote to memory of 1544	1572	dllhost.exe	66
PID 1572 wrote to memory of 1544	1572	dllhost.exe	66
PID 1572 wrote to memory of 1544	1572	dllhost.exe	66
PID 936 wrote to memory of 1944	936	WScript.exe	67
PID 936 wrote to memory of 1944	936	WScript.exe	67
PID 936 wrote to memory of 1944	936	WScript.exe	67
PID 1944 wrote to memory of 2520	1944	dllhost.exe	68
PID 1944 wrote to memory of 2520	1944	dllhost.exe	68
PID 1944 wrote to memory of 2520	1944	dllhost.exe	68
PID 1944 wrote to memory of 2508	1944	dllhost.exe	69
PID 1944 wrote to memory of 2508	1944	dllhost.exe	69
PID 1944 wrote to memory of 2508	1944	dllhost.exe	69
PID 2520 wrote to memory of 1700	2520	WScript.exe	70

System policy modification 1 TTPs 42 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d61876ddede62df51f22178f3f3810d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d61876ddede62df51f22178f3f3810d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d61876ddede62df51f22178f3f3810d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d61876ddede62df51f22178f3f3810d3.exe
"C:\Users\Admin\AppData\Local\Temp\d61876ddede62df51f22178f3f3810d3.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d61876ddede62df51f22178f3f3810d3.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\mfc120jpn\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\NlsData000f\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\resmon\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\wbem\WMI_Tracing\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\wersvc\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\wbem\WLanHC\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1720
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\186a8516-6c26-4e1d-85af-845a5e0e190f.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2632
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0982b4c3-5d74-48e5-ab8e-d7f9d617c85c.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2312
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1572
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed81e929-295f-4a59-9517-f8b891695ec4.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:936
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1944
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4763c670-509a-44da-a6e0-f650474005f7.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1700
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c1e0f221-8341-4e42-af90-fb64c62298de.vbs"
        11⤵
        
        PID:352
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1776
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aacd1031-9a06-4626-941b-1ce79e7a8b7a.vbs"
        13⤵
        
        PID:1236
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3ada2c84-8c51-4680-a685-ae95ff596fee.vbs"
        15⤵
        
        PID:772
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:588
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67e4b713-efad-4bd8-b3eb-c76602ef37ed.vbs"
        17⤵
        
        PID:1624
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe"
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1e57a5bc-b054-44fc-ae95-69c8efe67a84.vbs"
        19⤵
        
        PID:688
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe"
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1468
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af6b1300-46e5-4f16-9f35-e6d935f8ee14.vbs"
        21⤵
        
        PID:1412
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe"
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1776
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\346031c6-027a-418a-a528-f4003c68b6c7.vbs"
        23⤵
        
        PID:2960
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe"
        24⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2188
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac1e0d29-6b66-496c-8cd1-73b4cd3f31f4.vbs"
        25⤵
        
        PID:2260
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe"
        26⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1672
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\59d74d95-4c7c-4f15-85d8-1976b4c465e6.vbs"
        27⤵
        
        PID:1532
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3ba8def2-e467-4e94-afc8-705a11e638ea.vbs"
        27⤵
        
        PID:2104
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a138936-7664-46c6-9da9-e498abf80373.vbs"
        25⤵
        
        PID:596
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac801247-6051-43f8-9876-b1f122c9743b.vbs"
        23⤵
        
        PID:2864
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\58e62ad7-3eef-40db-8e28-b0c25b961347.vbs"
        21⤵
        
        PID:2368
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb9a1e70-bb1a-47ec-9122-8226e5e14ce4.vbs"
        19⤵
        
        PID:1584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\874cf613-cd4e-4538-ab49-bae31e97b065.vbs"
        17⤵
        
        PID:540
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02b455ca-13eb-45df-9977-944f48e3d75e.vbs"
        15⤵
        
        PID:2980
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df50b368-dfe5-4888-8dbf-0239b7816302.vbs"
        13⤵
        
        PID:2012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ff6c817-821e-4b88-8046-6747c48a85b7.vbs"
        11⤵
        
        PID:2096
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7570d4f1-62b6-425e-905c-be602cef4208.vbs"
        9⤵
        
        PID:2508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78974068-d760-4738-b033-b5cda20b7129.vbs"
        7⤵
        
        PID:1544
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c79ed120-725b-46ff-943a-f127d9506bf7.vbs"
        5⤵
        
        PID:1892
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6d6c0ce7-78ac-4845-9bb2-a314423b3a30.vbs"
    3⤵
    PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\mfc120jpn\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\NlsData000f\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\resmon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\WMI_Tracing\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\wersvc\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\WLanHC\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe

Filesize
1.1MB

MD5
d61876ddede62df51f22178f3f3810d3

SHA1
f61526c97f574e637c624293249c612894a3706e

SHA256
db703d6a45db327d773c77238bed0a9905bb2c2a049bd4467fc43ab0df12e735

SHA512
4b909d0c38361a5daa93b89c84182f48bb3f0352d72a40917700e0de83cd9ef7ae399487b50cb2bb44a1066aac91750b5aac44c2c681f20d4848f609800dbfa4

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\dllhost.exe

Filesize
1.1MB

MD5
5e7d9155653217e088c1ea4cb1d2d74f

SHA1
1d49e44bd06a9e63d2062e02c699e93a6df015d8

SHA256
86b40b4fe680c19f8edaee20b4fbc6f6f66bf2b44a0afad932748871f30b53fc

SHA512
16961faad8665e0d331a2817dd64b08fcc2acdf25027b11a60e22642f0c76ef3fb6523e75a3213db3a64e274dd10065deb86aad95a939a14465d996a8af2e564

Download Submit
C:\Users\Admin\AppData\Local\Temp\0982b4c3-5d74-48e5-ab8e-d7f9d617c85c.vbs

Filesize
759B

MD5
4f25fe58b9689e34c4c5e1747139ceea

SHA1
f2a8fd4b9590c588e693daa652a6584eccc5f484

SHA256
55c4583cc05db7e726977ba2d8a28b57e2baf06193cc3d56b5da5367b5bc51d2

SHA512
d5ad4576176bedb333dd28146d94593c24e033379ecaf115b964ee4debda9c4cecd11a204c295aceebb5b38e6fd3bf66dc5325a7e0ba533992ce1ba92beff202

Download Submit
C:\Users\Admin\AppData\Local\Temp\186a8516-6c26-4e1d-85af-845a5e0e190f.vbs

Filesize
759B

MD5
e0fa8aa724b91082d918baa641bf372c

SHA1
de59410f02c624e20548e8dd33df8cad451fc4ee

SHA256
d8489a6e5845e8c7f0c083131c39c38e533f3d039b97879bc4b21112b8e033fe

SHA512
4537c60361d511defeb310808721a7fceebf8a720b6153bcee438b212d09fd6e44ba0dd03d728ab384c9d89a6a74a282f770db9153313bbd16083221bc5dfd12

Download Submit
C:\Users\Admin\AppData\Local\Temp\1e57a5bc-b054-44fc-ae95-69c8efe67a84.vbs

Filesize
759B

MD5
6c534cac1d74ef35de66e0db75ca7c2c

SHA1
67886520d3d24bfee644a77f81042533929cf850

SHA256
ce84d5fddcc7007922c3f3168d332fff66d1cdfbcc3c902d2d5d70955a660967

SHA512
068a4a2182484273984f800a7a2d1f3d80d292187e73e81c28a4dc9905dac6f23bc1725a76da13f61eed6901d46ccc5fa9e5b95a24e6ce537a6b6e7a4aa179db

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ada2c84-8c51-4680-a685-ae95ff596fee.vbs

Filesize
759B

MD5
b9bf8d89099615edc9add747c7dd1823

SHA1
9ae6d3dfd9ebe32f1b2450abb9eeafed6e18c273

SHA256
a5f2bd811b9e4fdd4eaac77d91e7db5f07b621d452a9d667baae88b4c2e670bb

SHA512
20a1f3962e256fffbcb3333b446c958621ab2015918ba04e40c20a8d0136b57af2c3fb61bd81cd533f68f9cf519efe7ef80f7afa7bb93febcd4fac1f0cae2711

Download Submit
C:\Users\Admin\AppData\Local\Temp\4763c670-509a-44da-a6e0-f650474005f7.vbs

Filesize
759B

MD5
74d058d18365c99b3f472aaa78d7dbf7

SHA1
84c1c2d11401fbcbbc6a74098b754982d45b5304

SHA256
2e73163b51a4bd5497cda78d94b04130cc267bd309e35c0f616a223775c731aa

SHA512
2340e1f8e0dd1aea6751be055fbe93748ade849a34b94d38ef03f1acaec5add14afb7a8d4318baa32bcaafa6f662a58afae5a5db14ff007752554fbde8455a42

Download Submit
C:\Users\Admin\AppData\Local\Temp\59d74d95-4c7c-4f15-85d8-1976b4c465e6.vbs

Filesize
759B

MD5
29afd4c120bf39cf4f4e4155be37f23a

SHA1
033df58676897290fe9860c2bd85444baffe69b8

SHA256
e477ca9eda2ecb84b043e5ec412cee12b4b43cb893c19cd14b57892af636b843

SHA512
545a032dd8363bf1744cd5585bafca2055f1e7e65b173f4257c369f80dd19d99b2cbc6f24e0058a5b00bfa0803f365b9b4ec68ede6d5256a9037c195eb700c0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\67e4b713-efad-4bd8-b3eb-c76602ef37ed.vbs

Filesize
758B

MD5
7123a044b494d008ffcd9e7ef4ce635d

SHA1
429cd16e6802f894252958531023a523b022504e

SHA256
fee2d39586a6f64442775361851d5ab353ec791ef7aa13af6c332b7472288a0e

SHA512
033bc3f2943b47843d299af9b5589ff363e8853d5debc13bf85ef950dd7a6a4d624750c6f6e0eee5abf42468e20f1b14fcb96954cc4f2ec24da52caad8c5a2e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\6d6c0ce7-78ac-4845-9bb2-a314423b3a30.vbs

Filesize
535B

MD5
5b16c2f6193dfa200874e94242147719

SHA1
b655cd33c1d1211b63637ebeb87c37bf463a1dfc

SHA256
80f5fc53c57211f3d21bd90529d3d08e397d30b46a4a44d8b58cd19bc994cba4

SHA512
83149c7357b59c7fc69a182e84c79a9c3627d7a04ae76db6a4a430c5efb1faf498845b67a17bf54428f03f162deb1639de002df68e082d6442b4aedfcebcd9f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\aacd1031-9a06-4626-941b-1ce79e7a8b7a.vbs

Filesize
759B

MD5
c9aee55d20d937d575296f0ab7064c25

SHA1
52aab92cf5d02dd2eae033b6d81c32c7ff7a3714

SHA256
c74f473f393a14e7064a6fd440093571bb7116b7f078fe12041db07db70b5d28

SHA512
923970519ef4ff8b030f3d1dfd82b200b7faf1332958c1f58eefbca032ba4b0808c5dc7bcecb028a4beaa84c111cdd39b98caa995eab573ad24aa2b10fcf71f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ac1e0d29-6b66-496c-8cd1-73b4cd3f31f4.vbs

Filesize
759B

MD5
0934cc64be0e42fcefd8d459defd6862

SHA1
7bdf0d2fd160cba0de01f619eba532153cce1d39

SHA256
78a4160360169feceb46eb2eca4f547d3968f21071006b156f5c0c8649fe88d3

SHA512
2e119fe263678ba149c5619abdf57ca1db1fba8950be39216f5a9cab8863703d935cf47fe8994cc0852bca44f414cdaeb66d3656c0f39d15ac67f4044b7dd7fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\af6b1300-46e5-4f16-9f35-e6d935f8ee14.vbs

Filesize
759B

MD5
e1973c1365ebac0795ecf8687fb830dc

SHA1
da788a93884ef3eae6926c79fde9ae231f7e512b

SHA256
6dea276fd0ebd31b6601a5ec744ea4af5a96c39fa3c4f4106c9651cc02180442

SHA512
013fede2ab853f28c5f56b7f25c3347d42e3cdaa2f4d60861b043746f25904f97813bf0ab2662f06cedefdf895268e5e7118b69ef366a89e9336de12ab425ce8

Download Submit
C:\Users\Admin\AppData\Local\Temp\c1e0f221-8341-4e42-af90-fb64c62298de.vbs

Filesize
759B

MD5
e6143e5e4353d716ffa3ff504e2c656c

SHA1
fcc9bedc1852a394442d6b6fb39f47b8d1d142ef

SHA256
6d403cec8fbd7041b8d2c59e8ebeeca30e3aa65580b549ca9c2a6b49a2f3ef62

SHA512
96d57232b2ed7356ccb87c770c336a096d6b02a1e9ffcb3d9614f36342eba4652cfdd49c31b518fcca185cdaf625003a956339d6632b4f458fd2b5b18cacadbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ed81e929-295f-4a59-9517-f8b891695ec4.vbs

Filesize
759B

MD5
b852ff56e035a4660a2e91f368b8eb6b

SHA1
34c0f707e68ad6a67327675b466e36ff3bf44864

SHA256
297c10c9027ebe8f0cd2d9a3522ca09fc1fb22bf63ee6626c8048c25e3b56553

SHA512
beb0fb559c9bd6f381e6da9f39975d3ae896da199493a1b929784d9de2d93d43690eef272ce53f02c9ca47732a4c2b096087a7e02e75fc0f2c13b8ea44ccff97

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e07d1b06afdcf205fc634a289c90600e

SHA1
fafb02abb4d2185828acd9d09943b4a8eed1a8b9

SHA256
00643be82ddd9347f605e45c0002b8e46bb500863f66c019b6ce853c42c5b0e0

SHA512
7b54fb74243443ca47eb44afce7ca7c08999b91a4048e383aa75132d1efb6901d6f37a237377cd4000beaef614a426bcbfeee272aa1a60cf0c05a6656ea5dc6c

Download Submit
C:\Windows\System32\wbem\WMI_Tracing\WmiPrvSE.exe

Filesize
1.1MB

MD5
76d88d8e1ec164414c73ee6736ad2983

SHA1
df48a388c22962eee1df31ead079625fd529fc1b

SHA256
3ce7e6a7c65f1976abaa30f011cf75aa893707dd721fa6f00cac802a77173b7f

SHA512
c791d4e0c79c4eef76df7687c758897bdd8c2184e4b390053f431a88f54fa849f96128bbaeb5fc0329e449b0578aeffd046687f2e6e4d1d271311ae19a0e1eb2

Download Submit
memory/588-227-0x0000000000240000-0x0000000000354000-memory.dmp

Filesize
1.1MB

Download
memory/588-228-0x00000000003F0000-0x0000000000402000-memory.dmp

Filesize
72KB

Download
memory/1552-215-0x0000000000C50000-0x0000000000D64000-memory.dmp

Filesize
1.1MB

Download
memory/1672-285-0x0000000000340000-0x0000000000454000-memory.dmp

Filesize
1.1MB

Download
memory/1700-191-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/1720-106-0x0000000000950000-0x0000000000A64000-memory.dmp

Filesize
1.1MB

Download
memory/1720-146-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/1776-203-0x0000000000210000-0x0000000000324000-memory.dmp

Filesize
1.1MB

Download
memory/1848-240-0x0000000000E80000-0x0000000000F94000-memory.dmp

Filesize
1.1MB

Download
memory/2284-134-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/2440-135-0x0000000001D20000-0x0000000001D28000-memory.dmp

Filesize
32KB

Download
memory/2532-14-0x0000000000D00000-0x0000000000D0C000-memory.dmp

Filesize
48KB

Download
memory/2532-20-0x0000000000ED0000-0x0000000000EDC000-memory.dmp

Filesize
48KB

Download
memory/2532-0-0x000007FEF5DA3000-0x000007FEF5DA4000-memory.dmp

Filesize
4KB

Download
memory/2532-18-0x0000000000DC0000-0x0000000000DC8000-memory.dmp

Filesize
32KB

Download
memory/2532-17-0x0000000000DB0000-0x0000000000DBC000-memory.dmp

Filesize
48KB

Download
memory/2532-1-0x0000000000F80000-0x0000000001094000-memory.dmp

Filesize
1.1MB

Download
memory/2532-16-0x0000000000DA0000-0x0000000000DA8000-memory.dmp

Filesize
32KB

Download
memory/2532-15-0x0000000000D10000-0x0000000000D1A000-memory.dmp

Filesize
40KB

Download
memory/2532-13-0x0000000000CF0000-0x0000000000CFA000-memory.dmp

Filesize
40KB

Download
memory/2532-24-0x000007FEF5DA0000-0x000007FEF678C000-memory.dmp

Filesize
9.9MB

Download
memory/2532-12-0x0000000000CE0000-0x0000000000CE8000-memory.dmp

Filesize
32KB

Download
memory/2532-145-0x000007FEF5DA0000-0x000007FEF678C000-memory.dmp

Filesize
9.9MB

Download
memory/2532-11-0x0000000000CD0000-0x0000000000CE0000-memory.dmp

Filesize
64KB

Download
memory/2532-8-0x00000000002E0000-0x00000000002E8000-memory.dmp

Filesize
32KB

Download
memory/2532-9-0x0000000000CB0000-0x0000000000CBC000-memory.dmp

Filesize
48KB

Download
memory/2532-10-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

Filesize
64KB

Download
memory/2532-7-0x0000000000570000-0x000000000057C000-memory.dmp

Filesize
48KB

Download
memory/2532-6-0x0000000000300000-0x000000000030A000-memory.dmp

Filesize
40KB

Download
memory/2532-21-0x0000000000EE0000-0x0000000000EE8000-memory.dmp

Filesize
32KB

Download
memory/2532-5-0x00000000002F0000-0x00000000002FC000-memory.dmp

Filesize
48KB

Download
memory/2532-4-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/2532-3-0x00000000002B0000-0x00000000002B8000-memory.dmp

Filesize
32KB

Download
memory/2532-2-0x000007FEF5DA0000-0x000007FEF678C000-memory.dmp

Filesize
9.9MB

Download
memory/2632-157-0x00000000013A0000-0x00000000014B4000-memory.dmp

Filesize
1.1MB

Download