dcrat | 000996e02592d6f5216a77464baff2591739b5cb35a8ad930a5424c9099c7e11

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e48a47f400685a0d5ded8ad220d8f30.exe
Size

5.9MB
MD5

0e48a47f400685a0d5ded8ad220d8f30
SHA1

9e2de24fe28723727750f9e911fff325d74399bb
SHA256

8ef226d36414c628f71bebb9a7724dbbe58ed58d280a35a32f4550593baf8c2a
SHA512

66a3f552ae9cc6e4fc78ec683105a52b6f2ff4e7d8436438320a3e2332bb2ee0fc7ef61c909f8692137e7eccdcdcf3f898b810e18b64bc254dd08cb69ba77481
SSDEEP

98304:RyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw4G:RyeU11Rvqmu8TWKnF6N/1w3

Score

10^/10

dcrat defense_evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	696	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	696	schtasks.exe	30

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0e48a47f400685a0d5ded8ad220d8f30.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0e48a47f400685a0d5ded8ad220d8f30.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0e48a47f400685a0d5ded8ad220d8f30.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2876	powershell.exe
1740	powershell.exe
2952	powershell.exe
2924	powershell.exe
1060	powershell.exe
2668	powershell.exe
2648	powershell.exe
2460	powershell.exe
1616	powershell.exe
2684	powershell.exe
2276	powershell.exe
812	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	0e48a47f400685a0d5ded8ad220d8f30.exe

Executes dropped EXE 1 IoCs

pid	Process
2020	explorer.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0e48a47f400685a0d5ded8ad220d8f30.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0e48a47f400685a0d5ded8ad220d8f30.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2020	explorer.exe
2020	explorer.exe

Drops file in Program Files directory 40 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\1610b97d3ab4a7	0e48a47f400685a0d5ded8ad220d8f30.exe
File created	C:\Program Files\Java\jre7\42af1c969fbb7b	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\RCX90EE.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\RCXA6C2.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\RCXA933.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe
File created	C:\Program Files (x86)\Uninstall Information\winlogon.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\wininit.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Uninstall Information\RCXABB6.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Uninstall Information\winlogon.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\smss.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\69ddcba757bf72	0e48a47f400685a0d5ded8ad220d8f30.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\69ddcba757bf72	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files\Google\RCX9F9A.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\fr-FR\wininit.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File created	C:\Program Files (x86)\Uninstall Information\cc11b995f2a76d	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\RCXA934.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files\Google\RCX9F9B.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\smss.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File created	C:\Program Files\Java\jre7\audiodg.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File created	C:\Program Files\Google\b75386f1303e64	0e48a47f400685a0d5ded8ad220d8f30.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\OSPPSVC.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\smss.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Uninstall Information\RCXABB5.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files\Java\jre7\RCX9360.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\smss.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files\Java\jre7\audiodg.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\RCXA21C.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\RCXA6B1.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\fr-FR\RCXADCA.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe
File created	C:\Program Files\Google\taskhost.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\69ddcba757bf72	0e48a47f400685a0d5ded8ad220d8f30.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\56085415360792	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\RCX915C.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\OSPPSVC.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\fr-FR\RCXADC9.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files\Java\jre7\RCX93CE.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files\Google\taskhost.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\RCXA21B.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PolicyDefinitions\ja-JP\RCXB2BE.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Windows\PolicyDefinitions\ja-JP\smss.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File created	C:\Windows\PolicyDefinitions\ja-JP\smss.exe	0e48a47f400685a0d5ded8ad220d8f30.exe
File created	C:\Windows\PolicyDefinitions\ja-JP\69ddcba757bf72	0e48a47f400685a0d5ded8ad220d8f30.exe
File opened for modification	C:\Windows\PolicyDefinitions\ja-JP\RCXB2BD.tmp	0e48a47f400685a0d5ded8ad220d8f30.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1556	schtasks.exe
1504	schtasks.exe
2764	schtasks.exe
2068	schtasks.exe
2508	schtasks.exe
1040	schtasks.exe
1656	schtasks.exe
2008	schtasks.exe
900	schtasks.exe
984	schtasks.exe
2556	schtasks.exe
2784	schtasks.exe
2944	schtasks.exe
2988	schtasks.exe
2240	schtasks.exe
3048	schtasks.exe
888	schtasks.exe
1564	schtasks.exe
2452	schtasks.exe
1828	schtasks.exe
2036	schtasks.exe
2604	schtasks.exe
1032	schtasks.exe
1660	schtasks.exe
1856	schtasks.exe
1476	schtasks.exe
2464	schtasks.exe
1712	schtasks.exe
2656	schtasks.exe
1384	schtasks.exe
2992	schtasks.exe
2888	schtasks.exe
2296	schtasks.exe
1892	schtasks.exe
2188	schtasks.exe
1248	schtasks.exe
2232	schtasks.exe
812	schtasks.exe
1400	schtasks.exe
2000	schtasks.exe
2064	schtasks.exe
2856	schtasks.exe
2696	schtasks.exe
2776	schtasks.exe
1288	schtasks.exe
1816	schtasks.exe
1832	schtasks.exe
1648	schtasks.exe
1672	schtasks.exe
2388	schtasks.exe
2016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe
2924	powershell.exe
2648	powershell.exe
1060	powershell.exe
812	powershell.exe
2684	powershell.exe
2668	powershell.exe
2460	powershell.exe
1740	powershell.exe
2912	0e48a47f400685a0d5ded8ad220d8f30.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	0e48a47f400685a0d5ded8ad220d8f30.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	812	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	2020	explorer.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2924	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	82
PID 2912 wrote to memory of 2924	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	82
PID 2912 wrote to memory of 2924	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	82
PID 2912 wrote to memory of 1616	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	83
PID 2912 wrote to memory of 1616	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	83
PID 2912 wrote to memory of 1616	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	83
PID 2912 wrote to memory of 2952	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	85
PID 2912 wrote to memory of 2952	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	85
PID 2912 wrote to memory of 2952	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	85
PID 2912 wrote to memory of 2460	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	86
PID 2912 wrote to memory of 2460	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	86
PID 2912 wrote to memory of 2460	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	86
PID 2912 wrote to memory of 1740	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	88
PID 2912 wrote to memory of 1740	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	88
PID 2912 wrote to memory of 1740	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	88
PID 2912 wrote to memory of 2876	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	89
PID 2912 wrote to memory of 2876	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	89
PID 2912 wrote to memory of 2876	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	89
PID 2912 wrote to memory of 2648	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	91
PID 2912 wrote to memory of 2648	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	91
PID 2912 wrote to memory of 2648	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	91
PID 2912 wrote to memory of 812	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	93
PID 2912 wrote to memory of 812	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	93
PID 2912 wrote to memory of 812	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	93
PID 2912 wrote to memory of 2668	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	94
PID 2912 wrote to memory of 2668	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	94
PID 2912 wrote to memory of 2668	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	94
PID 2912 wrote to memory of 2276	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	95
PID 2912 wrote to memory of 2276	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	95
PID 2912 wrote to memory of 2276	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	95
PID 2912 wrote to memory of 2684	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	97
PID 2912 wrote to memory of 2684	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	97
PID 2912 wrote to memory of 2684	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	97
PID 2912 wrote to memory of 1060	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	98
PID 2912 wrote to memory of 1060	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	98
PID 2912 wrote to memory of 1060	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	98
PID 2912 wrote to memory of 2020	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	106
PID 2912 wrote to memory of 2020	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	106
PID 2912 wrote to memory of 2020	2912	0e48a47f400685a0d5ded8ad220d8f30.exe	106

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0e48a47f400685a0d5ded8ad220d8f30.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0e48a47f400685a0d5ded8ad220d8f30.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0e48a47f400685a0d5ded8ad220d8f30.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0e48a47f400685a0d5ded8ad220d8f30.exe
"C:\Users\Admin\AppData\Local\Temp\0e48a47f400685a0d5ded8ad220d8f30.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1060
- C:\Users\Admin\AppData\LocalLow\Sun\Java\explorer.exe
  "C:\Users\Admin\AppData\LocalLow\Sun\Java\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jre7\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jre7\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "0e48a47f400685a0d5ded8ad220d8f300" /sc MINUTE /mo 9 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\0e48a47f400685a0d5ded8ad220d8f30.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "0e48a47f400685a0d5ded8ad220d8f30" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\0e48a47f400685a0d5ded8ad220d8f30.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "0e48a47f400685a0d5ded8ad220d8f300" /sc MINUTE /mo 5 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\0e48a47f400685a0d5ded8ad220d8f30.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Google\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\LocalLow\Sun\Java\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\AppData\LocalLow\Sun\Java\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\LocalLow\Sun\Java\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Uninstall Information\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Uninstall Information\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\PolicyDefinitions\ja-JP\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\ja-JP\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\PolicyDefinitions\ja-JP\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\RCX9D29.tmp

Filesize
5.9MB

MD5
4ca80192bb14201d0772e7035af39f1e

SHA1
c7d2a36f045ab0c067fd9d3f63d9bd9822f8744e

SHA256
1de83bfdd84eb8d390ae43e0455648e8646fb4bc90ee913b2b4b0d45b001737b

SHA512
835c298e7283e8abe48d2f577b961781e0ebcd5c1d86b0f0f6adc3b58fec008dd10716b3133d15a80bde76b3feeef1485c4aa0095db0089b40287222772efc0c

Download Submit
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\smss.exe

Filesize
5.9MB

MD5
94dd6fb0a775b4a42d9e812a51326b00

SHA1
3c20ea710855f21fd161a508290cb23fe619266d

SHA256
fbe904e3b00532af1b24729488a73ab809c475ac322e5d8243289b2ec66b3db8

SHA512
82944c2b4bc239af66697aa403e30fb30dab3dfe652e5fd6430cda43c154f8b7482337313fed8ab2ba912ca2d9e443ec26778cf518b2cedc9fb4bde28ff60b9f

Download Submit
C:\Program Files\Java\jre7\audiodg.exe

Filesize
5.9MB

MD5
93f4545fc0b8a5daccb9e5b18e6d08f6

SHA1
b23b56d14d3414ceeabfa87d91e3edf1b8427a19

SHA256
eadbf484544fe53dc11b0819a922de5ab7f7e258901efbf023e56406b4bef43c

SHA512
1af698bf2ed66ee6a21fbe2e32d0e10298a326672e75e19422769f81f34dc7d2f9d61898fe72a88ca3faaafa628cde010755e9964a3324afe3357e9c4c08f9fd

Download Submit
C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\smss.exe

Filesize
5.9MB

MD5
0e48a47f400685a0d5ded8ad220d8f30

SHA1
9e2de24fe28723727750f9e911fff325d74399bb

SHA256
8ef226d36414c628f71bebb9a7724dbbe58ed58d280a35a32f4550593baf8c2a

SHA512
66a3f552ae9cc6e4fc78ec683105a52b6f2ff4e7d8436438320a3e2332bb2ee0fc7ef61c909f8692137e7eccdcdcf3f898b810e18b64bc254dd08cb69ba77481

Download Submit
C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\spoolsv.exe

Filesize
5.9MB

MD5
8fbfd20af5e4a5454de209bcdf34b0ab

SHA1
d8ee6ed1b1d8dcc39e118212a030dff43f7e7fca

SHA256
fc3593f7e3c3a809160e9a88cb55dcb4372438a84dd00f8d00c2f9cf6d3e904e

SHA512
508343cdae26d16ce412a32fc84ea8ea573e1d282a23837851dc79e55c930a95b76ceee6dae4c6d944a3aac4a8ca15bc170905bc4d73f97d9e86ce32e8996a3a

Download Submit
C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\sppsvc.exe

Filesize
5.9MB

MD5
f17807895c5b14035a381021dc3c186d

SHA1
d0954fd52a003d40cf7c150a045ba3df1aed6132

SHA256
539e3ecc7f020fa445eabeaf72678bd7866abf5d6537cc6bd5dd4e12555c8657

SHA512
bda18699a48d7b7d719bf59781c47324a2070935bed104b74694785d94cb6316e7251eed5defc93931148d4cc8428196e96b81b754fb3c0faa39d6f9c9541e0c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e1b368bdfa759e0247a3c41fbc39ccd4

SHA1
b65e3d52f571b8c83a207778a34190606d0505de

SHA256
5338f2cc170673d2a1644ad392f6aba7a3749843909d74dfc8a2467d0aadb7b4

SHA512
80545aa45725c1f9ddfef29d1f056e74c9add8f7822ff6d5ea7b69c9be1b0623306b5a63e74565f242ce07a1760b906c99c8baf61b58374893ff51b4bd7b4d25

Download Submit
memory/2020-344-0x00000000027D0000-0x00000000027E2000-memory.dmp

Filesize
72KB

Download
memory/2020-341-0x0000000000230000-0x0000000000B28000-memory.dmp

Filesize
9.0MB

Download
memory/2648-300-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2912-34-0x000000001B9B0000-0x000000001B9BE000-memory.dmp

Filesize
56KB

Download
memory/2912-28-0x000000001B430000-0x000000001B43C000-memory.dmp

Filesize
48KB

Download
memory/2912-6-0x0000000000570000-0x0000000000578000-memory.dmp

Filesize
32KB

Download
memory/2912-12-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/2912-13-0x0000000002750000-0x000000000275C000-memory.dmp

Filesize
48KB

Download
memory/2912-16-0x0000000002900000-0x000000000290A000-memory.dmp

Filesize
40KB

Download
memory/2912-18-0x0000000002910000-0x000000000291C000-memory.dmp

Filesize
48KB

Download
memory/2912-23-0x0000000002A40000-0x0000000002A52000-memory.dmp

Filesize
72KB

Download
memory/2912-24-0x0000000002A50000-0x0000000002A5C000-memory.dmp

Filesize
48KB

Download
memory/2912-27-0x000000001B420000-0x000000001B42C000-memory.dmp

Filesize
48KB

Download
memory/2912-30-0x000000001B590000-0x000000001B59C000-memory.dmp

Filesize
48KB

Download
memory/2912-38-0x000000001B9F0000-0x000000001B9FA000-memory.dmp

Filesize
40KB

Download
memory/2912-39-0x000000001BA00000-0x000000001BA0C000-memory.dmp

Filesize
48KB

Download
memory/2912-37-0x000000001B9E0000-0x000000001B9E8000-memory.dmp

Filesize
32KB

Download
memory/2912-36-0x000000001B9D0000-0x000000001B9DC000-memory.dmp

Filesize
48KB

Download
memory/2912-35-0x000000001B9C0000-0x000000001B9C8000-memory.dmp

Filesize
32KB

Download
memory/2912-4-0x0000000000350000-0x000000000035E000-memory.dmp

Filesize
56KB

Download
memory/2912-33-0x000000001B9A0000-0x000000001B9A8000-memory.dmp

Filesize
32KB

Download
memory/2912-32-0x000000001B630000-0x000000001B63E000-memory.dmp

Filesize
56KB

Download
memory/2912-31-0x000000001B620000-0x000000001B62A000-memory.dmp

Filesize
40KB

Download
memory/2912-29-0x000000001B540000-0x000000001B548000-memory.dmp

Filesize
32KB

Download
memory/2912-7-0x0000000000590000-0x00000000005AC000-memory.dmp

Filesize
112KB

Download
memory/2912-26-0x000000001B410000-0x000000001B418000-memory.dmp

Filesize
32KB

Download
memory/2912-25-0x000000001B400000-0x000000001B40C000-memory.dmp

Filesize
48KB

Download
memory/2912-21-0x0000000002940000-0x0000000002948000-memory.dmp

Filesize
32KB

Download
memory/2912-20-0x0000000002930000-0x000000000293C000-memory.dmp

Filesize
48KB

Download
memory/2912-19-0x0000000002920000-0x0000000002928000-memory.dmp

Filesize
32KB

Download
memory/2912-17-0x000000001AFC0000-0x000000001B016000-memory.dmp

Filesize
344KB

Download
memory/2912-15-0x00000000028F0000-0x0000000002900000-memory.dmp

Filesize
64KB

Download
memory/2912-14-0x0000000002730000-0x0000000002738000-memory.dmp

Filesize
32KB

Download
memory/2912-11-0x0000000000A20000-0x0000000000A28000-memory.dmp

Filesize
32KB

Download
memory/2912-10-0x0000000000A00000-0x0000000000A16000-memory.dmp

Filesize
88KB

Download
memory/2912-9-0x00000000009F0000-0x0000000000A00000-memory.dmp

Filesize
64KB

Download
memory/2912-8-0x00000000009E0000-0x00000000009E8000-memory.dmp

Filesize
32KB

Download
memory/2912-177-0x000007FEF5003000-0x000007FEF5004000-memory.dmp

Filesize
4KB

Download
memory/2912-5-0x0000000000360000-0x000000000036E000-memory.dmp

Filesize
56KB

Download
memory/2912-3-0x000007FEF5000000-0x000007FEF59EC000-memory.dmp

Filesize
9.9MB

Download
memory/2912-2-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2912-215-0x000007FEF5000000-0x000007FEF59EC000-memory.dmp

Filesize
9.9MB

Download
memory/2912-0-0x000007FEF5003000-0x000007FEF5004000-memory.dmp

Filesize
4KB

Download
memory/2912-1-0x0000000000A30000-0x0000000001328000-memory.dmp

Filesize
9.0MB

Download
memory/2912-342-0x000007FEF5000000-0x000007FEF59EC000-memory.dmp

Filesize
9.9MB

Download
memory/2924-289-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download