dcrat | e5d28ec84e4b5f023e3f386cf7e0776850b67e2bad1299413885f3fdd757f58c

Analysis

max time kernel
150s
max time network
157s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Size

5.9MB
MD5

1e36a4648b29e6f1e182d0db0c45a3be
SHA1

934d5fe30ed8233d77098f1214d07b0d009e5371
SHA256

e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7
SHA512

ec6ddc3da4d504bac611d61d0e294f74e1092ce0d6afc1e56641ec99b44237af1fcbce374b39eb1b8aaf9e57de5997bd6917b38e1a5cf5c34f44e93e089061b2
SSDEEP

98304:RyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw4H:RyeU11Rvqmu8TWKnF6N/1wK

Score

10^/10

dcrat defense_evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1132	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1028	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2936	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2936	schtasks.exe	31

UAC bypass 3 TTPs 12 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2620	powershell.exe
2788	powershell.exe
2756	powershell.exe
3008	powershell.exe
2904	powershell.exe
2932	powershell.exe
2692	powershell.exe
2800	powershell.exe
2624	powershell.exe
3020	powershell.exe
2900	powershell.exe
2168	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe

Executes dropped EXE 3 IoCs

pid	Process
2184	OSPPSVC.exe
1164	OSPPSVC.exe
1792	OSPPSVC.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
1164	OSPPSVC.exe
1164	OSPPSVC.exe
1792	OSPPSVC.exe
1792	OSPPSVC.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Journal\fr-FR\OSPPSVC.exe	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File created	C:\Program Files\Windows Journal\fr-FR\1610b97d3ab4a7	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File created	C:\Program Files (x86)\Windows Sidebar\ja-JP\Idle.exe	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File created	C:\Program Files (x86)\Windows Sidebar\ja-JP\6ccacd8608530f	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Program Files\Windows Journal\fr-FR\OSPPSVC.exe	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\ja-JP\RCXFCA9.tmp	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Program Files\Windows Journal\fr-FR\RCXEEB8.tmp	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Program Files\Windows Journal\fr-FR\RCXEF36.tmp	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\ja-JP\RCXFCAA.tmp	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\ja-JP\Idle.exe	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File created	C:\Windows\DigitalLocker\es-ES\lsm.exe	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Windows\DigitalLocker\es-ES\RCXF35E.tmp	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Windows\LiveKernelReports\RCXF881.tmp	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Windows\RemotePackages\RemoteDesktops\wininit.exe	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File created	C:\Windows\DigitalLocker\es-ES\101b941d020240	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Windows\Offline Web Pages\RCXF13A.tmp	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Windows\LiveKernelReports\explorer.exe	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File created	C:\Windows\Registration\CRMLog\OSPPSVC.exe	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File created	C:\Windows\Offline Web Pages\taskhost.exe	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File created	C:\Windows\RemotePackages\RemoteDesktops\wininit.exe	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File created	C:\Windows\RemotePackages\RemoteDesktops\56085415360792	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Windows\Offline Web Pages\taskhost.exe	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Windows\DigitalLocker\es-ES\RCXF36F.tmp	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Windows\DigitalLocker\es-ES\lsm.exe	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Windows\LiveKernelReports\RCXF804.tmp	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File created	C:\Windows\LiveKernelReports\explorer.exe	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File created	C:\Windows\LiveKernelReports\7a0fd90576e088	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Windows\Registration\CRMLog\RCXEA61.tmp	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Windows\Registration\CRMLog\RCXEA81.tmp	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Windows\Offline Web Pages\RCXF14B.tmp	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Windows\RemotePackages\RemoteDesktops\RCXFA85.tmp	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Windows\RemotePackages\RemoteDesktops\RCXFA96.tmp	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File opened for modification	C:\Windows\Registration\CRMLog\OSPPSVC.exe	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File created	C:\Windows\Registration\CRMLog\1610b97d3ab4a7	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
File created	C:\Windows\Offline Web Pages\b75386f1303e64	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1036	schtasks.exe
1588	schtasks.exe
2860	schtasks.exe
2968	schtasks.exe
2200	schtasks.exe
2656	schtasks.exe
1960	schtasks.exe
756	schtasks.exe
1632	schtasks.exe
2852	schtasks.exe
1864	schtasks.exe
2344	schtasks.exe
2180	schtasks.exe
1132	schtasks.exe
2796	schtasks.exe
2584	schtasks.exe
1620	schtasks.exe
2660	schtasks.exe
2604	schtasks.exe
2520	schtasks.exe
2824	schtasks.exe
1508	schtasks.exe
1612	schtasks.exe
1028	schtasks.exe
1928	schtasks.exe
2792	schtasks.exe
2664	schtasks.exe
1996	schtasks.exe
1820	schtasks.exe
2740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
2904	powershell.exe
2900	powershell.exe
2932	powershell.exe
3020	powershell.exe
2168	powershell.exe
3008	powershell.exe
2800	powershell.exe
2624	powershell.exe
2788	powershell.exe
2620	powershell.exe
2692	powershell.exe
2756	powershell.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe
2184	OSPPSVC.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	2788	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	2184	OSPPSVC.exe
Token: SeDebugPrivilege	1164	OSPPSVC.exe
Token: SeDebugPrivilege	1792	OSPPSVC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2932	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	62
PID 2080 wrote to memory of 2932	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	62
PID 2080 wrote to memory of 2932	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	62
PID 2080 wrote to memory of 2904	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	63
PID 2080 wrote to memory of 2904	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	63
PID 2080 wrote to memory of 2904	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	63
PID 2080 wrote to memory of 2900	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	64
PID 2080 wrote to memory of 2900	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	64
PID 2080 wrote to memory of 2900	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	64
PID 2080 wrote to memory of 3020	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	66
PID 2080 wrote to memory of 3020	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	66
PID 2080 wrote to memory of 3020	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	66
PID 2080 wrote to memory of 2624	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	69
PID 2080 wrote to memory of 2624	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	69
PID 2080 wrote to memory of 2624	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	69
PID 2080 wrote to memory of 3008	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	70
PID 2080 wrote to memory of 3008	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	70
PID 2080 wrote to memory of 3008	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	70
PID 2080 wrote to memory of 2800	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	71
PID 2080 wrote to memory of 2800	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	71
PID 2080 wrote to memory of 2800	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	71
PID 2080 wrote to memory of 2756	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	72
PID 2080 wrote to memory of 2756	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	72
PID 2080 wrote to memory of 2756	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	72
PID 2080 wrote to memory of 2788	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	73
PID 2080 wrote to memory of 2788	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	73
PID 2080 wrote to memory of 2788	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	73
PID 2080 wrote to memory of 2620	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	74
PID 2080 wrote to memory of 2620	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	74
PID 2080 wrote to memory of 2620	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	74
PID 2080 wrote to memory of 2692	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	75
PID 2080 wrote to memory of 2692	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	75
PID 2080 wrote to memory of 2692	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	75
PID 2080 wrote to memory of 2168	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	77
PID 2080 wrote to memory of 2168	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	77
PID 2080 wrote to memory of 2168	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	77
PID 2080 wrote to memory of 1276	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	85
PID 2080 wrote to memory of 1276	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	85
PID 2080 wrote to memory of 1276	2080	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe	85
PID 1276 wrote to memory of 912	1276	cmd.exe	88
PID 1276 wrote to memory of 912	1276	cmd.exe	88
PID 1276 wrote to memory of 912	1276	cmd.exe	88
PID 1276 wrote to memory of 2184	1276	cmd.exe	89
PID 1276 wrote to memory of 2184	1276	cmd.exe	89
PID 1276 wrote to memory of 2184	1276	cmd.exe	89
PID 2184 wrote to memory of 2876	2184	OSPPSVC.exe	90
PID 2184 wrote to memory of 2876	2184	OSPPSVC.exe	90
PID 2184 wrote to memory of 2876	2184	OSPPSVC.exe	90
PID 2184 wrote to memory of 1976	2184	OSPPSVC.exe	91
PID 2184 wrote to memory of 1976	2184	OSPPSVC.exe	91
PID 2184 wrote to memory of 1976	2184	OSPPSVC.exe	91
PID 2876 wrote to memory of 1164	2876	WScript.exe	92
PID 2876 wrote to memory of 1164	2876	WScript.exe	92
PID 2876 wrote to memory of 1164	2876	WScript.exe	92
PID 1164 wrote to memory of 2672	1164	OSPPSVC.exe	93
PID 1164 wrote to memory of 2672	1164	OSPPSVC.exe	93
PID 1164 wrote to memory of 2672	1164	OSPPSVC.exe	93
PID 1164 wrote to memory of 1296	1164	OSPPSVC.exe	94
PID 1164 wrote to memory of 1296	1164	OSPPSVC.exe	94
PID 1164 wrote to memory of 1296	1164	OSPPSVC.exe	94
PID 2672 wrote to memory of 1792	2672	WScript.exe	95
PID 2672 wrote to memory of 1792	2672	WScript.exe	95
PID 2672 wrote to memory of 1792	2672	WScript.exe	95
PID 1792 wrote to memory of 2116	1792	OSPPSVC.exe	96

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
"C:\Users\Admin\AppData\Local\Temp\e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jbMX1aEz0O.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:912
- - C:\Program Files\Windows Journal\fr-FR\OSPPSVC.exe
    "C:\Program Files\Windows Journal\fr-FR\OSPPSVC.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2184
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\788d1607-da68-40c9-9cd8-2ea228774efa.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2876
    - - C:\Program Files\Windows Journal\fr-FR\OSPPSVC.exe
        
        "C:\Program Files\Windows Journal\fr-FR\OSPPSVC.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1164
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9441fdac-421b-4248-9a17-bc72ff7c2582.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Program Files\Windows Journal\fr-FR\OSPPSVC.exe
        
        "C:\Program Files\Windows Journal\fr-FR\OSPPSVC.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1792
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\85e8171f-6808-4d2c-9ebd-4bfd4dcc2c31.vbs"
        8⤵
        
        PID:2116
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\477ce2c5-810f-4948-a803-383ec170bf74.vbs"
        8⤵
        
        PID:1584
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8134de62-38ce-4f85-9014-360e74a15f1f.vbs"
        6⤵
        
        PID:1296
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31556778-6c76-456f-8476-6f06b0b0a203.vbs"
      4⤵
      PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Windows\Registration\CRMLog\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Windows\Registration\CRMLog\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Journal\fr-FR\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\fr-FR\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Journal\fr-FR\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Windows\Offline Web Pages\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Windows\Offline Web Pages\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Windows\DigitalLocker\es-ES\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\es-ES\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Windows\DigitalLocker\es-ES\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\LiveKernelReports\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Windows\LiveKernelReports\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\RemotePackages\RemoteDesktops\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteDesktops\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Windows\RemotePackages\RemoteDesktops\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\ja-JP\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\ja-JP\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\ja-JP\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Journal\fr-FR\OSPPSVC.exe

Filesize
5.9MB

MD5
7e2fbec8d8f1d05cadf8d90b0758f2f2

SHA1
f4ad7c455bd80e7c78bf1298b74ddf3ed44e3b1f

SHA256
886847154d435ac2d92a83b20593ca6f02da73d58d3a9ce831ac0044de5619af

SHA512
2bccdeeebf36f4bd6e2b870d6407528c996c85654155beb2cd78b428fc98604cf3836479cff3677ec5532107703bec21ba5d8ffb9a6d5447411b1f6dc9f4b443

Download Submit
C:\Users\Admin\AppData\Local\Temp\31556778-6c76-456f-8476-6f06b0b0a203.vbs

Filesize
502B

MD5
9cf3fee8561980be59bf4ddb47271e82

SHA1
c7fd1417ff80ea11e16b7aec865db5d75f5ce528

SHA256
42484d3c898589e3d749dab5e9a729aa1c22e87845026faaad598dba3e4e8c52

SHA512
4887e102b9421326e678f6330ccffd2b8318f9c424a433a182f33200dc7801c1e5fd3af976ee993780e485cdbbe2cc81877f38ce562d08543b2fcf3ca87609a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\788d1607-da68-40c9-9cd8-2ea228774efa.vbs

Filesize
726B

MD5
088e73abfb799bef9d126fa7f811cca7

SHA1
e319a319fcb6d0b52bd5a5ebc346df67ea101fea

SHA256
2d93187847c6081760a7a34df0ec3ec98e79aed7f7f6aa415fa3eb0985f52519

SHA512
9556a41df1ed7c3b8b6eb853549d4b64a0c68fbf9794b47a5645e640b19d7e2e7e31a8cb433a824bfb2411859d417519180aa7dd706e06e7b64a370e92d04716

Download Submit
C:\Users\Admin\AppData\Local\Temp\85e8171f-6808-4d2c-9ebd-4bfd4dcc2c31.vbs

Filesize
726B

MD5
734fc5547ab4a5bdeb2180590c49fc19

SHA1
773a4f9aeadadbf1420024393ece1e2e9def4bf7

SHA256
123a23a213e1f20fa91f72e82db2380ce86924e04833e3ca4fefbe1fe040a3d6

SHA512
7938729cdcda5f97c2aa89347d98b676ed1f71b4a247b996ba4c9d4ac57f592ab621e3df424cc16a09b47a008edf9b874c903b31593141f3e25666f2d767f43b

Download Submit
C:\Users\Admin\AppData\Local\Temp\9441fdac-421b-4248-9a17-bc72ff7c2582.vbs

Filesize
726B

MD5
df050a18abfe8d678d4649b78d2daa6c

SHA1
afad5c7847d4bef80d375e63db0e3e3d1b78f102

SHA256
984b45d5cc1fc7f528b6cca6c6b4ec482c9f62bb197f3d50573bafa4ce31465a

SHA512
17dad1574d27bc262a549b5d7f3c3b929827c031b807a5c1decbbbefbd5e3d31f9425cc13ff2affdfa6f97ec2617ddb1042ebdfccdee35e7cefaafd912cf15ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\jbMX1aEz0O.bat

Filesize
215B

MD5
d7eef8b2e2c63fc372901c22e78c6dc6

SHA1
c600620a197e56b804df1c4bb6263f2ea3eea6d2

SHA256
9de7983b03d696d3721ee629dbf379375078d946cbb3a7be521faff574da4abb

SHA512
c422d7bb348b1b5f78428da3058ee33a09ea0fc22c4c9234e8e8ea228689a2902e8119f2210d78361b843ceae77842f3feb85d8e90a2eec8ef758bc389a216c7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
9f7c83961cb0e376a3b5e432f058d875

SHA1
7a3344cfb601b3fd7b8ba32a9e0dda941801a92e

SHA256
e44670d0985b549bf56586a03b715fe410cd53369861d26139e47aa39a74d77a

SHA512
5ca2fa984e1ce8f4434df4c936f9279503c05f74cbc59118f787ab33ac0ce44c7db31499cbdaf53be349a34f6179a08e926399cd8efd67d69faca18da1de4c4a

Download Submit
C:\Windows\DigitalLocker\es-ES\lsm.exe

Filesize
5.9MB

MD5
1e36a4648b29e6f1e182d0db0c45a3be

SHA1
934d5fe30ed8233d77098f1214d07b0d009e5371

SHA256
e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7

SHA512
ec6ddc3da4d504bac611d61d0e294f74e1092ce0d6afc1e56641ec99b44237af1fcbce374b39eb1b8aaf9e57de5997bd6917b38e1a5cf5c34f44e93e089061b2

Download Submit
C:\Windows\LiveKernelReports\explorer.exe

Filesize
5.9MB

MD5
d05f72b1ae0addbb373359ee76942c78

SHA1
e28fb9ae4e434b2414f139c35b535de342f03307

SHA256
1b3748b581eeecde2d102388e8d6345f17b3ec4247a5ba4cb19265cdeab6ee91

SHA512
63e0c80d1c94df83fc92c7401eaa47b87871078eef03ba171ab5270d1e7892e9f7c1e748a835c2ec487d6558d2778bbb26bb692fe98dff382f250b14a8b3cc61

Download Submit
memory/1164-263-0x00000000012C0000-0x0000000001BB8000-memory.dmp

Filesize
9.0MB

Download
memory/2080-38-0x000000001B1E0000-0x000000001B1EA000-memory.dmp

Filesize
40KB

Download
memory/2080-31-0x000000001B070000-0x000000001B07A000-memory.dmp

Filesize
40KB

Download
memory/2080-15-0x0000000000AD0000-0x0000000000AE0000-memory.dmp

Filesize
64KB

Download
memory/2080-14-0x0000000000AC0000-0x0000000000AC8000-memory.dmp

Filesize
32KB

Download
memory/2080-12-0x0000000000AB0000-0x0000000000AC2000-memory.dmp

Filesize
72KB

Download
memory/2080-16-0x0000000000AE0000-0x0000000000AEA000-memory.dmp

Filesize
40KB

Download
memory/2080-17-0x00000000028A0000-0x00000000028F6000-memory.dmp

Filesize
344KB

Download
memory/2080-11-0x0000000000A90000-0x0000000000A98000-memory.dmp

Filesize
32KB

Download
memory/2080-23-0x0000000002980000-0x0000000002992000-memory.dmp

Filesize
72KB

Download
memory/2080-21-0x0000000002970000-0x0000000002978000-memory.dmp

Filesize
32KB

Download
memory/2080-24-0x0000000002990000-0x000000000299C000-memory.dmp

Filesize
48KB

Download
memory/2080-20-0x0000000002810000-0x000000000281C000-memory.dmp

Filesize
48KB

Download
memory/2080-28-0x000000001AFC0000-0x000000001AFCC000-memory.dmp

Filesize
48KB

Download
memory/2080-34-0x000000001B1A0000-0x000000001B1AE000-memory.dmp

Filesize
56KB

Download
memory/2080-39-0x000000001B1F0000-0x000000001B1FC000-memory.dmp

Filesize
48KB

Download
memory/2080-9-0x00000000004C0000-0x00000000004D0000-memory.dmp

Filesize
64KB

Download
memory/2080-37-0x000000001B1D0000-0x000000001B1D8000-memory.dmp

Filesize
32KB

Download
memory/2080-36-0x000000001B1C0000-0x000000001B1CC000-memory.dmp

Filesize
48KB

Download
memory/2080-35-0x000000001B1B0000-0x000000001B1B8000-memory.dmp

Filesize
32KB

Download
memory/2080-33-0x000000001B090000-0x000000001B098000-memory.dmp

Filesize
32KB

Download
memory/2080-32-0x000000001B080000-0x000000001B08E000-memory.dmp

Filesize
56KB

Download
memory/2080-13-0x0000000000AA0000-0x0000000000AAC000-memory.dmp

Filesize
48KB

Download
memory/2080-30-0x000000001AFD0000-0x000000001AFDC000-memory.dmp

Filesize
48KB

Download
memory/2080-29-0x000000001AFE0000-0x000000001AFE8000-memory.dmp

Filesize
32KB

Download
memory/2080-27-0x000000001AFB0000-0x000000001AFBC000-memory.dmp

Filesize
48KB

Download
memory/2080-26-0x000000001AFA0000-0x000000001AFA8000-memory.dmp

Filesize
32KB

Download
memory/2080-25-0x0000000002A00000-0x0000000002A0C000-memory.dmp

Filesize
48KB

Download
memory/2080-19-0x0000000002800000-0x0000000002808000-memory.dmp

Filesize
32KB

Download
memory/2080-18-0x00000000027F0000-0x00000000027FC000-memory.dmp

Filesize
48KB

Download
memory/2080-10-0x0000000000A70000-0x0000000000A86000-memory.dmp

Filesize
88KB

Download
memory/2080-8-0x0000000000480000-0x0000000000488000-memory.dmp

Filesize
32KB

Download
memory/2080-7-0x00000000004A0000-0x00000000004BC000-memory.dmp

Filesize
112KB

Download
memory/2080-6-0x0000000000470000-0x0000000000478000-memory.dmp

Filesize
32KB

Download
memory/2080-5-0x00000000003E0000-0x00000000003EE000-memory.dmp

Filesize
56KB

Download
memory/2080-208-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download
memory/2080-0-0x000007FEF52D3000-0x000007FEF52D4000-memory.dmp

Filesize
4KB

Download
memory/2080-1-0x0000000000AF0000-0x00000000013E8000-memory.dmp

Filesize
9.0MB

Download
memory/2080-2-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2080-3-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download
memory/2080-4-0x00000000003D0000-0x00000000003DE000-memory.dmp

Filesize
56KB

Download
memory/2184-252-0x0000000000F80000-0x0000000000FD6000-memory.dmp

Filesize
344KB

Download
memory/2184-250-0x00000000011C0000-0x0000000001AB8000-memory.dmp

Filesize
9.0MB

Download
memory/2904-196-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2904-199-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download