dcrat | e9e6a5e4d64f01b158801bbaead6aedfeeb8cd754e734d1471f591ca3e2c08f8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9a7a84e51c67d1a641349c9195c4f74.exe
Size 1.1MB
Sample250322-g17rssy1ev
SHA256 98be7f502a04b1116647aec47e8e1061d2c26404d6e7855423371fe01d8f5ef9
MD5 d9a7a84e51c67d1a641349c9195c4f74
SHA1 ab7430806db422ec6dc6bf7c378d70f36125c33f
SHA512 fd9a242d657e746ddd07474fefe772afb1b4060db34bb030d1ce8abd7c4ff1af235b209606ea8f43aaf87ae30e1cbfd5b23986344b23a6a50bf13b35deb97ee7
SSDEEP 12288:Kmc4TfAkdN7TPPl2Eh8Nv6L1FMCubuoGTeh46qTnnCPQeB89hNuD1hOp1i3l10gR:Kh4TbLUEhZL/GspeYhkc9Soh2SfwJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat defense_evasion execution infostealer persistence rat trojan

Malware Config

Signatures

DcRat 16 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		4536	schtasks.exe
		2708	schtasks.exe
		4568	schtasks.exe
		4820	schtasks.exe
		4556	schtasks.exe
		4608	schtasks.exe
		4496	schtasks.exe
		3360	schtasks.exe
		1020	schtasks.exe
		2136	schtasks.exe
File created	C:\Program Files\edge_BITS_4604_1909617439\69ddcba757bf72		d9a7a84e51c67d1a641349c9195c4f74.exe
		4628	schtasks.exe
		3892	schtasks.exe
		4548	schtasks.exe
		2068	schtasks.exe
		5308	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 15 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\edge_BITS_4604_1909617439\\smss.exe\", \"C:\\Windows\\System32\\Microsoft.Uev.Common\\dllhost.exe\", \"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\RuntimeBroker.exe\", \"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0\\OfficeClickToRun.exe\", \"C:\\Windows\\uk-UA\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\dllhost.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\edge_BITS_4604_1909617439\\smss.exe\", \"C:\\Windows\\System32\\Microsoft.Uev.Common\\dllhost.exe\", \"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\RuntimeBroker.exe\", \"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0\\OfficeClickToRun.exe\", \"C:\\Windows\\uk-UA\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\dllhost.exe\", \"C:\\Documents and Settings\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\SettingsHandlers_BrowserDeclutter\\winlogon.exe\", \"C:\\Windows\\System32\\perfd007\\RuntimeBroker.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\edge_BITS_4604_1909617439\\smss.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\edge_BITS_4604_1909617439\\smss.exe\", \"C:\\Windows\\System32\\Microsoft.Uev.Common\\dllhost.exe\", \"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\RuntimeBroker.exe\", \"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0\\OfficeClickToRun.exe\", \"C:\\Windows\\uk-UA\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\dllhost.exe\", \"C:\\Documents and Settings\\winlogon.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\edge_BITS_4604_1909617439\\smss.exe\", \"C:\\Windows\\System32\\Microsoft.Uev.Common\\dllhost.exe\", \"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\RuntimeBroker.exe\", \"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0\\OfficeClickToRun.exe\", \"C:\\Windows\\uk-UA\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\dllhost.exe\", \"C:\\Documents and Settings\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\SettingsHandlers_BrowserDeclutter\\winlogon.exe\", \"C:\\Windows\\System32\\perfd007\\RuntimeBroker.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\conhost.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\edge_BITS_4604_1909617439\\smss.exe\", \"C:\\Windows\\System32\\Microsoft.Uev.Common\\dllhost.exe\", \"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\RuntimeBroker.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\edge_BITS_4604_1909617439\\smss.exe\", \"C:\\Windows\\System32\\Microsoft.Uev.Common\\dllhost.exe\", \"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\RuntimeBroker.exe\", \"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0\\OfficeClickToRun.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\edge_BITS_4604_1909617439\\smss.exe\", \"C:\\Windows\\System32\\Microsoft.Uev.Common\\dllhost.exe\", \"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\RuntimeBroker.exe\", \"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0\\OfficeClickToRun.exe\", \"C:\\Windows\\uk-UA\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\dllhost.exe\", \"C:\\Documents and Settings\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\edge_BITS_4604_1909617439\\smss.exe\", \"C:\\Windows\\System32\\Microsoft.Uev.Common\\dllhost.exe\", \"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\RuntimeBroker.exe\", \"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0\\OfficeClickToRun.exe\", \"C:\\Windows\\uk-UA\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\dllhost.exe\", \"C:\\Documents and Settings\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\SettingsHandlers_BrowserDeclutter\\winlogon.exe\", \"C:\\Windows\\System32\\perfd007\\RuntimeBroker.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\conhost.exe\", \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format\\powershell.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\edge_BITS_4604_1909617439\\smss.exe\", \"C:\\Windows\\System32\\Microsoft.Uev.Common\\dllhost.exe\", \"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\RuntimeBroker.exe\", \"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0\\OfficeClickToRun.exe\", \"C:\\Windows\\uk-UA\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\dllhost.exe\", \"C:\\Documents and Settings\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\SettingsHandlers_BrowserDeclutter\\winlogon.exe\", \"C:\\Windows\\System32\\perfd007\\RuntimeBroker.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\conhost.exe\", \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format\\powershell.exe\", \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell\\powershell.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\amd64\\csrss.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\edge_BITS_4604_1909617439\\smss.exe\", \"C:\\Windows\\System32\\Microsoft.Uev.Common\\dllhost.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\edge_BITS_4604_1909617439\\smss.exe\", \"C:\\Windows\\System32\\Microsoft.Uev.Common\\dllhost.exe\", \"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\RuntimeBroker.exe\", \"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\edge_BITS_4604_1909617439\\smss.exe\", \"C:\\Windows\\System32\\Microsoft.Uev.Common\\dllhost.exe\", \"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\RuntimeBroker.exe\", \"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0\\OfficeClickToRun.exe\", \"C:\\Windows\\uk-UA\\dllhost.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\edge_BITS_4604_1909617439\\smss.exe\", \"C:\\Windows\\System32\\Microsoft.Uev.Common\\dllhost.exe\", \"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\RuntimeBroker.exe\", \"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0\\OfficeClickToRun.exe\", \"C:\\Windows\\uk-UA\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\dllhost.exe\", \"C:\\Documents and Settings\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\SettingsHandlers_BrowserDeclutter\\winlogon.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\edge_BITS_4604_1909617439\\smss.exe\", \"C:\\Windows\\System32\\Microsoft.Uev.Common\\dllhost.exe\", \"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\RuntimeBroker.exe\", \"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0\\OfficeClickToRun.exe\", \"C:\\Windows\\uk-UA\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\dllhost.exe\", \"C:\\Documents and Settings\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\SettingsHandlers_BrowserDeclutter\\winlogon.exe\", \"C:\\Windows\\System32\\perfd007\\RuntimeBroker.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\conhost.exe\", \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format\\powershell.exe\", \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell\\powershell.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	3620	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	3620	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	3620	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	3620	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	3620	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4548	3620	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	3620	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3892	3620	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	3620	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	3620	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	3620	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3360	3620	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	3620	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1020	3620	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5308	3620	schtasks.exe	89

UAC bypass 3 TTPs 54 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4140	powershell.exe
6024	powershell.exe
2692	powershell.exe
1124	powershell.exe
408	powershell.exe
5576	powershell.exe
4204	powershell.exe
2532	powershell.exe
5936	powershell.exe
5060	powershell.exe
1432	powershell.exe
2628	powershell.exe
5740	powershell.exe
5860	powershell.exe
4208	powershell.exe
6032	powershell.exe
1640	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	d9a7a84e51c67d1a641349c9195c4f74.exe

Checks computer location settings 2 TTPs 18 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	d9a7a84e51c67d1a641349c9195c4f74.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	d9a7a84e51c67d1a641349c9195c4f74.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	conhost.exe

Executes dropped EXE 17 IoCs

pid	Process
4612	d9a7a84e51c67d1a641349c9195c4f74.exe
1276	conhost.exe
5488	conhost.exe
6104	conhost.exe
5624	conhost.exe
32	conhost.exe
5664	conhost.exe
1276	conhost.exe
5372	conhost.exe
1144	conhost.exe
2576	conhost.exe
1464	conhost.exe
5704	conhost.exe
4552	conhost.exe
4960	conhost.exe
1916	conhost.exe
5976	conhost.exe

Adds Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\All Users\\SoftwareDistribution\\dllhost.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\perfd007\\RuntimeBroker.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\Microsoft.Uev.Common\\dllhost.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\Microsoft.Uev.Common\\dllhost.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\RuntimeBroker.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0\\OfficeClickToRun.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\SettingsHandlers_BrowserDeclutter\\winlogon.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\SettingsHandlers_BrowserDeclutter\\winlogon.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Documents and Settings\\winlogon.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\perfd007\\RuntimeBroker.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\conhost.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell\\powershell.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Java\\jre-1.8\\lib\\amd64\\csrss.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Java\\jre-1.8\\lib\\amd64\\csrss.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\edge_BITS_4604_1909617439\\smss.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell\\powershell.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\RuntimeBroker.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\All Users\\SoftwareDistribution\\dllhost.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\conhost.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\edge_BITS_4604_1909617439\\smss.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\uk-UA\\dllhost.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Documents and Settings\\winlogon.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format\\powershell.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format\\powershell.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0\\OfficeClickToRun.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\uk-UA\\dllhost.exe\""	d9a7a84e51c67d1a641349c9195c4f74.exe

Checks whether UAC is enabled 1 TTPs 36 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9a7a84e51c67d1a641349c9195c4f74.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d9a7a84e51c67d1a641349c9195c4f74.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\System32\SettingsHandlers_BrowserDeclutter\cc11b995f2a76d	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Windows\System32\perfd007\9e8d7a4ca61bd9	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\RuntimeBroker.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Windows\System32\perfd007\RuntimeBroker.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format\powershell.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Windows\System32\Microsoft.Uev.Common\dllhost.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Windows\System32\SettingsHandlers_BrowserDeclutter\winlogon.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format\powershell.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\powershell\powershell.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\powershell\e978f868350d50	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Windows\System32\Microsoft.Uev.Common\5940a34987c991	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Windows\System32\Microsoft.Uev.Common\RCX6E1D.tmp	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\RCX7022.tmp	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\powershell\powershell.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Windows\System32\Microsoft.Uev.Common\dllhost.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\9e8d7a4ca61bd9	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Windows\System32\perfd007\RuntimeBroker.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Windows\System32\SettingsHandlers_BrowserDeclutter\RCX7F6B.tmp	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Windows\System32\perfd007\RCX824B.tmp	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format\e978f868350d50	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\RuntimeBroker.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Windows\System32\SettingsHandlers_BrowserDeclutter\winlogon.exe	d9a7a84e51c67d1a641349c9195c4f74.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0\RCX743B.tmp	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0\OfficeClickToRun.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCX7CCA.tmp	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\9e8d7a4ca61bd9	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Program Files\edge_BITS_4604_1909617439\RCX6B9C.tmp	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\csrss.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Program Files\edge_BITS_4604_1909617439\smss.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Program Files\edge_BITS_4604_1909617439\smss.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\088424020bedd6	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\886983d96e3d3e	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\amd64\csrss.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Program Files\edge_BITS_4604_1909617439\69ddcba757bf72	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0\OfficeClickToRun.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0\e6c9b481da804f	d9a7a84e51c67d1a641349c9195c4f74.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\uk-UA\dllhost.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\TextInputHost.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\22eafd247d37c3	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Windows\uk-UA\dllhost.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File created	C:\Windows\uk-UA\5940a34987c991	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\RCX7227.tmp	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\TextInputHost.exe	d9a7a84e51c67d1a641349c9195c4f74.exe
File opened for modification	C:\Windows\uk-UA\RCX763F.tmp	d9a7a84e51c67d1a641349c9195c4f74.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	d9a7a84e51c67d1a641349c9195c4f74.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	d9a7a84e51c67d1a641349c9195c4f74.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	conhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2136	schtasks.exe
4556	schtasks.exe
4568	schtasks.exe
5308	schtasks.exe
2708	schtasks.exe
4548	schtasks.exe
3892	schtasks.exe
1020	schtasks.exe
4820	schtasks.exe
4496	schtasks.exe
4536	schtasks.exe
4608	schtasks.exe
4628	schtasks.exe
3360	schtasks.exe
2068	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
5740	powershell.exe
5740	powershell.exe
6032	powershell.exe
5936	powershell.exe
5936	powershell.exe
6032	powershell.exe
5860	powershell.exe
5860	powershell.exe
4140	powershell.exe
4140	powershell.exe
5576	powershell.exe
5576	powershell.exe
4204	powershell.exe
4204	powershell.exe
6024	powershell.exe
6024	powershell.exe
4208	powershell.exe
4208	powershell.exe
2692	powershell.exe
2692	powershell.exe
2532	powershell.exe
2532	powershell.exe
2532	powershell.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
5060	powershell.exe
5060	powershell.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
5060	powershell.exe
3156	d9a7a84e51c67d1a641349c9195c4f74.exe
2692	powershell.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	3156	d9a7a84e51c67d1a641349c9195c4f74.exe
Token: SeDebugPrivilege	5740	powershell.exe
Token: SeDebugPrivilege	5936	powershell.exe
Token: SeDebugPrivilege	6032	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeDebugPrivilege	5860	powershell.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeDebugPrivilege	5576	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	6024	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	4208	powershell.exe
Token: SeDebugPrivilege	4612	d9a7a84e51c67d1a641349c9195c4f74.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	1276	conhost.exe
Token: SeDebugPrivilege	5488	conhost.exe
Token: SeDebugPrivilege	6104	conhost.exe
Token: SeDebugPrivilege	5624	conhost.exe
Token: SeDebugPrivilege	32	conhost.exe
Token: SeDebugPrivilege	5664	conhost.exe
Token: SeDebugPrivilege	1276	conhost.exe
Token: SeDebugPrivilege	5372	conhost.exe
Token: SeDebugPrivilege	1144	conhost.exe
Token: SeDebugPrivilege	2576	conhost.exe
Token: SeDebugPrivilege	1464	conhost.exe
Token: SeDebugPrivilege	5704	conhost.exe
Token: SeDebugPrivilege	4552	conhost.exe
Token: SeDebugPrivilege	4960	conhost.exe
Token: SeDebugPrivilege	1916	conhost.exe
Token: SeDebugPrivilege	5976	conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 5576	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	105
PID 3156 wrote to memory of 5576	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	105
PID 3156 wrote to memory of 5740	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	106
PID 3156 wrote to memory of 5740	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	106
PID 3156 wrote to memory of 5936	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	107
PID 3156 wrote to memory of 5936	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	107
PID 3156 wrote to memory of 4140	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	108
PID 3156 wrote to memory of 4140	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	108
PID 3156 wrote to memory of 5860	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	109
PID 3156 wrote to memory of 5860	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	109
PID 3156 wrote to memory of 6032	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	110
PID 3156 wrote to memory of 6032	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	110
PID 3156 wrote to memory of 4208	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	111
PID 3156 wrote to memory of 4208	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	111
PID 3156 wrote to memory of 2532	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	112
PID 3156 wrote to memory of 2532	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	112
PID 3156 wrote to memory of 4204	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	113
PID 3156 wrote to memory of 4204	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	113
PID 3156 wrote to memory of 5060	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	114
PID 3156 wrote to memory of 5060	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	114
PID 3156 wrote to memory of 2692	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	115
PID 3156 wrote to memory of 2692	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	115
PID 3156 wrote to memory of 6024	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	117
PID 3156 wrote to memory of 6024	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	117
PID 3156 wrote to memory of 4612	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	129
PID 3156 wrote to memory of 4612	3156	d9a7a84e51c67d1a641349c9195c4f74.exe	129
PID 4612 wrote to memory of 1124	4612	d9a7a84e51c67d1a641349c9195c4f74.exe	135
PID 4612 wrote to memory of 1124	4612	d9a7a84e51c67d1a641349c9195c4f74.exe	135
PID 4612 wrote to memory of 1640	4612	d9a7a84e51c67d1a641349c9195c4f74.exe	136
PID 4612 wrote to memory of 1640	4612	d9a7a84e51c67d1a641349c9195c4f74.exe	136
PID 4612 wrote to memory of 1432	4612	d9a7a84e51c67d1a641349c9195c4f74.exe	137
PID 4612 wrote to memory of 1432	4612	d9a7a84e51c67d1a641349c9195c4f74.exe	137
PID 4612 wrote to memory of 2628	4612	d9a7a84e51c67d1a641349c9195c4f74.exe	138
PID 4612 wrote to memory of 2628	4612	d9a7a84e51c67d1a641349c9195c4f74.exe	138
PID 4612 wrote to memory of 408	4612	d9a7a84e51c67d1a641349c9195c4f74.exe	139
PID 4612 wrote to memory of 408	4612	d9a7a84e51c67d1a641349c9195c4f74.exe	139
PID 4612 wrote to memory of 1276	4612	d9a7a84e51c67d1a641349c9195c4f74.exe	145
PID 4612 wrote to memory of 1276	4612	d9a7a84e51c67d1a641349c9195c4f74.exe	145
PID 1276 wrote to memory of 3804	1276	conhost.exe	147
PID 1276 wrote to memory of 3804	1276	conhost.exe	147
PID 1276 wrote to memory of 2788	1276	conhost.exe	148
PID 1276 wrote to memory of 2788	1276	conhost.exe	148
PID 3804 wrote to memory of 5488	3804	WScript.exe	149
PID 3804 wrote to memory of 5488	3804	WScript.exe	149
PID 5488 wrote to memory of 4916	5488	conhost.exe	150
PID 5488 wrote to memory of 4916	5488	conhost.exe	150
PID 5488 wrote to memory of 1344	5488	conhost.exe	151
PID 5488 wrote to memory of 1344	5488	conhost.exe	151
PID 4916 wrote to memory of 6104	4916	WScript.exe	157
PID 4916 wrote to memory of 6104	4916	WScript.exe	157
PID 6104 wrote to memory of 3856	6104	conhost.exe	158
PID 6104 wrote to memory of 3856	6104	conhost.exe	158
PID 6104 wrote to memory of 6036	6104	conhost.exe	159
PID 6104 wrote to memory of 6036	6104	conhost.exe	159
PID 3856 wrote to memory of 5624	3856	WScript.exe	163
PID 3856 wrote to memory of 5624	3856	WScript.exe	163
PID 5624 wrote to memory of 2628	5624	conhost.exe	164
PID 5624 wrote to memory of 2628	5624	conhost.exe	164
PID 5624 wrote to memory of 4548	5624	conhost.exe	165
PID 5624 wrote to memory of 4548	5624	conhost.exe	165
PID 2628 wrote to memory of 32	2628	WScript.exe	166
PID 2628 wrote to memory of 32	2628	WScript.exe	166
PID 32 wrote to memory of 1048	32	conhost.exe	167
PID 32 wrote to memory of 1048	32	conhost.exe	167

System policy modification 1 TTPs 54 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d9a7a84e51c67d1a641349c9195c4f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d9a7a84e51c67d1a641349c9195c4f74.exe
"C:\Users\Admin\AppData\Local\Temp\d9a7a84e51c67d1a641349c9195c4f74.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d9a7a84e51c67d1a641349c9195c4f74.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\edge_BITS_4604_1909617439\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Microsoft.Uev.Common\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\TextInputHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0\OfficeClickToRun.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\uk-UA\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\SoftwareDistribution\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Documents and Settings\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\SettingsHandlers_BrowserDeclutter\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\perfd007\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6024
- C:\Users\Admin\AppData\Local\Temp\d9a7a84e51c67d1a641349c9195c4f74.exe
  "C:\Users\Admin\AppData\Local\Temp\d9a7a84e51c67d1a641349c9195c4f74.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d9a7a84e51c67d1a641349c9195c4f74.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format\powershell.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell\powershell.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre-1.8\lib\amd64\csrss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:408
- - C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe
    "C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1276
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\90c178ce-219b-4c7d-831d-67a951fa0b51.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3804
    - - C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:5488
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d341226c-ea9a-40c5-a0e6-6813caca5f63.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:6104
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c813f861-3528-49f0-8fbe-2ba24ba95b59.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:5624
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1688e8ed-f90a-451a-9bcb-977d14cc6b97.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:32
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a43a47f4-c4c1-48af-9a23-1928e5198aec.vbs"
        12⤵
        
        PID:1048
        
        C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5664
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\03b7f0b4-f2a8-4b79-abc4-92abb964cc76.vbs"
        14⤵
        
        PID:1912
        
        C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1276
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32275cf7-8686-49a9-aa91-f47cde827761.vbs"
        16⤵
        
        PID:4580
        
        C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5372
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\59192001-e23f-4721-8f58-3d46d0b01581.vbs"
        18⤵
        
        PID:5768
        
        C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1144
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d1f7b37e-d05e-4522-82da-90678eb014af.vbs"
        20⤵
        
        PID:1156
        
        C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2576
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0ee48ffa-31ce-488e-b6e6-4551f9179529.vbs"
        22⤵
        
        PID:3728
        
        C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89a03d46-7f04-4e77-a5ad-3170ffa79f42.vbs"
        24⤵
        
        PID:3104
        
        C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"
        25⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5704
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\81a7e1a3-d308-459c-b37c-8ff54dcd851d.vbs"
        26⤵
        
        PID:4956
        
        C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"
        27⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78c18653-390f-4d97-a955-4ea122f35e4b.vbs"
        28⤵
        
        PID:4104
        
        C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"
        29⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6aea0d47-30ff-44ff-be71-9d39e6caa393.vbs"
        30⤵
        
        PID:5676
        
        C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"
        31⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1916
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d28e62ef-d558-4da6-ba01-72b7de1bfeac.vbs"
        32⤵
        
        PID:4340
        
        C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"
        33⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5976
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d541837-629c-47ed-a3c8-982bd4b55b88.vbs"
        34⤵
        
        PID:5820
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aa9450c3-7840-4873-85b5-fd019bccf6a8.vbs"
        34⤵
        
        PID:2700
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d7e195b9-385d-43f3-a36f-89490d80be31.vbs"
        32⤵
        
        PID:648
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e3a552e-82ca-453c-81e7-d4bbe41ecdae.vbs"
        30⤵
        
        PID:6052
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8f48b4e1-a6e8-4c75-8531-ae75944893e5.vbs"
        28⤵
        
        PID:4856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\379cd3f3-02a6-4dc9-a25e-129ed8e8a113.vbs"
        26⤵
        
        PID:5780
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d249db5-88ea-49de-a61e-d5a4374355a3.vbs"
        24⤵
        
        PID:4624
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3fd1b5b7-3e5e-4b8e-8c96-126839e53cdf.vbs"
        22⤵
        
        PID:3608
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5bdabb29-3e65-4335-9a14-33e7eca50b4b.vbs"
        20⤵
        
        PID:2008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0218bdcb-17ae-42d6-be69-ef084ed787f8.vbs"
        18⤵
        
        PID:4972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d032fb8-470b-433f-b3d0-8bc018931e5c.vbs"
        16⤵
        
        PID:4452
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fbbe866a-885b-4634-8897-aad82033951f.vbs"
        14⤵
        
        PID:3768
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c10d6391-90fd-4507-9f01-7ed81e04176b.vbs"
        12⤵
        
        PID:2344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d22c7e10-7963-4e02-b417-76e7575198d7.vbs"
        10⤵
        
        PID:4548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e34c1586-e973-4c16-a87f-48588dbc7617.vbs"
        8⤵
        
        PID:6036
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3ba111d-adaf-4fa0-bdf9-140908daa481.vbs"
        6⤵
        
        PID:1344
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f456f34c-c652-44f1-8777-7405366d43b2.vbs"
      4⤵
      PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4604_1909617439\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\Microsoft.Uev.Common\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\uk-UA\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Documents and Settings\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\SettingsHandlers_BrowserDeclutter\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\perfd007\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Windows\System32\WindowsPowerShell\v1.0\powershell\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\lib\amd64\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe
Size 1.1MB
SHA256 53f9606244d24ee354af5f66a8fd964db3858b17d9ed0a50159f3b9f982f2321
MD5 e883672df257d854bfbf0a1f8ad51579
SHA1 e49ebb325bec9fe2e723effec58f11023a66b460
SHA512 4ca156e974cbe1acb5df759d7f533c0c685e7bac7fbca2b90f112dda18a99f65c5678bf37f83b021a255f21a7ea79f07b138dcba07945828980c89ceaa90fb18
SSDEEP 12288:qmc4TfAkdN7TPPl2Eh8Nv6L1FMCubuoGTeh46qTnnCPQeB89hNuD1hOp1i3l10gR:qh4TbLUEhZL/GspeYhkc9Soh2SfwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0\OfficeClickToRun.exe
Size 1.1MB
SHA256 98be7f502a04b1116647aec47e8e1061d2c26404d6e7855423371fe01d8f5ef9
MD5 d9a7a84e51c67d1a641349c9195c4f74
SHA1 ab7430806db422ec6dc6bf7c378d70f36125c33f
SHA512 fd9a242d657e746ddd07474fefe772afb1b4060db34bb030d1ce8abd7c4ff1af235b209606ea8f43aaf87ae30e1cbfd5b23986344b23a6a50bf13b35deb97ee7
SSDEEP 12288:Kmc4TfAkdN7TPPl2Eh8Nv6L1FMCubuoGTeh46qTnnCPQeB89hNuD1hOp1i3l10gR:Kh4TbLUEhZL/GspeYhkc9Soh2SfwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

d9a7a84e51c67d1a641349c9195c4f74.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\d9a7a84e51c67d1a641349c9195c4f74.exe.log
Size 1KB
SHA256 519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
MD5 7f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1 d58622bf6b5071beacf3b35bb505bde2000983e3
SHA512 8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download