dcrat | 5e807de88a43edb7b341ed17b4e218f35c3204bf5dc969c131792b0a23e9ddc1

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e282def0d26b0a0ace50c80bd0d3e389.exe
Size

1.1MB
MD5

e282def0d26b0a0ace50c80bd0d3e389
SHA1

aad1e263222141dab481347dc60f033ffc3e86cb
SHA256

e8fa1ef4d468a51c9aabb390609c63f549b8693592d23160d5459817d3fefe88
SHA512

8966a24026b973dfa147d697ef7d659ff3f1b8ec11ea3971593667cd637655edaad4370683069ea2ecea21c1b0863ef79cf46effb8736328c3db010b25299b33
SSDEEP

12288:qmc4TfAkdN7TPPl2Eh8Nv6L1FMCubuoGTeh46qTnnCPQeB89hNuD1hOp1i3l10gR:qh4TbLUEhZL/GspeYhkc9Soh2SfwJ

Score

10^/10

dcrat defense_evasion execution infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 11 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\SearchApi.CppWinrt\\SearchApp.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\pcwum\\dwm.exe\", \"C:\\Windows\\System32\\tdh\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\win\\explorer.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\SearchApi.CppWinrt\\SearchApp.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\pcwum\\dwm.exe\", \"C:\\Windows\\System32\\tdh\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\win\\explorer.exe\", \"C:\\Windows\\System32\\scrptadm\\backgroundTaskHost.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\SearchApi.CppWinrt\\SearchApp.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\pcwum\\dwm.exe\", \"C:\\Windows\\System32\\tdh\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\win\\explorer.exe\", \"C:\\Windows\\System32\\scrptadm\\backgroundTaskHost.exe\", \"C:\\900323d723f1dd1206\\sihost.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\SearchApi.CppWinrt\\SearchApp.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\SearchApi.CppWinrt\\SearchApp.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\pcwum\\dwm.exe\", \"C:\\Windows\\System32\\tdh\\fontdrvhost.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\SearchApi.CppWinrt\\SearchApp.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\SearchApi.CppWinrt\\SearchApp.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\pcwum\\dwm.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\SearchApi.CppWinrt\\SearchApp.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\pcwum\\dwm.exe\", \"C:\\Windows\\System32\\tdh\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe

Process spawned unexpected child process 11 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	5940	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	5940	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	5940	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4692	5940	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	5940	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	5940	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	5940	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	5940	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5292	5940	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5300	5940	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	5940	schtasks.exe	87

UAC bypass 3 TTPs 57 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3132	powershell.exe
1204	powershell.exe
392	powershell.exe
2348	powershell.exe
1980	powershell.exe
1888	powershell.exe
3856	powershell.exe
5392	powershell.exe
3632	powershell.exe
3496	powershell.exe
2900	powershell.exe
1704	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	e282def0d26b0a0ace50c80bd0d3e389.exe

Checks computer location settings 2 TTPs 19 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	e282def0d26b0a0ace50c80bd0d3e389.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dwm.exe

Executes dropped EXE 18 IoCs

pid	Process
5404	dwm.exe
4968	dwm.exe
5340	dwm.exe
5608	dwm.exe
5800	dwm.exe
5784	dwm.exe
1380	dwm.exe
3608	dwm.exe
4128	dwm.exe
4620	dwm.exe
4840	dwm.exe
4444	dwm.exe
5648	dwm.exe
4036	dwm.exe
5820	dwm.exe
872	dwm.exe
1244	dwm.exe
4408	dwm.exe

Adds Run key to start application 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\win\\explorer.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\SearchApi.CppWinrt\\SearchApp.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\pcwum\\dwm.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\System32\\scrptadm\\backgroundTaskHost.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\900323d723f1dd1206\\sihost.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Recovery\\WindowsRE\\TextInputHost.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\SearchApi.CppWinrt\\SearchApp.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\tdh\\fontdrvhost.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\win\\explorer.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\900323d723f1dd1206\\sihost.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Multimedia Platform\\RuntimeBroker.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\pcwum\\dwm.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\tdh\\fontdrvhost.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\System32\\scrptadm\\backgroundTaskHost.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Recovery\\WindowsRE\\TextInputHost.exe\""	e282def0d26b0a0ace50c80bd0d3e389.exe

Checks whether UAC is enabled 1 TTPs 38 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	e282def0d26b0a0ace50c80bd0d3e389.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\System32\scrptadm\backgroundTaskHost.exe	e282def0d26b0a0ace50c80bd0d3e389.exe
File opened for modification	C:\Windows\System32\pcwum\RCX937C.tmp	e282def0d26b0a0ace50c80bd0d3e389.exe
File opened for modification	C:\Windows\System32\pcwum\dwm.exe	e282def0d26b0a0ace50c80bd0d3e389.exe
File opened for modification	C:\Windows\System32\tdh\fontdrvhost.exe	e282def0d26b0a0ace50c80bd0d3e389.exe
File created	C:\Windows\System32\pcwum\dwm.exe	e282def0d26b0a0ace50c80bd0d3e389.exe
File created	C:\Windows\System32\pcwum\6cb0b6c459d5d3	e282def0d26b0a0ace50c80bd0d3e389.exe
File created	C:\Windows\System32\tdh\5b884080fd4f94	e282def0d26b0a0ace50c80bd0d3e389.exe
File created	C:\Windows\System32\scrptadm\eddb19405b7ce1	e282def0d26b0a0ace50c80bd0d3e389.exe
File opened for modification	C:\Windows\System32\tdh\RCX9580.tmp	e282def0d26b0a0ace50c80bd0d3e389.exe
File opened for modification	C:\Windows\System32\scrptadm\RCX9C88.tmp	e282def0d26b0a0ace50c80bd0d3e389.exe
File opened for modification	C:\Windows\System32\scrptadm\backgroundTaskHost.exe	e282def0d26b0a0ace50c80bd0d3e389.exe
File created	C:\Windows\System32\tdh\fontdrvhost.exe	e282def0d26b0a0ace50c80bd0d3e389.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office 15\ClientX64\ea9f0e6c9e2dcd	e282def0d26b0a0ace50c80bd0d3e389.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dllhost.exe	e282def0d26b0a0ace50c80bd0d3e389.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\5940a34987c991	e282def0d26b0a0ace50c80bd0d3e389.exe
File created	C:\Program Files\Windows Multimedia Platform\9e8d7a4ca61bd9	e282def0d26b0a0ace50c80bd0d3e389.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe	e282def0d26b0a0ace50c80bd0d3e389.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe	e282def0d26b0a0ace50c80bd0d3e389.exe
File created	C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe	e282def0d26b0a0ace50c80bd0d3e389.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCX87A0.tmp	e282def0d26b0a0ace50c80bd0d3e389.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\RCX8BB8.tmp	e282def0d26b0a0ace50c80bd0d3e389.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dllhost.exe	e282def0d26b0a0ace50c80bd0d3e389.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCX902F.tmp	e282def0d26b0a0ace50c80bd0d3e389.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe	e282def0d26b0a0ace50c80bd0d3e389.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApi.CppWinrt\SearchApp.exe	e282def0d26b0a0ace50c80bd0d3e389.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApi.CppWinrt\38384e6a620884	e282def0d26b0a0ace50c80bd0d3e389.exe
File created	C:\Windows\win\explorer.exe	e282def0d26b0a0ace50c80bd0d3e389.exe
File created	C:\Windows\win\7a0fd90576e088	e282def0d26b0a0ace50c80bd0d3e389.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApi.CppWinrt\RCX8DBD.tmp	e282def0d26b0a0ace50c80bd0d3e389.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApi.CppWinrt\SearchApp.exe	e282def0d26b0a0ace50c80bd0d3e389.exe
File opened for modification	C:\Windows\win\RCX9A07.tmp	e282def0d26b0a0ace50c80bd0d3e389.exe
File opened for modification	C:\Windows\win\explorer.exe	e282def0d26b0a0ace50c80bd0d3e389.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	e282def0d26b0a0ace50c80bd0d3e389.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dwm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4728	schtasks.exe
4688	schtasks.exe
5292	schtasks.exe
5300	schtasks.exe
4692	schtasks.exe
4720	schtasks.exe
4964	schtasks.exe
952	schtasks.exe
3668	schtasks.exe
5092	schtasks.exe
4624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1916	e282def0d26b0a0ace50c80bd0d3e389.exe
1204	powershell.exe
1204	powershell.exe
3132	powershell.exe
3132	powershell.exe
3856	powershell.exe
3856	powershell.exe
392	powershell.exe
392	powershell.exe
5392	powershell.exe
5392	powershell.exe
2900	powershell.exe
2900	powershell.exe
1704	powershell.exe
1704	powershell.exe
2348	powershell.exe
2348	powershell.exe
3632	powershell.exe
3632	powershell.exe
1888	powershell.exe
1888	powershell.exe
1980	powershell.exe
1980	powershell.exe
3856	powershell.exe
3496	powershell.exe
3496	powershell.exe
1204	powershell.exe
392	powershell.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	e282def0d26b0a0ace50c80bd0d3e389.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeDebugPrivilege	392	powershell.exe
Token: SeDebugPrivilege	5392	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeDebugPrivilege	5404	dwm.exe
Token: SeDebugPrivilege	4968	dwm.exe
Token: SeDebugPrivilege	5340	dwm.exe
Token: SeDebugPrivilege	5608	dwm.exe
Token: SeDebugPrivilege	5800	dwm.exe
Token: SeDebugPrivilege	5784	dwm.exe
Token: SeDebugPrivilege	1380	dwm.exe
Token: SeDebugPrivilege	3608	dwm.exe
Token: SeDebugPrivilege	4128	dwm.exe
Token: SeDebugPrivilege	4620	dwm.exe
Token: SeDebugPrivilege	4840	dwm.exe
Token: SeDebugPrivilege	4444	dwm.exe
Token: SeDebugPrivilege	5648	dwm.exe
Token: SeDebugPrivilege	4036	dwm.exe
Token: SeDebugPrivilege	5820	dwm.exe
Token: SeDebugPrivilege	872	dwm.exe
Token: SeDebugPrivilege	1244	dwm.exe
Token: SeDebugPrivilege	4408	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2900	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	103
PID 1916 wrote to memory of 2900	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	103
PID 1916 wrote to memory of 3132	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	104
PID 1916 wrote to memory of 3132	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	104
PID 1916 wrote to memory of 1704	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	105
PID 1916 wrote to memory of 1704	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	105
PID 1916 wrote to memory of 1204	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	107
PID 1916 wrote to memory of 1204	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	107
PID 1916 wrote to memory of 3856	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	108
PID 1916 wrote to memory of 3856	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	108
PID 1916 wrote to memory of 1980	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	109
PID 1916 wrote to memory of 1980	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	109
PID 1916 wrote to memory of 2348	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	111
PID 1916 wrote to memory of 2348	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	111
PID 1916 wrote to memory of 5392	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	112
PID 1916 wrote to memory of 5392	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	112
PID 1916 wrote to memory of 392	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	113
PID 1916 wrote to memory of 392	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	113
PID 1916 wrote to memory of 3632	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	117
PID 1916 wrote to memory of 3632	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	117
PID 1916 wrote to memory of 1888	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	118
PID 1916 wrote to memory of 1888	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	118
PID 1916 wrote to memory of 3496	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	119
PID 1916 wrote to memory of 3496	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	119
PID 1916 wrote to memory of 4352	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	127
PID 1916 wrote to memory of 4352	1916	e282def0d26b0a0ace50c80bd0d3e389.exe	127
PID 4352 wrote to memory of 1120	4352	cmd.exe	129
PID 4352 wrote to memory of 1120	4352	cmd.exe	129
PID 4352 wrote to memory of 5404	4352	cmd.exe	132
PID 4352 wrote to memory of 5404	4352	cmd.exe	132
PID 5404 wrote to memory of 860	5404	dwm.exe	133
PID 5404 wrote to memory of 860	5404	dwm.exe	133
PID 5404 wrote to memory of 4000	5404	dwm.exe	134
PID 5404 wrote to memory of 4000	5404	dwm.exe	134
PID 860 wrote to memory of 4968	860	WScript.exe	135
PID 860 wrote to memory of 4968	860	WScript.exe	135
PID 4968 wrote to memory of 4040	4968	dwm.exe	136
PID 4968 wrote to memory of 4040	4968	dwm.exe	136
PID 4968 wrote to memory of 2856	4968	dwm.exe	137
PID 4968 wrote to memory of 2856	4968	dwm.exe	137
PID 4040 wrote to memory of 5340	4040	WScript.exe	141
PID 4040 wrote to memory of 5340	4040	WScript.exe	141
PID 5340 wrote to memory of 4176	5340	dwm.exe	142
PID 5340 wrote to memory of 4176	5340	dwm.exe	142
PID 5340 wrote to memory of 3024	5340	dwm.exe	144
PID 5340 wrote to memory of 3024	5340	dwm.exe	144
PID 4176 wrote to memory of 5608	4176	WScript.exe	147
PID 4176 wrote to memory of 5608	4176	WScript.exe	147
PID 5608 wrote to memory of 1768	5608	dwm.exe	148
PID 5608 wrote to memory of 1768	5608	dwm.exe	148
PID 5608 wrote to memory of 4136	5608	dwm.exe	149
PID 5608 wrote to memory of 4136	5608	dwm.exe	149
PID 1768 wrote to memory of 5800	1768	WScript.exe	150
PID 1768 wrote to memory of 5800	1768	WScript.exe	150
PID 5800 wrote to memory of 1536	5800	dwm.exe	151
PID 5800 wrote to memory of 1536	5800	dwm.exe	151
PID 5800 wrote to memory of 1712	5800	dwm.exe	152
PID 5800 wrote to memory of 1712	5800	dwm.exe	152
PID 1536 wrote to memory of 5784	1536	WScript.exe	153
PID 1536 wrote to memory of 5784	1536	WScript.exe	153
PID 5784 wrote to memory of 556	5784	dwm.exe	154
PID 5784 wrote to memory of 556	5784	dwm.exe	154
PID 5784 wrote to memory of 3396	5784	dwm.exe	155
PID 5784 wrote to memory of 3396	5784	dwm.exe	155

System policy modification 1 TTPs 57 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e282def0d26b0a0ace50c80bd0d3e389.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e282def0d26b0a0ace50c80bd0d3e389.exe
"C:\Users\Admin\AppData\Local\Temp\e282def0d26b0a0ace50c80bd0d3e389.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\e282def0d26b0a0ace50c80bd0d3e389.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\TextInputHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApi.CppWinrt\SearchApp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\pcwum\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\tdh\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\win\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\scrptadm\backgroundTaskHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\900323d723f1dd1206\sihost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oRYbT3TuVW.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1120
- - C:\Windows\System32\pcwum\dwm.exe
    "C:\Windows\System32\pcwum\dwm.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:5404
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\acc30fbd-2a60-4dc4-9432-659d3e683f5f.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:860
    - - C:\Windows\System32\pcwum\dwm.exe
        
        C:\Windows\System32\pcwum\dwm.exe
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4968
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e84b963-265d-43f2-874e-80f8142909f8.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\System32\pcwum\dwm.exe
        
        C:\Windows\System32\pcwum\dwm.exe
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:5340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df697220-9673-4268-bfe5-ebd651df2f56.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4176
        
        C:\Windows\System32\pcwum\dwm.exe
        
        C:\Windows\System32\pcwum\dwm.exe
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:5608
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0f753b2-1f91-418f-8185-9e2a1ed4a303.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\System32\pcwum\dwm.exe
        
        C:\Windows\System32\pcwum\dwm.exe
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:5800
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\58b47054-a05b-4246-bf59-adf0ab0d0c93.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\System32\pcwum\dwm.exe
        
        C:\Windows\System32\pcwum\dwm.exe
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:5784
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eea1b3d2-986e-4bdb-965a-919bd90a51f7.vbs"
        14⤵
        
        PID:556
        
        C:\Windows\System32\pcwum\dwm.exe
        
        C:\Windows\System32\pcwum\dwm.exe
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1380
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6434ec32-2b1e-4367-8b5d-62321bc17714.vbs"
        16⤵
        
        PID:3292
        
        C:\Windows\System32\pcwum\dwm.exe
        
        C:\Windows\System32\pcwum\dwm.exe
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3608
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a5821815-684a-46c8-a492-aa6e7b62ecae.vbs"
        18⤵
        
        PID:4420
        
        C:\Windows\System32\pcwum\dwm.exe
        
        C:\Windows\System32\pcwum\dwm.exe
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4128
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2dcc940-1d94-477f-b00b-a02b4a4ae146.vbs"
        20⤵
        
        PID:4752
        
        C:\Windows\System32\pcwum\dwm.exe
        
        C:\Windows\System32\pcwum\dwm.exe
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4eecbf55-0d5f-4a78-9210-4071e6bad322.vbs"
        22⤵
        
        PID:4836
        
        C:\Windows\System32\pcwum\dwm.exe
        
        C:\Windows\System32\pcwum\dwm.exe
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4840
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cba39f64-7a76-4feb-94a4-b154871fcb27.vbs"
        24⤵
        
        PID:2016
        
        C:\Windows\System32\pcwum\dwm.exe
        
        C:\Windows\System32\pcwum\dwm.exe
        25⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08000026-646a-450c-8871-fc55351ba37a.vbs"
        26⤵
        
        PID:552
        
        C:\Windows\System32\pcwum\dwm.exe
        
        C:\Windows\System32\pcwum\dwm.exe
        27⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5648
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27456609-c479-45e0-b1cb-7bdb3c6f6405.vbs"
        28⤵
        
        PID:4932
        
        C:\Windows\System32\pcwum\dwm.exe
        
        C:\Windows\System32\pcwum\dwm.exe
        29⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a88fe76-988d-4e65-a9a8-b5feff60dcd1.vbs"
        30⤵
        
        PID:5604
        
        C:\Windows\System32\pcwum\dwm.exe
        
        C:\Windows\System32\pcwum\dwm.exe
        31⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5820
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\95580e50-2094-4135-8326-fbc67ed91e12.vbs"
        32⤵
        
        PID:4116
        
        C:\Windows\System32\pcwum\dwm.exe
        
        C:\Windows\System32\pcwum\dwm.exe
        33⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:872
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b26508bf-2b34-43fe-ad5e-c16039a6dec7.vbs"
        34⤵
        
        PID:3836
        
        C:\Windows\System32\pcwum\dwm.exe
        
        C:\Windows\System32\pcwum\dwm.exe
        35⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1244
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3f95169-2561-495e-8049-aa7af1a00523.vbs"
        36⤵
        
        PID:5424
        
        C:\Windows\System32\pcwum\dwm.exe
        
        C:\Windows\System32\pcwum\dwm.exe
        37⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4408
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cddb1647-8eaf-42ef-b9e6-e883c6e7f7d4.vbs"
        38⤵
        
        PID:368
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d351a92-9ba5-4f92-8157-b7f9f92dec64.vbs"
        38⤵
        
        PID:952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6fd09570-c15b-4d66-a039-9c2955b1f88b.vbs"
        36⤵
        
        PID:5340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\554ebc04-df0e-43af-8db9-d6648b04acd5.vbs"
        34⤵
        
        PID:5764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5e58deab-e4c8-4eb2-acb4-6fbf2b3ab3bb.vbs"
        32⤵
        
        PID:2760
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52a6b62e-6035-46c6-8191-f553fd70063a.vbs"
        30⤵
        
        PID:400
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7549eb16-9203-47ce-8c03-09bc3d7a5148.vbs"
        28⤵
        
        PID:2676
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a764ee3-dae7-4f39-9198-986c99e4f28d.vbs"
        26⤵
        
        PID:1788
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d5e65222-d8d0-4a6a-bd71-59903d6bc132.vbs"
        24⤵
        
        PID:3844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f643f6e4-5c30-49e8-91a8-d9afbf21cf53.vbs"
        22⤵
        
        PID:1164
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d9b7e4f6-05c2-42b3-9380-634d1c2e1171.vbs"
        20⤵
        
        PID:5948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da474f1a-375f-452c-bd91-8706881eb523.vbs"
        18⤵
        
        PID:3100
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8f412184-2d8a-491f-a9c8-a6393c52cf06.vbs"
        16⤵
        
        PID:2560
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\592de5ec-d56b-4f0c-a842-e87581ca648e.vbs"
        14⤵
        
        PID:3396
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0fc23a29-87cf-4c2d-b4e6-2776c137ce17.vbs"
        12⤵
        
        PID:1712
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f6740aa8-c6a7-4bc7-bc5f-3b4a0972f34c.vbs"
        10⤵
        
        PID:4136
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\18240a07-5166-4958-a51d-cae8ca7f64ef.vbs"
        8⤵
        
        PID:3024
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fbbdeec5-36a5-4df8-9d7c-07c768d47dd6.vbs"
        6⤵
        
        PID:2856
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c824571e-442b-4fbe-bebf-34f54cc65d72.vbs"
      4⤵
      PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApi.CppWinrt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\pcwum\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\tdh\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\win\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\System32\scrptadm\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\900323d723f1dd1206\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe

Filesize
1.1MB

MD5
e282def0d26b0a0ace50c80bd0d3e389

SHA1
aad1e263222141dab481347dc60f033ffc3e86cb

SHA256
e8fa1ef4d468a51c9aabb390609c63f549b8693592d23160d5459817d3fefe88

SHA512
8966a24026b973dfa147d697ef7d659ff3f1b8ec11ea3971593667cd637655edaad4370683069ea2ecea21c1b0863ef79cf46effb8736328c3db010b25299b33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dwm.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a16aff60eb3c3e35753a259b050c8a27

SHA1
85196d5dfb23d0c8b32b186325e2d58315a11287

SHA256
a057f85fa5358fac25f1337c1fbabeffb1ca1908b352208038293ec575dfc206

SHA512
13e6514cddaafba8f4fe3b08f6d6e118823ad454aac4efcb71a82438de50f97cd9570f44d594db27e4c534912a12ed066ea098b95505a6994f854f8349f2f5b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
385f2ec5a61f1814b5b9ab67c2f07a0e

SHA1
1426461338ffaf19c90943434470b10ab38347be

SHA256
832f227c50733f10c0461f4494219ceb045a9fc45b2a88b07e795a9226b4e6c7

SHA512
a9858fa3d7eaca31fba2ed05c7c3a0f3db5bfde5ae20d91bb2f942f2ed39339e7939385441d1377f292c4e72761f98e61e0842fd87f852b99408a391215bd9f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9038073858225f9afc939a0a2385005d

SHA1
ccd8ee1416a8e738628ffd01f39eca6324000563

SHA256
3fc794e69bf73ea36eccc866688e3ba9303224c00f264f4b771bdb536035240e

SHA512
cb0f4422b84975595744bf183a71527b053cf738f19aa4ed1008c35d5ea6fb9e2c8ae142a81eeae2091abf2a17e24c6beca488a9c3ea6b6d2d989e3a58a52d53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bcebe662dcddf8a8c942299b507205e0

SHA1
74c92b01e2b8c147f2f6e39ef7a95b171252ad37

SHA256
1aa7e8cd174ef0191e4aa20a0d71c447ecba9cca979ccb0b921d8275c4aad610

SHA512
bb6156cc9a37d8e978b54c7a91d3362eb759b02a58c434633f76ebea793674b8b5633dcbce9ac8297bf97d92fdae49a6bfa85df0e8fa0a204628d65c7074b4e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
00889a4c090a6a44dee9c16d05fc83df

SHA1
3ca3e69969cd5f63856d27fff17ecb00b854b0ca

SHA256
7badaad80d3059dd0b80c71e42e196345c38d08630ec8e5e20d145c918dcd6ce

SHA512
9d02a7e437a1cb0269d595a3a435c7b22993715100c741cfd415907dcc8d62f9655922c77fca66fe9365152dedc8784aba8123bda4b137eb218a9e8e6c624dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c44e48d99762769d16de7352e92db16f

SHA1
29898e4ddba0504899fe0f0a55abacf592689e1b

SHA256
f92b4e399718fecfdc08924f70f0bdb7c5e0014eaeec343d815a503e06205bc8

SHA512
18cfd8b4bf3871c26c01d20ecd90f76493a6e55d7df33e78fb1491f6151ab3c04589758d6419f7b73a1288d5e65b85f40142bb7e3df5bc46e7fe4cf2da014879

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0c3cddab7d289f65843ac7ee436ff50d

SHA1
19046a0dc416df364c3be08b72166becf7ed9ca9

SHA256
c94ea9a9d0877a48ade47f77733be15871512f7aded45a211eb636bdcf7e45a1

SHA512
45c710a959f67ed05c25709c24887a4d5e5909e94f2012bd1cad64b32729fafea6f6628b2552f36c9d98bf8a1ddf50bb84d92d6e1cb15f20b2a74739ff19c9ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\08000026-646a-450c-8871-fc55351ba37a.vbs

Filesize
709B

MD5
d9ec474ab97f28d79eae74d134f93a66

SHA1
630f010ba1bf61099ad550a59cf3867946daf26d

SHA256
581d0d0095bb686d5d6649c46b42956463847ffb6587e724c7a93784dc5db74b

SHA512
fbee72d64558dba19457a4790faf7bc2f1fb89bb4d263124e3456946edf28ecb9cb0d3af98c783ec69072f1690ab516a2ea905c113eaaaebddd688f9447bed00

Download Submit
C:\Users\Admin\AppData\Local\Temp\2e84b963-265d-43f2-874e-80f8142909f8.vbs

Filesize
709B

MD5
9d91a5c071228a7f4be802a6a2a34f4f

SHA1
1947a5200eeed59860e8729f02fe8f8ab22fe8ad

SHA256
25caaaf6b1bb3b878772227bc0d3dfc2fea9386aefd99b351d835bc4744613e0

SHA512
df2b3ecab6b0842e79b99b56628993a7a3bb2ec14dfc245b2d9b4acd06db1696d472675545beb777bd7f745ceedeb0119b3fa6a9884e42494fcab604b1391ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\4eecbf55-0d5f-4a78-9210-4071e6bad322.vbs

Filesize
709B

MD5
192db28c9b6f2ac5ff5b39309c43f728

SHA1
569069426a61f2586a923b403c485bdd14d32bd5

SHA256
7c03d4369c7e860e493855c1f3189a20eab63c62a10b51dc580b2152a5f92527

SHA512
655fbaa2cb4940421b0641b74a35bbac553dfa4dd880451a69b68968674458df76ef4e290d697f19ce09ddb5321c784924c542c9504dd5a6584a3f6be4f87b6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\58b47054-a05b-4246-bf59-adf0ab0d0c93.vbs

Filesize
709B

MD5
a7eba2a00fbc6bfe44e7eabbaa79a43e

SHA1
617ff728f2d938e3aede2f225248128e72510435

SHA256
10f16e72bd20e0699d742031494ea0a521c17158ead4988bd4f739785d72353c

SHA512
c8aae58be5035b6f0315b8451aebf7f68b74d8ab4f9037bbfebad33ef816f37682fe778b215a215a4ca5b04609523f075cf0928fd2dcd5f67d4fb7e6cee0b80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\6434ec32-2b1e-4367-8b5d-62321bc17714.vbs

Filesize
709B

MD5
7a7d187af91b872175bfc4bb57874c62

SHA1
2ae321d545101ff295773a2047d452b7580f0eb0

SHA256
89de2678824fb52921abd13e180154be1612f39359d024eced9c982bfcecf99a

SHA512
d26ffabd9a1db116ba0e5e2f1215405379f80895a511acd3417dc38458572246330d620f4521262321072da6f830f2a4cb84646a8a0fb7d8828fd40de7209742

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rti4c2gv.1at.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a5821815-684a-46c8-a492-aa6e7b62ecae.vbs

Filesize
709B

MD5
07fc4d1417a096419b1159493f3d3f6c

SHA1
40b29c020d9c061ebb13df3dee09a475cb1e229a

SHA256
e1ff15c1b78df7e8521befc7bc5355ea3bc1ffd035a6a0ec330258cb54c801ee

SHA512
d0ec563226b861cfd0218dc41c60604f2443899b12e2c8d10ad1a797115d3105112efcbe61cde8f2f152d6179a355d2801f41bfe388bc94e351a2609fa200655

Download Submit
C:\Users\Admin\AppData\Local\Temp\acc30fbd-2a60-4dc4-9432-659d3e683f5f.vbs

Filesize
709B

MD5
9f91234ec15257e989647c745a745327

SHA1
018f62bd9725719968a0365cec7cc4ed06212fe5

SHA256
e83ff8df3b0a0e1c047e4359293ec18b90497a02c515fe835960fcb95b05a082

SHA512
ff3e99e6a9244604af21897158fde86727dde548c22b3dbfd728b4f49ce958e993ecb598032578154d4007167dadca03aef636a4b129ec35e8e44549deb8d378

Download Submit
C:\Users\Admin\AppData\Local\Temp\c824571e-442b-4fbe-bebf-34f54cc65d72.vbs

Filesize
485B

MD5
c4cd84deda5da31785155bcefbcb5d36

SHA1
0c4fdfc37f886f35ce332506724768330ace2e28

SHA256
41d7970802bd4cc0cab53420d8296f7ba86709214113e53daa437949edf50121

SHA512
82cbf553f023d6cd23d07f7e90c2e4d059b704bf78c6c03cfbb3d45c4982aa1829d33e15bcbdb24c23c6dfef15783828afd63090c25818d6ea852eb23ae287e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\cba39f64-7a76-4feb-94a4-b154871fcb27.vbs

Filesize
709B

MD5
d889547bcba95d7b1d54364a2b23979c

SHA1
e25a656faef7ecb45f99fe1e8a0045a1cad06bb9

SHA256
5073b478a425f13250f7f3de2013ebf68de7d4f503c66827f536521c7503c572

SHA512
94ac7e36e24adca6ebffb74a2296a1bc658e4cf90e0d4e7dea8d3a677289d9c154c973115b72d893a5a7b357cb9a9ba471d6d73a03c289cf53e6705b4c7340a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\df697220-9673-4268-bfe5-ebd651df2f56.vbs

Filesize
709B

MD5
895ad1781b16ff615f14c38526e8e086

SHA1
098f6eee76a6648085623753baf3dda9a1edc0ff

SHA256
6e9009f07463d91b0d9b46fecd3170baec07fb799fd964be3573932560b41b0f

SHA512
359c5de994b3efc47d6ce587281ef303c7dae7ba81fa0e7ad61861aa413c2ffff6e90da4f37198b8c634417e29422ba76ac666f1f8d4ecbeb8910eac928447dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\eea1b3d2-986e-4bdb-965a-919bd90a51f7.vbs

Filesize
709B

MD5
3e2eb75cd8321ccdea1d817cbc550602

SHA1
5b3217d22c7f263da73d35a3348461e5bc305fff

SHA256
6aea6f99f4cd653adf62d6cae88febb0b80e0aa9d8f19d8b59d8b899191226ac

SHA512
ca190558a1e63c1ef47d20b526cee2522d78aa0919a03cf61952363af39cc68d53e6e4a1b6978a4370329b60afece86ca5ea290928c5b5d7bf83c22aaef269ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\f0f753b2-1f91-418f-8185-9e2a1ed4a303.vbs

Filesize
709B

MD5
bcfd98b7584f0ee1798228b717f1e97c

SHA1
0fd5bd357612f92ef473aa05abad7025469eb974

SHA256
2351dd3b15529072bffae88247f1caab36a2431879c8e8619edc9292d905b3df

SHA512
6f3120bb879f8243c853db74d2ef211236e1642d312b2a9332a9d17d276bd8bcee022d9c4402dc8e29df5227f4995852663ea09cd6b8bdeb832be4aaa6627cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\f2dcc940-1d94-477f-b00b-a02b4a4ae146.vbs

Filesize
709B

MD5
e6e1131f8e71077bd362cc53a3ef91a0

SHA1
5cae00e804f47a647b623df197cd8357a5f13e3c

SHA256
8c07ce90213fa781bb581ff48994b6537f0d8c1a95b2b4cfd7507a115f4baec6

SHA512
a100b2e5543f1d8c1366b28ddd4d5c20fbfe2d6545e22028fff5865daece626e3a9e9a78049d8e34a1b476dbcbac2a11673014f9b55b30d92314c601b5251587

Download Submit
C:\Users\Admin\AppData\Local\Temp\oRYbT3TuVW.bat

Filesize
197B

MD5
87a4dedac10669c5e67b823a430b75d9

SHA1
a528b9adc9624749fd3c4e046a5969948064fbdb

SHA256
a9ed61f3c9622fd07a47fc0140502e5a4126ec9d0c97aca8cfd7e237598a98ae

SHA512
3bfaa01e93b851fca0348141607af0ab9d75ded18caeb646a512add484043f4d0dc265a41a7157eea628222d8ce73952c735c22e69183f53c84d79960c8ce5d2

Download Submit
memory/1204-130-0x00000289C7160000-0x00000289C7182000-memory.dmp

Filesize
136KB

Download
memory/1380-337-0x0000000001480000-0x0000000001492000-memory.dmp

Filesize
72KB

Download
memory/1916-11-0x000000001BC50000-0x000000001BC60000-memory.dmp

Filesize
64KB

Download
memory/1916-10-0x000000001BC40000-0x000000001BC50000-memory.dmp

Filesize
64KB

Download
memory/1916-1-0x0000000000ED0000-0x0000000000FE4000-memory.dmp

Filesize
1.1MB

Download
memory/1916-117-0x00007FF9AFEF3000-0x00007FF9AFEF5000-memory.dmp

Filesize
8KB

Download
memory/1916-25-0x00007FF9AFEF0000-0x00007FF9B09B1000-memory.dmp

Filesize
10.8MB

Download
memory/1916-24-0x00007FF9AFEF0000-0x00007FF9B09B1000-memory.dmp

Filesize
10.8MB

Download
memory/1916-21-0x000000001BCE0000-0x000000001BCE8000-memory.dmp

Filesize
32KB

Download
memory/1916-16-0x000000001BCA0000-0x000000001BCA8000-memory.dmp

Filesize
32KB

Download
memory/1916-20-0x000000001BCD0000-0x000000001BCDC000-memory.dmp

Filesize
48KB

Download
memory/1916-17-0x000000001BCB0000-0x000000001BCBC000-memory.dmp

Filesize
48KB

Download
memory/1916-18-0x000000001BCC0000-0x000000001BCC8000-memory.dmp

Filesize
32KB

Download
memory/1916-15-0x000000001BC90000-0x000000001BC9A000-memory.dmp

Filesize
40KB

Download
memory/1916-14-0x000000001BC80000-0x000000001BC8C000-memory.dmp

Filesize
48KB

Download
memory/1916-12-0x000000001BC60000-0x000000001BC68000-memory.dmp

Filesize
32KB

Download
memory/1916-128-0x00007FF9AFEF0000-0x00007FF9B09B1000-memory.dmp

Filesize
10.8MB

Download
memory/1916-13-0x000000001BC70000-0x000000001BC7A000-memory.dmp

Filesize
40KB

Download
memory/1916-0-0x00007FF9AFEF3000-0x00007FF9AFEF5000-memory.dmp

Filesize
8KB

Download
memory/1916-9-0x0000000003250000-0x000000000325C000-memory.dmp

Filesize
48KB

Download
memory/1916-127-0x00007FF9AFEF0000-0x00007FF9B09B1000-memory.dmp

Filesize
10.8MB

Download
memory/1916-8-0x0000000003240000-0x0000000003248000-memory.dmp

Filesize
32KB

Download
memory/1916-2-0x00007FF9AFEF0000-0x00007FF9B09B1000-memory.dmp

Filesize
10.8MB

Download
memory/1916-6-0x0000000003220000-0x000000000322A000-memory.dmp

Filesize
40KB

Download
memory/1916-129-0x00007FF9AFEF0000-0x00007FF9B09B1000-memory.dmp

Filesize
10.8MB

Download
memory/1916-7-0x0000000003230000-0x000000000323C000-memory.dmp

Filesize
48KB

Download
memory/1916-5-0x0000000003210000-0x000000000321C000-memory.dmp

Filesize
48KB

Download
memory/1916-4-0x0000000003200000-0x0000000003212000-memory.dmp

Filesize
72KB

Download
memory/1916-3-0x00000000030E0000-0x00000000030E8000-memory.dmp

Filesize
32KB

Download
memory/4128-360-0x000000001BB10000-0x000000001BB22000-memory.dmp

Filesize
72KB

Download
memory/5784-325-0x0000000000BE0000-0x0000000000BF2000-memory.dmp

Filesize
72KB

Download
memory/5800-313-0x0000000002D80000-0x0000000002D92000-memory.dmp

Filesize
72KB

Download
memory/5820-420-0x0000000000BC0000-0x0000000000BD2000-memory.dmp

Filesize
72KB

Download