dcrat | 249f9bd035685660ae45fc4138334e744c30ce7e1038c140a98529b90c4270c5

Analysis

max time kernel
103s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

defcdae3dc9e03410d78ef0ab357f764.exe
Size

1.9MB
MD5

defcdae3dc9e03410d78ef0ab357f764
SHA1

d9e1223e947b96d32607b66ec3bdb41608ae58cd
SHA256

479e4d08f33e904dadbf2af464d24e42eec66a2301a85fc2ef3552cf037c0bd5
SHA512

7d958b544df58fd1444b06c48ccdf79eadddbffbe729a7fd696b5dfd025b08fa7ddfa22a19f3bf1d79836587832d5c3b4a8d1959c83798b0a3239f9b1021443f
SSDEEP

24576:5cIqg3pZ9Lbp1x5mMnbJ4ANfUAlkDd/2uUpET57RLGKETv/cyUM6MniOlsxvZBSg:XrhDbJ4dAlkpuuUpY57cKEr0a7iOyKc

Score

10^/10

dcrat execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\", \"C:\\60739cf6f660743813\\csrss.exe\", \"C:\\Windows\\Performance\\Idle.exe\", \"C:\\60739cf6f660743813\\unsecapp.exe\", \"C:\\60739cf6f660743813\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\csrss.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Idle.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\", \"C:\\60739cf6f660743813\\csrss.exe\", \"C:\\Windows\\Performance\\Idle.exe\", \"C:\\60739cf6f660743813\\unsecapp.exe\", \"C:\\60739cf6f660743813\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\csrss.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Idle.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\features\\fontdrvhost.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\", \"C:\\60739cf6f660743813\\csrss.exe\", \"C:\\Windows\\Performance\\Idle.exe\", \"C:\\60739cf6f660743813\\unsecapp.exe\", \"C:\\60739cf6f660743813\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\csrss.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Idle.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\features\\fontdrvhost.exe\", \"C:\\900323d723f1dd1206\\RuntimeBroker.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\", \"C:\\60739cf6f660743813\\csrss.exe\", \"C:\\Windows\\Performance\\Idle.exe\", \"C:\\60739cf6f660743813\\unsecapp.exe\", \"C:\\60739cf6f660743813\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\csrss.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Idle.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\features\\fontdrvhost.exe\", \"C:\\900323d723f1dd1206\\RuntimeBroker.exe\", \"C:\\60739cf6f660743813\\sysmon.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\sppsvc.exe\", \"C:\\60739cf6f660743813\\SearchApp.exe\", \"C:\\Windows\\twain_32\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\", \"C:\\60739cf6f660743813\\csrss.exe\", \"C:\\Windows\\Performance\\Idle.exe\", \"C:\\60739cf6f660743813\\unsecapp.exe\", \"C:\\60739cf6f660743813\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\csrss.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Idle.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\features\\fontdrvhost.exe\", \"C:\\900323d723f1dd1206\\RuntimeBroker.exe\", \"C:\\60739cf6f660743813\\sysmon.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\sppsvc.exe\", \"C:\\60739cf6f660743813\\SearchApp.exe\", \"C:\\Windows\\twain_32\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\60739cf6f660743813\\fontdrvhost.exe\", \"C:\\60739cf6f660743813\\upfc.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\", \"C:\\60739cf6f660743813\\csrss.exe\", \"C:\\Windows\\Performance\\Idle.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\", \"C:\\60739cf6f660743813\\csrss.exe\", \"C:\\Windows\\Performance\\Idle.exe\", \"C:\\60739cf6f660743813\\unsecapp.exe\", \"C:\\60739cf6f660743813\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\csrss.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Idle.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\features\\fontdrvhost.exe\", \"C:\\900323d723f1dd1206\\RuntimeBroker.exe\", \"C:\\60739cf6f660743813\\sysmon.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\", \"C:\\60739cf6f660743813\\csrss.exe\", \"C:\\Windows\\Performance\\Idle.exe\", \"C:\\60739cf6f660743813\\unsecapp.exe\", \"C:\\60739cf6f660743813\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\csrss.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Idle.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\features\\fontdrvhost.exe\", \"C:\\900323d723f1dd1206\\RuntimeBroker.exe\", \"C:\\60739cf6f660743813\\sysmon.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\sppsvc.exe\", \"C:\\60739cf6f660743813\\SearchApp.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\", \"C:\\60739cf6f660743813\\csrss.exe\", \"C:\\Windows\\Performance\\Idle.exe\", \"C:\\60739cf6f660743813\\unsecapp.exe\", \"C:\\60739cf6f660743813\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\csrss.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Idle.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\features\\fontdrvhost.exe\", \"C:\\900323d723f1dd1206\\RuntimeBroker.exe\", \"C:\\60739cf6f660743813\\sysmon.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\sppsvc.exe\", \"C:\\60739cf6f660743813\\SearchApp.exe\", \"C:\\Windows\\twain_32\\wininit.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\", \"C:\\60739cf6f660743813\\csrss.exe\", \"C:\\Windows\\Performance\\Idle.exe\", \"C:\\60739cf6f660743813\\unsecapp.exe\", \"C:\\60739cf6f660743813\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\csrss.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Idle.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\features\\fontdrvhost.exe\", \"C:\\900323d723f1dd1206\\RuntimeBroker.exe\", \"C:\\60739cf6f660743813\\sysmon.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\sppsvc.exe\", \"C:\\60739cf6f660743813\\SearchApp.exe\", \"C:\\Windows\\twain_32\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\60739cf6f660743813\\fontdrvhost.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\", \"C:\\60739cf6f660743813\\csrss.exe\", \"C:\\Windows\\Performance\\Idle.exe\", \"C:\\60739cf6f660743813\\unsecapp.exe\", \"C:\\60739cf6f660743813\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\csrss.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Idle.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\features\\fontdrvhost.exe\", \"C:\\900323d723f1dd1206\\RuntimeBroker.exe\", \"C:\\60739cf6f660743813\\sysmon.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\sppsvc.exe\", \"C:\\60739cf6f660743813\\SearchApp.exe\", \"C:\\Windows\\twain_32\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\60739cf6f660743813\\fontdrvhost.exe\", \"C:\\60739cf6f660743813\\upfc.exe\", \"C:\\900323d723f1dd1206\\dllhost.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\", \"C:\\60739cf6f660743813\\csrss.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\", \"C:\\60739cf6f660743813\\csrss.exe\", \"C:\\Windows\\Performance\\Idle.exe\", \"C:\\60739cf6f660743813\\unsecapp.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\", \"C:\\60739cf6f660743813\\csrss.exe\", \"C:\\Windows\\Performance\\Idle.exe\", \"C:\\60739cf6f660743813\\unsecapp.exe\", \"C:\\60739cf6f660743813\\spoolsv.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\", \"C:\\60739cf6f660743813\\csrss.exe\", \"C:\\Windows\\Performance\\Idle.exe\", \"C:\\60739cf6f660743813\\unsecapp.exe\", \"C:\\60739cf6f660743813\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\fontdrvhost.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\", \"C:\\60739cf6f660743813\\csrss.exe\", \"C:\\Windows\\Performance\\Idle.exe\", \"C:\\60739cf6f660743813\\unsecapp.exe\", \"C:\\60739cf6f660743813\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\csrss.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\", \"C:\\60739cf6f660743813\\csrss.exe\", \"C:\\Windows\\Performance\\Idle.exe\", \"C:\\60739cf6f660743813\\unsecapp.exe\", \"C:\\60739cf6f660743813\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\csrss.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Idle.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\features\\fontdrvhost.exe\", \"C:\\900323d723f1dd1206\\RuntimeBroker.exe\", \"C:\\60739cf6f660743813\\sysmon.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\sppsvc.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5728	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5500	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3604	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3540	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5824	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5240	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3856	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5184	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5660	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6024	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3100	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5716	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5852	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5732	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5520	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4640	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	2684	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	2684	schtasks.exe	86

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral22/memory/2004-1-0x0000000000CF0000-0x0000000000EEA000-memory.dmp	dcrat
behavioral22/files/0x0007000000024237-33.dat	dcrat
behavioral22/files/0x000700000002426c-135.dat	dcrat
behavioral22/files/0x000800000002426d-176.dat	dcrat
behavioral22/files/0x000700000002426e-181.dat	dcrat
behavioral22/memory/5124-407-0x0000000000960000-0x0000000000B5A000-memory.dmp	dcrat
behavioral22/files/0x000b000000024246-406.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3708	powershell.exe
3032	powershell.exe
2484	powershell.exe
1588	powershell.exe
1924	powershell.exe
3076	powershell.exe
1504	powershell.exe
396	powershell.exe
5320	powershell.exe
6032	powershell.exe
2876	powershell.exe
5172	powershell.exe
5644	powershell.exe
2612	powershell.exe
2208	powershell.exe
5368	powershell.exe
5724	powershell.exe
4012	powershell.exe
4056	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	defcdae3dc9e03410d78ef0ab357f764.exe

Executes dropped EXE 1 IoCs

pid	Process
5124	smss.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\60739cf6f660743813\\SearchApp.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\twain_32\\wininit.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\60739cf6f660743813\\fontdrvhost.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\60739cf6f660743813\\SearchApp.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\twain_32\\wininit.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\60739cf6f660743813\\unsecapp.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\60739cf6f660743813\\spoolsv.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\csrss.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Mozilla Firefox\\browser\\features\\fontdrvhost.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\60739cf6f660743813\\upfc.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\60739cf6f660743813\\csrss.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\60739cf6f660743813\\spoolsv.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\MSBuild\\Microsoft\\Idle.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\MSBuild\\Microsoft\\Idle.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\60739cf6f660743813\\sysmon.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\60739cf6f660743813\\upfc.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\900323d723f1dd1206\\dllhost.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\60739cf6f660743813\\unsecapp.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Mozilla Firefox\\browser\\features\\fontdrvhost.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\900323d723f1dd1206\\RuntimeBroker.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\60739cf6f660743813\\sysmon.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Public\\Documents\\My Videos\\sppsvc.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\900323d723f1dd1206\\dllhost.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\fontdrvhost.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Public\\Documents\\My Videos\\sppsvc.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\60739cf6f660743813\\fontdrvhost.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\Performance\\Idle.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\Performance\\Idle.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\fontdrvhost.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\csrss.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files (x86)\\Windows Portable Devices\\unsecapp.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\60739cf6f660743813\\csrss.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\900323d723f1dd1206\\RuntimeBroker.exe\""	defcdae3dc9e03410d78ef0ab357f764.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\29c1c3cc0f7685	defcdae3dc9e03410d78ef0ab357f764.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\5b884080fd4f94	defcdae3dc9e03410d78ef0ab357f764.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX4509.tmp	defcdae3dc9e03410d78ef0ab357f764.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe	defcdae3dc9e03410d78ef0ab357f764.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\RCX5685.tmp	defcdae3dc9e03410d78ef0ab357f764.exe
File created	C:\Program Files (x86)\Windows Portable Devices\unsecapp.exe	defcdae3dc9e03410d78ef0ab357f764.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe	defcdae3dc9e03410d78ef0ab357f764.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\5b884080fd4f94	defcdae3dc9e03410d78ef0ab357f764.exe
File created	C:\Program Files\MSBuild\Microsoft\Idle.exe	defcdae3dc9e03410d78ef0ab357f764.exe
File created	C:\Program Files\MSBuild\Microsoft\6ccacd8608530f	defcdae3dc9e03410d78ef0ab357f764.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\fontdrvhost.exe	defcdae3dc9e03410d78ef0ab357f764.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\csrss.exe	defcdae3dc9e03410d78ef0ab357f764.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Idle.exe	defcdae3dc9e03410d78ef0ab357f764.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\csrss.exe	defcdae3dc9e03410d78ef0ab357f764.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\886983d96e3d3e	defcdae3dc9e03410d78ef0ab357f764.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\RCX4FFB.tmp	defcdae3dc9e03410d78ef0ab357f764.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\RCX5404.tmp	defcdae3dc9e03410d78ef0ab357f764.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\fontdrvhost.exe	defcdae3dc9e03410d78ef0ab357f764.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\unsecapp.exe	defcdae3dc9e03410d78ef0ab357f764.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\RCX51FF.tmp	defcdae3dc9e03410d78ef0ab357f764.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Performance\Idle.exe	defcdae3dc9e03410d78ef0ab357f764.exe
File created	C:\Windows\Performance\6ccacd8608530f	defcdae3dc9e03410d78ef0ab357f764.exe
File created	C:\Windows\twain_32\wininit.exe	defcdae3dc9e03410d78ef0ab357f764.exe
File created	C:\Windows\twain_32\56085415360792	defcdae3dc9e03410d78ef0ab357f764.exe
File opened for modification	C:\Windows\Performance\RCX497F.tmp	defcdae3dc9e03410d78ef0ab357f764.exe
File opened for modification	C:\Windows\Performance\Idle.exe	defcdae3dc9e03410d78ef0ab357f764.exe
File opened for modification	C:\Windows\twain_32\RCX6204.tmp	defcdae3dc9e03410d78ef0ab357f764.exe
File opened for modification	C:\Windows\twain_32\wininit.exe	defcdae3dc9e03410d78ef0ab357f764.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	defcdae3dc9e03410d78ef0ab357f764.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4640	schtasks.exe
4556	schtasks.exe
5112	schtasks.exe
5240	schtasks.exe
5184	schtasks.exe
5716	schtasks.exe
2124	schtasks.exe
4884	schtasks.exe
4712	schtasks.exe
1976	schtasks.exe
3700	schtasks.exe
3992	schtasks.exe
5520	schtasks.exe
4628	schtasks.exe
4760	schtasks.exe
4928	schtasks.exe
6024	schtasks.exe
4872	schtasks.exe
1068	schtasks.exe
4472	schtasks.exe
4820	schtasks.exe
1972	schtasks.exe
1820	schtasks.exe
1864	schtasks.exe
5660	schtasks.exe
888	schtasks.exe
4824	schtasks.exe
5852	schtasks.exe
3604	schtasks.exe
3540	schtasks.exe
5824	schtasks.exe
876	schtasks.exe
3856	schtasks.exe
4936	schtasks.exe
4600	schtasks.exe
4560	schtasks.exe
5728	schtasks.exe
4380	schtasks.exe
4704	schtasks.exe
1084	schtasks.exe
4672	schtasks.exe
4544	schtasks.exe
1688	schtasks.exe
3348	schtasks.exe
4340	schtasks.exe
3100	schtasks.exe
4800	schtasks.exe
5732	schtasks.exe
4488	schtasks.exe
5500	schtasks.exe
4296	schtasks.exe
3048	schtasks.exe
3468	schtasks.exe
3940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe
2004	defcdae3dc9e03410d78ef0ab357f764.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	defcdae3dc9e03410d78ef0ab357f764.exe
Token: SeDebugPrivilege	5320	powershell.exe
Token: SeDebugPrivilege	2484	powershell.exe
Token: SeDebugPrivilege	5644	powershell.exe
Token: SeDebugPrivilege	5172	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeDebugPrivilege	3076	powershell.exe
Token: SeDebugPrivilege	5724	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	396	powershell.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	5368	powershell.exe
Token: SeDebugPrivilege	3708	powershell.exe
Token: SeDebugPrivilege	6032	powershell.exe
Token: SeDebugPrivilege	5124	smss.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 5320	2004	defcdae3dc9e03410d78ef0ab357f764.exe	146
PID 2004 wrote to memory of 5320	2004	defcdae3dc9e03410d78ef0ab357f764.exe	146
PID 2004 wrote to memory of 5724	2004	defcdae3dc9e03410d78ef0ab357f764.exe	147
PID 2004 wrote to memory of 5724	2004	defcdae3dc9e03410d78ef0ab357f764.exe	147
PID 2004 wrote to memory of 2208	2004	defcdae3dc9e03410d78ef0ab357f764.exe	148
PID 2004 wrote to memory of 2208	2004	defcdae3dc9e03410d78ef0ab357f764.exe	148
PID 2004 wrote to memory of 3708	2004	defcdae3dc9e03410d78ef0ab357f764.exe	150
PID 2004 wrote to memory of 3708	2004	defcdae3dc9e03410d78ef0ab357f764.exe	150
PID 2004 wrote to memory of 396	2004	defcdae3dc9e03410d78ef0ab357f764.exe	151
PID 2004 wrote to memory of 396	2004	defcdae3dc9e03410d78ef0ab357f764.exe	151
PID 2004 wrote to memory of 4056	2004	defcdae3dc9e03410d78ef0ab357f764.exe	153
PID 2004 wrote to memory of 4056	2004	defcdae3dc9e03410d78ef0ab357f764.exe	153
PID 2004 wrote to memory of 1504	2004	defcdae3dc9e03410d78ef0ab357f764.exe	154
PID 2004 wrote to memory of 1504	2004	defcdae3dc9e03410d78ef0ab357f764.exe	154
PID 2004 wrote to memory of 2612	2004	defcdae3dc9e03410d78ef0ab357f764.exe	155
PID 2004 wrote to memory of 2612	2004	defcdae3dc9e03410d78ef0ab357f764.exe	155
PID 2004 wrote to memory of 5644	2004	defcdae3dc9e03410d78ef0ab357f764.exe	156
PID 2004 wrote to memory of 5644	2004	defcdae3dc9e03410d78ef0ab357f764.exe	156
PID 2004 wrote to memory of 3076	2004	defcdae3dc9e03410d78ef0ab357f764.exe	157
PID 2004 wrote to memory of 3076	2004	defcdae3dc9e03410d78ef0ab357f764.exe	157
PID 2004 wrote to memory of 5172	2004	defcdae3dc9e03410d78ef0ab357f764.exe	159
PID 2004 wrote to memory of 5172	2004	defcdae3dc9e03410d78ef0ab357f764.exe	159
PID 2004 wrote to memory of 4012	2004	defcdae3dc9e03410d78ef0ab357f764.exe	160
PID 2004 wrote to memory of 4012	2004	defcdae3dc9e03410d78ef0ab357f764.exe	160
PID 2004 wrote to memory of 5368	2004	defcdae3dc9e03410d78ef0ab357f764.exe	161
PID 2004 wrote to memory of 5368	2004	defcdae3dc9e03410d78ef0ab357f764.exe	161
PID 2004 wrote to memory of 1924	2004	defcdae3dc9e03410d78ef0ab357f764.exe	162
PID 2004 wrote to memory of 1924	2004	defcdae3dc9e03410d78ef0ab357f764.exe	162
PID 2004 wrote to memory of 1588	2004	defcdae3dc9e03410d78ef0ab357f764.exe	163
PID 2004 wrote to memory of 1588	2004	defcdae3dc9e03410d78ef0ab357f764.exe	163
PID 2004 wrote to memory of 2484	2004	defcdae3dc9e03410d78ef0ab357f764.exe	164
PID 2004 wrote to memory of 2484	2004	defcdae3dc9e03410d78ef0ab357f764.exe	164
PID 2004 wrote to memory of 2876	2004	defcdae3dc9e03410d78ef0ab357f764.exe	165
PID 2004 wrote to memory of 2876	2004	defcdae3dc9e03410d78ef0ab357f764.exe	165
PID 2004 wrote to memory of 3032	2004	defcdae3dc9e03410d78ef0ab357f764.exe	167
PID 2004 wrote to memory of 3032	2004	defcdae3dc9e03410d78ef0ab357f764.exe	167
PID 2004 wrote to memory of 6032	2004	defcdae3dc9e03410d78ef0ab357f764.exe	168
PID 2004 wrote to memory of 6032	2004	defcdae3dc9e03410d78ef0ab357f764.exe	168
PID 2004 wrote to memory of 5076	2004	defcdae3dc9e03410d78ef0ab357f764.exe	184
PID 2004 wrote to memory of 5076	2004	defcdae3dc9e03410d78ef0ab357f764.exe	184
PID 5076 wrote to memory of 5112	5076	cmd.exe	186
PID 5076 wrote to memory of 5112	5076	cmd.exe	186
PID 5076 wrote to memory of 5124	5076	cmd.exe	188
PID 5076 wrote to memory of 5124	5076	cmd.exe	188

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\defcdae3dc9e03410d78ef0ab357f764.exe
"C:\Users\Admin\AppData\Local\Temp\defcdae3dc9e03410d78ef0ab357f764.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\defcdae3dc9e03410d78ef0ab357f764.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\unsecapp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\60739cf6f660743813\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Performance\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\60739cf6f660743813\unsecapp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\60739cf6f660743813\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\en-US\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\browser\features\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\900323d723f1dd1206\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\60739cf6f660743813\sysmon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\My Videos\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\60739cf6f660743813\SearchApp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\60739cf6f660743813\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\60739cf6f660743813\upfc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\900323d723f1dd1206\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IrEeFocwsv.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:5112
- - C:\Recovery\WindowsRE\smss.exe
    "C:\Recovery\WindowsRE\smss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\60739cf6f660743813\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\60739cf6f660743813\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\60739cf6f660743813\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Performance\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\Performance\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\60739cf6f660743813\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\60739cf6f660743813\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\60739cf6f660743813\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\60739cf6f660743813\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\60739cf6f660743813\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\60739cf6f660743813\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\Microsoft\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\browser\features\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\features\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\browser\features\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\900323d723f1dd1206\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\900323d723f1dd1206\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\900323d723f1dd1206\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\60739cf6f660743813\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\60739cf6f660743813\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\60739cf6f660743813\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Documents\My Videos\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Videos\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Documents\My Videos\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\60739cf6f660743813\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\60739cf6f660743813\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\60739cf6f660743813\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Windows\twain_32\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\twain_32\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Windows\twain_32\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\60739cf6f660743813\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\60739cf6f660743813\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\60739cf6f660743813\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\60739cf6f660743813\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\60739cf6f660743813\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\60739cf6f660743813\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\900323d723f1dd1206\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\900323d723f1dd1206\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\900323d723f1dd1206\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\60739cf6f660743813\RCX688F.tmp

Filesize
1.9MB

MD5
68e9c391db1d1aaa72a5df34a496d4be

SHA1
9264c1ca0b287ff7312886231f9ce79ec0c0bf2e

SHA256
ab2f7d6113d843805dfc4b5950a77d2ce28b5b252fe2356d06f9efa2a126fdf5

SHA512
28d0f438eef9df6e78f83b5d6984d512d1aeb711baee999b41d617fd97802ce89e4a83cd673ef977b50ca9a816b54c3cb60e4a7090734864a81ca717987e37b7

Download Submit
C:\60739cf6f660743813\spoolsv.exe

Filesize
1.9MB

MD5
defcdae3dc9e03410d78ef0ab357f764

SHA1
d9e1223e947b96d32607b66ec3bdb41608ae58cd

SHA256
479e4d08f33e904dadbf2af464d24e42eec66a2301a85fc2ef3552cf037c0bd5

SHA512
7d958b544df58fd1444b06c48ccdf79eadddbffbe729a7fd696b5dfd025b08fa7ddfa22a19f3bf1d79836587832d5c3b4a8d1959c83798b0a3239f9b1021443f

Download Submit
C:\60739cf6f660743813\sysmon.exe

Filesize
1.9MB

MD5
b44c84402f6ce73cccba3fc9a09ac0ec

SHA1
48ce6af1238a875e249f42a5706a0d4f94c3171f

SHA256
13e2402f0148c7175c46ae12ceedb67b9b3f2406716826cbaedcfadb0f6bbddd

SHA512
ee63740c00f013a2036ec75f9050c03ec1b49fbf09692822d6c1e402c20a3d4c46f147e2908e7f13686b2b3833b5557333e1471edf37f2770c9fa7d9996cfa36

Download Submit
C:\900323d723f1dd1206\RCX6A93.tmp

Filesize
1.9MB

MD5
267a5efb018f4fe09450ea0b0a612bcc

SHA1
e021386c6edd9588a7673c1d57c03d7edf5a2a72

SHA256
21c85ad85ba31d5e13e8fb8d026733d131dbdad975ff2797bad39f0b3865b22b

SHA512
458438c720b33477eb1a7668316a102cf75ea1525dd8348e8bdaf50629fe72dd8c7a0c398b0bbaa0ba8292769a11398c29ccb1def0fe68ceb7b802ea8676a469

Download Submit
C:\Recovery\WindowsRE\smss.exe

Filesize
1.9MB

MD5
91c1417ed4e5a512f90ecaf99a9e5bb6

SHA1
6c18e2d89dc0f65dc9e337b385fbb11d2b6ffd4f

SHA256
08914b84e4b5a28b40d2ceafb7c4c4be372ff157b6311ace7e41b63e396a0db2

SHA512
59a1deb84109ab8dd21d60360a94d21e6cf456d0b7c7b15319ca3a9887f6b539f36c3f74cde9fa6424cb436015f1a6f16bcc8bdf335cb0541ae6464ab434d589

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9191187d695b2965f2ceb651f0b37ee8

SHA1
b50a4038fb94c8aa7cff8d6941a4329b5b2ae8c7

SHA256
654a46452391ae3310ff9c6a4c820774e950276014fea044c41f007f6c335833

SHA512
90094f44f83470c88c4fcecb239f70e8e791b3b3da628c00676e3c4791766808b4e31c12beef2a7bc7d6a12d05bd8150888461ed1ef7e9eebc8697f6955d63bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
56addce8ad0788fa7ed121c8239f965f

SHA1
ac9482a712ad866d8d8ba241489613344883ba32

SHA256
cf8f4a84a53607b45f9dfed75c34776b03777d64ac3c44112ccc5638957557d8

SHA512
ecb98df46c6ccec6e9f401f1c8456b26cf38afe82e2bea885c8dc10619fcbaba9e89432f055b1bdbcce40254b06b1e20e330ea4ac724e4f0c673a5697c548521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
82da496008a09abc336bf9adbe6453dd

SHA1
a57df6c2432c6bf7ab549a4333e636f9d9dfebd2

SHA256
69def38d01c34269e4e7be79130fc62befb01815c783fef6d4dc116672306810

SHA512
86d1efaf512d5ffc0af6a4508e63ffaa646971192762461957c0a544e77f9f24bbd0576927a6a996a87f147bcd6562bdc27a57caac6aad64354f485a7a7a7197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
76c4d3c87da7e0fe580b97f942028fe6

SHA1
d182259b34f7c96471edd28e97470888ffe150d1

SHA256
d9f1c9c92ee57bbb51767eeba0cdab1c3b11d4cd735f07fc206b6f2014f15439

SHA512
23466bc0414638ac0d90ecf79e47c21fbe7a0308acb69d64b4cc72ae6cf045b66147c54ae7488ca76391b0fffd7c7ca39d093789b25af720b8a0e62f3e0841ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0f29d4b03e157fa020f2b793683543af

SHA1
1b0603266b02dd38444489e0d5e18ee93b6b766a

SHA256
eec5516679b34fb0efe983a81cc19b0b5cf33fd3191d5d8fd5c3fb082a55d410

SHA512
b0cca3aa1373f813a7a16a1ca94b7e048d83f8875b28949d7ece9668c5cb847250d1468080a85e478833a8876b668a8a6e0ef4df4a289ca66badac3af00dc5c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
7ebbb17f3791dea62cf267d83cf036a4

SHA1
266c27acf64b85afd8380277f767cc54f91ab2b0

SHA256
2345628c466a33c557a0fba468c06436ce7121c56e6260492c5d6ce52d05ba19

SHA512
6e519f44c8d4e9fe752471f19ec9956e3cd6d73f741496d09bb0fb0c8f0048636b6a52204fa475436c0403d022500fd33452e0ad8f18b3ed2245b24b5bd7bb51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
47d9df7fab0d0c96afdd2ca49f2b5030

SHA1
92583883bcf376062ddef5db2333f066d8d36612

SHA256
0f244dd39698dace2c650435886b1175ea01131e581d6c13888576c07fa40b02

SHA512
1844ce4f35849b70c246127482040986caa1bbae2d81119c77e9841f2a3280aabae0ad0db52fc29fe48023b4f4c073fe759b1f54e70e1562289d5e349c015200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3357c199be211a745818714039e25935

SHA1
7d50d07ff2e234f3d10a88363796cbd615b1e9a3

SHA256
668bb751b77a8c5c53c7efcb71e3ee9b2902388e0503e6d6ad3647587a0a0a38

SHA512
052751067bede3dba675313a1c0d88c0e76d62bbc903dbd9ba4cf2b8d03530716c021926bbe34242af9516a77e27df080d1cedde04d8cb51c88c1484ea8a1077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
16a6a93b66d0e764324e2abde988e87f

SHA1
2e79e9a885d4fe41ca396cc4f5d79c5803c87911

SHA256
617d34790965de2672b4ea86c7c078637b1225b70596c064bf3b53bc44dba881

SHA512
32ca76d665bee47070b52df6d9e8e2ffd972558cb2662ff0e851382a4f2824d661f6589c300f7f53efd3226d78f81fa9a7c96819fd2b4b1c7a17a1f02c6bc4df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e1c41ab70e6e5907330c398d5789b851

SHA1
39dbfc40fb75793d222369e59ae5d784f5c3b7a3

SHA256
90c7c4c7f4671b52194b8e5d5e43715003581b96ee6418ced8c3bab9329a1fad

SHA512
a5e07a6316a8142a0680d9ae73890daabb18de56540ed1025f1a7a463b7992854b7b31c537d8e1a32deaf8864dfacc88fb2203c22891643f9e1ddc713968c3fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0c3cddab7d289f65843ac7ee436ff50d

SHA1
19046a0dc416df364c3be08b72166becf7ed9ca9

SHA256
c94ea9a9d0877a48ade47f77733be15871512f7aded45a211eb636bdcf7e45a1

SHA512
45c710a959f67ed05c25709c24887a4d5e5909e94f2012bd1cad64b32729fafea6f6628b2552f36c9d98bf8a1ddf50bb84d92d6e1cb15f20b2a74739ff19c9ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
856B

MD5
f0470cad5ea81dab28194e0478d0868c

SHA1
14e0d840d0f927b6b2f3aeef6f6c5067519e718b

SHA256
7efdc90c0372a08064138ac7ac0d3abbd2728cc5cb981252d6abb84afb4ca380

SHA512
272a40480f066618be28a8579000bed9ac49b99800a69ed353535fea83db2a518d8a039ecfa90c5e459f0820a7db8987a94316605ebab2f59a43577031f5d8ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IrEeFocwsv.bat

Filesize
195B

MD5
8f78412e3e1bf4b6cad0a50587333811

SHA1
8de9444a894a1bb9c61479c016c3ae56d646d2bb

SHA256
e99df820e1a90248a0889b8b03f852e6a6b14ff6d5eb2c6bd40814e952f157e7

SHA512
98fec27bc6b358de8c3d29fe5ddb46de14e2acb632864930f6e0ff42dd3d55eb8c74163ea96776634eb2b95b831678438790fa3648d596ff846ce1807a0c81d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hk0sbgii.4bg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2004-21-0x00007FFA85580000-0x00007FFA86041000-memory.dmp

Filesize
10.8MB

Download
memory/2004-22-0x000000001C470000-0x000000001C47A000-memory.dmp

Filesize
40KB

Download
memory/2004-13-0x000000001C1B0000-0x000000001C1BC000-memory.dmp

Filesize
48KB

Download
memory/2004-12-0x000000001C740000-0x000000001CC68000-memory.dmp

Filesize
5.2MB

Download
memory/2004-5-0x000000001BA00000-0x000000001BA1C000-memory.dmp

Filesize
112KB

Download
memory/2004-4-0x000000001B9F0000-0x000000001B9F8000-memory.dmp

Filesize
32KB

Download
memory/2004-128-0x00007FFA85583000-0x00007FFA85585000-memory.dmp

Filesize
8KB

Download
memory/2004-17-0x000000001C430000-0x000000001C43E000-memory.dmp

Filesize
56KB

Download
memory/2004-142-0x00007FFA85580000-0x00007FFA86041000-memory.dmp

Filesize
10.8MB

Download
memory/2004-170-0x00007FFA85580000-0x00007FFA86041000-memory.dmp

Filesize
10.8MB

Download
memory/2004-18-0x000000001C440000-0x000000001C448000-memory.dmp

Filesize
32KB

Download
memory/2004-19-0x000000001C450000-0x000000001C45E000-memory.dmp

Filesize
56KB

Download
memory/2004-1-0x0000000000CF0000-0x0000000000EEA000-memory.dmp

Filesize
2.0MB

Download
memory/2004-20-0x000000001C460000-0x000000001C46C000-memory.dmp

Filesize
48KB

Download
memory/2004-219-0x00007FFA85580000-0x00007FFA86041000-memory.dmp

Filesize
10.8MB

Download
memory/2004-14-0x000000001C210000-0x000000001C21C000-memory.dmp

Filesize
48KB

Download
memory/2004-26-0x00007FFA85580000-0x00007FFA86041000-memory.dmp

Filesize
10.8MB

Download
memory/2004-23-0x000000001C480000-0x000000001C48C000-memory.dmp

Filesize
48KB

Download
memory/2004-0-0x00007FFA85583000-0x00007FFA85585000-memory.dmp

Filesize
8KB

Download
memory/2004-16-0x000000001C420000-0x000000001C42C000-memory.dmp

Filesize
48KB

Download
memory/2004-15-0x000000001C490000-0x000000001C498000-memory.dmp

Filesize
32KB

Download
memory/2004-8-0x000000001BA30000-0x000000001BA46000-memory.dmp

Filesize
88KB

Download
memory/2004-11-0x000000001C180000-0x000000001C192000-memory.dmp

Filesize
72KB

Download
memory/2004-9-0x000000001BA50000-0x000000001BA60000-memory.dmp

Filesize
64KB

Download
memory/2004-10-0x000000001C170000-0x000000001C17C000-memory.dmp

Filesize
48KB

Download
memory/2004-6-0x000000001C1C0000-0x000000001C210000-memory.dmp

Filesize
320KB

Download
memory/2004-7-0x000000001BA20000-0x000000001BA30000-memory.dmp

Filesize
64KB

Download
memory/2004-3-0x0000000003000000-0x000000000300E000-memory.dmp

Filesize
56KB

Download
memory/2004-2-0x00007FFA85580000-0x00007FFA86041000-memory.dmp

Filesize
10.8MB

Download
memory/2484-195-0x000001DD35CE0000-0x000001DD35D02000-memory.dmp

Filesize
136KB

Download
memory/5124-407-0x0000000000960000-0x0000000000B5A000-memory.dmp

Filesize
2.0MB

Download
memory/5124-408-0x000000001BFF0000-0x000000001C002000-memory.dmp

Filesize
72KB

Download