dcrat | 760f5ddd00760be411967d77224b29a48e00e1eed0e978ba4017979595d1637e

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64402f0d8e48be50cf9751b33f85d1c0.exe
Size

5.9MB
MD5

64402f0d8e48be50cf9751b33f85d1c0
SHA1

4f8de3bc5101be29cd10a767de05a8d2dc3c6988
SHA256

3ce38013669a1e91dc5222723bfc954c695fc08a3efa33bbe99076a9608efc64
SHA512

6e697cd890a95e87761ab0ac6e818a90980d1a0d2e80e03d77d29888a852d671e82210f05b0adba780db46be4f7af966eb2abf7372972ccfaf7355a8f7e651f7
SSDEEP

98304:xyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw4C:xyeU11Rvqmu8TWKnF6N/1wb

Score

10^/10

dcrat defense_evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4176	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4260	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4740	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4116	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5300	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	472	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1124	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3080	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5644	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6064	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5848	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3864	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5484	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4640	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	4584	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6100	4584	schtasks.exe	88

UAC bypass 3 TTPs 12 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	64402f0d8e48be50cf9751b33f85d1c0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	64402f0d8e48be50cf9751b33f85d1c0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	64402f0d8e48be50cf9751b33f85d1c0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2332	powershell.exe
3492	powershell.exe
3084	powershell.exe
1008	powershell.exe
3720	powershell.exe
3468	powershell.exe
2424	powershell.exe
1776	powershell.exe
1632	powershell.exe
2224	powershell.exe
4812	powershell.exe
5192	powershell.exe
1300	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	64402f0d8e48be50cf9751b33f85d1c0.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	64402f0d8e48be50cf9751b33f85d1c0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 3 IoCs

pid	Process
1672	dllhost.exe
6020	dllhost.exe
5352	dllhost.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	64402f0d8e48be50cf9751b33f85d1c0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	64402f0d8e48be50cf9751b33f85d1c0.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
1672	dllhost.exe
1672	dllhost.exe
6020	dllhost.exe
6020	dllhost.exe
5352	dllhost.exe
5352	dllhost.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\RCX8A3A.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\RCX931A.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\edge_BITS_4600_846981562\csrss.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Program Files\Windows Defender\en-US\f3b6ecef712a24	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\RCX932B.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\edge_BITS_4600_846981562\RCX9CA7.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Program Files\edge_BITS_4764_811068770\fontdrvhost.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Program Files\edge_BITS_4764_811068770\5b884080fd4f94	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\dwm.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\Idle.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\6ccacd8608530f	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Program Files\edge_BITS_4600_846981562\csrss.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\edge_BITS_4764_811068770\RCX8515.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\edge_BITS_4764_811068770\fontdrvhost.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Program Files\Windows Defender\en-US\spoolsv.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\dwm.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\spoolsv.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\RCX97F1.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\RCX987E.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\Idle.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\edge_BITS_4600_846981562\RCX9C96.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6cb0b6c459d5d3	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Program Files\edge_BITS_4600_846981562\886983d96e3d3e	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\edge_BITS_4764_811068770\RCX8505.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\RCX8A29.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\CbsTemp\RCX809C.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Windows\CbsTemp\RCX80AC.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Windows\CbsTemp\RuntimeBroker.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Windows\CbsTemp\RuntimeBroker.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Windows\CbsTemp\9e8d7a4ca61bd9	64402f0d8e48be50cf9751b33f85d1c0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	64402f0d8e48be50cf9751b33f85d1c0.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
868	schtasks.exe
1920	schtasks.exe
3984	schtasks.exe
5484	schtasks.exe
1732	schtasks.exe
4176	schtasks.exe
2680	schtasks.exe
472	schtasks.exe
3864	schtasks.exe
4712	schtasks.exe
4640	schtasks.exe
4616	schtasks.exe
4260	schtasks.exe
5300	schtasks.exe
1124	schtasks.exe
5116	schtasks.exe
892	schtasks.exe
3948	schtasks.exe
3588	schtasks.exe
1172	schtasks.exe
5848	schtasks.exe
4824	schtasks.exe
6100	schtasks.exe
1676	schtasks.exe
1704	schtasks.exe
552	schtasks.exe
1760	schtasks.exe
856	schtasks.exe
4996	schtasks.exe
2876	schtasks.exe
5056	schtasks.exe
6064	schtasks.exe
3080	schtasks.exe
5644	schtasks.exe
3228	schtasks.exe
4732	schtasks.exe
4960	schtasks.exe
4636	schtasks.exe
4596	schtasks.exe
4740	schtasks.exe
4116	schtasks.exe
5032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
2224	powershell.exe
2224	powershell.exe
3928	64402f0d8e48be50cf9751b33f85d1c0.exe
1300	powershell.exe
1300	powershell.exe
1776	powershell.exe
1776	powershell.exe
3492	powershell.exe
3492	powershell.exe
3720	powershell.exe
1008	powershell.exe
3720	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	3928	64402f0d8e48be50cf9751b33f85d1c0.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	3492	powershell.exe
Token: SeDebugPrivilege	3720	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	4812	powershell.exe
Token: SeDebugPrivilege	3084	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	3468	powershell.exe
Token: SeDebugPrivilege	5192	powershell.exe
Token: SeDebugPrivilege	1672	dllhost.exe
Token: SeDebugPrivilege	6020	dllhost.exe
Token: SeDebugPrivilege	5352	dllhost.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 3492	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	135
PID 3928 wrote to memory of 3492	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	135
PID 3928 wrote to memory of 2332	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	136
PID 3928 wrote to memory of 2332	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	136
PID 3928 wrote to memory of 2224	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	137
PID 3928 wrote to memory of 2224	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	137
PID 3928 wrote to memory of 1632	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	138
PID 3928 wrote to memory of 1632	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	138
PID 3928 wrote to memory of 1776	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	139
PID 3928 wrote to memory of 1776	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	139
PID 3928 wrote to memory of 2424	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	141
PID 3928 wrote to memory of 2424	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	141
PID 3928 wrote to memory of 1300	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	142
PID 3928 wrote to memory of 1300	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	142
PID 3928 wrote to memory of 3468	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	144
PID 3928 wrote to memory of 3468	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	144
PID 3928 wrote to memory of 3720	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	145
PID 3928 wrote to memory of 3720	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	145
PID 3928 wrote to memory of 5192	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	146
PID 3928 wrote to memory of 5192	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	146
PID 3928 wrote to memory of 1008	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	147
PID 3928 wrote to memory of 1008	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	147
PID 3928 wrote to memory of 3084	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	149
PID 3928 wrote to memory of 3084	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	149
PID 3928 wrote to memory of 4812	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	150
PID 3928 wrote to memory of 4812	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	150
PID 3928 wrote to memory of 4712	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	161
PID 3928 wrote to memory of 4712	3928	64402f0d8e48be50cf9751b33f85d1c0.exe	161
PID 4712 wrote to memory of 1180	4712	cmd.exe	163
PID 4712 wrote to memory of 1180	4712	cmd.exe	163
PID 4712 wrote to memory of 1672	4712	cmd.exe	166
PID 4712 wrote to memory of 1672	4712	cmd.exe	166
PID 1672 wrote to memory of 436	1672	dllhost.exe	167
PID 1672 wrote to memory of 436	1672	dllhost.exe	167
PID 1672 wrote to memory of 4168	1672	dllhost.exe	168
PID 1672 wrote to memory of 4168	1672	dllhost.exe	168
PID 436 wrote to memory of 6020	436	WScript.exe	177
PID 436 wrote to memory of 6020	436	WScript.exe	177
PID 6020 wrote to memory of 3020	6020	dllhost.exe	178
PID 6020 wrote to memory of 3020	6020	dllhost.exe	178
PID 6020 wrote to memory of 4104	6020	dllhost.exe	179
PID 6020 wrote to memory of 4104	6020	dllhost.exe	179
PID 3020 wrote to memory of 5352	3020	WScript.exe	181
PID 3020 wrote to memory of 5352	3020	WScript.exe	181
PID 5352 wrote to memory of 2196	5352	dllhost.exe	182
PID 5352 wrote to memory of 2196	5352	dllhost.exe	182
PID 5352 wrote to memory of 4308	5352	dllhost.exe	183
PID 5352 wrote to memory of 4308	5352	dllhost.exe	183

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	64402f0d8e48be50cf9751b33f85d1c0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	64402f0d8e48be50cf9751b33f85d1c0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	64402f0d8e48be50cf9751b33f85d1c0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\64402f0d8e48be50cf9751b33f85d1c0.exe
"C:\Users\Admin\AppData\Local\Temp\64402f0d8e48be50cf9751b33f85d1c0.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/60739cf6f660743813/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/900323d723f1dd1206/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L6whRu2F84.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1180
- - C:\60739cf6f660743813\dllhost.exe
    "C:\60739cf6f660743813\dllhost.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1672
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0cc087a8-dd5f-4584-b583-0c0460441479.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:436
    - - C:\60739cf6f660743813\dllhost.exe
        
        C:\60739cf6f660743813\dllhost.exe
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:6020
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f7b7412f-afc8-4cec-a14c-f8674f48d6ad.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\60739cf6f660743813\dllhost.exe
        
        C:\60739cf6f660743813\dllhost.exe
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:5352
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ead176d-21ac-4d70-8046-fc724fd7887b.vbs"
        8⤵
        
        PID:2196
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05793560-61b8-4292-941a-e9cf9ec17eac.vbs"
        8⤵
        
        PID:4308
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6405b76e-5ec6-414a-8c09-9e74c76677d7.vbs"
        6⤵
        
        PID:4104
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d5c7ee1f-8887-491e-a34a-652cc43714e5.vbs"
      4⤵
      PID:4168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files\edge_BITS_4764_811068770\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4764_811068770\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\edge_BITS_4764_811068770\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\900323d723f1dd1206\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\900323d723f1dd1206\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\900323d723f1dd1206\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\60739cf6f660743813\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\60739cf6f660743813\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\60739cf6f660743813\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\60739cf6f660743813\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\60739cf6f660743813\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\60739cf6f660743813\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\en-US\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\en-US\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\en-US\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\900323d723f1dd1206\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\900323d723f1dd1206\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\900323d723f1dd1206\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\edge_BITS_4600_846981562\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4600_846981562\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\edge_BITS_4600_846981562\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\900323d723f1dd1206\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\900323d723f1dd1206\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\900323d723f1dd1206\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\900323d723f1dd1206\sihost.exe

Filesize
5.9MB

MD5
786b1c7602b19d4ca0c21269723bb969

SHA1
8fa17a0ab7b0dc56b0162eed54874f0d93144de9

SHA256
492facedad5a024203bdba33a4fd31269b2b5c9ffbfd0f40ff6fc3ac9414e6b6

SHA512
b82be40e4855089c0daa58e56f8b63744eb314b7111bfdfa6cd26cbb723892dfc187b6a8fd21459b132f4bb28141c57e08c2cd843c80ff1e48ba0cefeed2ed05

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\dwm.exe

Filesize
5.9MB

MD5
64402f0d8e48be50cf9751b33f85d1c0

SHA1
4f8de3bc5101be29cd10a767de05a8d2dc3c6988

SHA256
3ce38013669a1e91dc5222723bfc954c695fc08a3efa33bbe99076a9608efc64

SHA512
6e697cd890a95e87761ab0ac6e818a90980d1a0d2e80e03d77d29888a852d671e82210f05b0adba780db46be4f7af966eb2abf7372972ccfaf7355a8f7e651f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
229da4b4256a6a948830de7ee5f9b298

SHA1
8118b8ddc115689ca9dc2fe8c244350333c5ba8b

SHA256
3d63b4a66e80ed97a8d74ea9dee7645942aafbd4abf1b31afed1027e5967fe11

SHA512
3a4ec8f720000a32bb1555b32db13236a73bb6e654e35b4de8bdb0fc0de535584bc08ebe25c7066324e86faa33e8f571a11cc4e5ef00be78e2993e228f615224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
a43e653ffb5ab07940f4bdd9cc8fade4

SHA1
af43d04e3427f111b22dc891c5c7ee8a10ac4123

SHA256
c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe

SHA512
62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
47d9df7fab0d0c96afdd2ca49f2b5030

SHA1
92583883bcf376062ddef5db2333f066d8d36612

SHA256
0f244dd39698dace2c650435886b1175ea01131e581d6c13888576c07fa40b02

SHA512
1844ce4f35849b70c246127482040986caa1bbae2d81119c77e9841f2a3280aabae0ad0db52fc29fe48023b4f4c073fe759b1f54e70e1562289d5e349c015200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a16aff60eb3c3e35753a259b050c8a27

SHA1
85196d5dfb23d0c8b32b186325e2d58315a11287

SHA256
a057f85fa5358fac25f1337c1fbabeffb1ca1908b352208038293ec575dfc206

SHA512
13e6514cddaafba8f4fe3b08f6d6e118823ad454aac4efcb71a82438de50f97cd9570f44d594db27e4c534912a12ed066ea098b95505a6994f854f8349f2f5b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
fdbc304f3d894fc63c481c99aa258017

SHA1
47cd3a7cae4dbf6bdd92532bbb69224a75221b86

SHA256
58c02d17c622f9ffc1744d26a3be409d7a95796119bcea540e54dcf687c8abb3

SHA512
18923c6b620a47d59377bdffd8dbf9717750a52980530cd67c169704649e471b1583eda2045cc7db84e560a9672759f8ea0c3a5ab45d4f328e17aa6e0ca5fae1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0c3cddab7d289f65843ac7ee436ff50d

SHA1
19046a0dc416df364c3be08b72166becf7ed9ca9

SHA256
c94ea9a9d0877a48ade47f77733be15871512f7aded45a211eb636bdcf7e45a1

SHA512
45c710a959f67ed05c25709c24887a4d5e5909e94f2012bd1cad64b32729fafea6f6628b2552f36c9d98bf8a1ddf50bb84d92d6e1cb15f20b2a74739ff19c9ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9ec1de5af22ee94e2a00a91da98957bd

SHA1
0ade5098be757a47adb6d5d0dbf576bcf41d6253

SHA256
540ab5c28d94cbbe9c9bf5334eb8dd7e203b7c4aa5c6f195f95fe64965f1ed76

SHA512
8c2242c22a8c2baa92e2ec47fd29447caa709093ed4ff6ee459f8f438c193bc0cb9f5baaf113696c63227f7a67462214236703569689f50272a6f37f5f63452b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5224a8af64b17b8a36247f8bda22bc94

SHA1
841edc986867d9813534b217790e76b017c48617

SHA256
464cb1185c4ac036587a0583565205a60a9d67c6130ac6bf3e666d197a79aa55

SHA512
041d2827788aa8b7f3320b013380d74cc12a444adcf587ef8dfcbb52353548abf1746f34e33f0bfb6117ed488e85d9f8e0bfffbf79011546199ee371e192fdde

Download Submit
C:\Users\Admin\AppData\Local\Temp\0cc087a8-dd5f-4584-b583-0c0460441479.vbs

Filesize
709B

MD5
3a31d224936ce6aa7062831396ade8a2

SHA1
f9cebc49594e626b701b26d7fb212cea0dbea8bb

SHA256
289d34ddbde06ffa7fbb1414ef8345035d4a6c3e1280c565211daa7d46ac3b49

SHA512
9ebca0bb52e1afc0fe0c8813592ddfc7a76707d9b4f5a6d2eb24364e390dfba5d8c1105a3c9d6021b52e847ab15586a0281acd97f12f8f34458bbb7634720c38

Download Submit
C:\Users\Admin\AppData\Local\Temp\4ead176d-21ac-4d70-8046-fc724fd7887b.vbs

Filesize
709B

MD5
b68f460f09c785fa6683fccf5206c84d

SHA1
ce38520bab1e16a5e0ca0844425afced2c0c82dd

SHA256
8e7c5d965c329458ad49d1cfe7fde9742c0edef42524e21237eb74b9fa0cc3ad

SHA512
c7ff90091de600e8811efc66f8525d0bd529a36b1282241d95d2cb6ec04ed480eeb61bf7f458c8870620f9a26563ebabee0749b626ecb160a9fb8134aee8ffe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\L6whRu2F84.bat

Filesize
198B

MD5
2b09644e7371387e4bae8d66eea74f6b

SHA1
bb3fdc54660b524e8397a15f3e58bd103918b4f9

SHA256
0ca515496f7c042dd0600d16103a617934997af4ce13cf891d371e8ba0fb12c4

SHA512
e5e1e961e1c00fb245865692bbee710cce366e5dcb01f1a9b89fb95386e9a912a4dfc8c3aba695c92f435520886f24d13118274141179c727a4fc4be7ded6ee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2n3qctfd.xhc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\d5c7ee1f-8887-491e-a34a-652cc43714e5.vbs

Filesize
485B

MD5
5eb3cfe8839d9c9461e9429310117dfb

SHA1
c988eb6615d864f7fcbc23db03f48b9c15c8b173

SHA256
33366fa7803e99e391eebf2d9ba9bce7a3e3b4c8ba86fdd8e1fda8cde68c22f5

SHA512
b306af4c610714d276e95f137ffeb9f6abb70ca34bb78d20c99140369c0936b2d487da90f7fc31f787255b9ed6c155fda2c6f2646082a4fca1b060bc6d9fd931

Download Submit
C:\Users\Admin\AppData\Local\Temp\f7b7412f-afc8-4cec-a14c-f8674f48d6ad.vbs

Filesize
709B

MD5
06cad988cab0d0a92a08e56ac8496487

SHA1
17093efe6c70a5ca551486d0ed21e0d10d36acf9

SHA256
395d805c9eefee2ff48d2434a58f55f13f57c838d647a9fc0f90f159ca2a7dfa

SHA512
82622de309131519da14c9a1d7523c168528bc95ff6b3e59b4d1de5753001fd2afb66c861a0d29f4cc022f72295029c56f99362c86b4ee6eecee80aa48e33df0

Download Submit
memory/1776-260-0x0000019127AB0000-0x0000019127AD2000-memory.dmp

Filesize
136KB

Download
memory/3928-22-0x000000001C170000-0x000000001C178000-memory.dmp

Filesize
32KB

Download
memory/3928-7-0x0000000002C80000-0x0000000002C9C000-memory.dmp

Filesize
112KB

Download
memory/3928-39-0x000000001C490000-0x000000001C498000-memory.dmp

Filesize
32KB

Download
memory/3928-38-0x000000001C260000-0x000000001C26C000-memory.dmp

Filesize
48KB

Download
memory/3928-37-0x000000001C250000-0x000000001C258000-memory.dmp

Filesize
32KB

Download
memory/3928-35-0x000000001C230000-0x000000001C238000-memory.dmp

Filesize
32KB

Download
memory/3928-34-0x000000001C220000-0x000000001C22E000-memory.dmp

Filesize
56KB

Download
memory/3928-33-0x000000001C210000-0x000000001C21A000-memory.dmp

Filesize
40KB

Download
memory/3928-31-0x000000001C480000-0x000000001C488000-memory.dmp

Filesize
32KB

Download
memory/3928-30-0x000000001C1F0000-0x000000001C1FC000-memory.dmp

Filesize
48KB

Download
memory/3928-28-0x000000001C1D0000-0x000000001C1D8000-memory.dmp

Filesize
32KB

Download
memory/3928-27-0x000000001C1C0000-0x000000001C1CC000-memory.dmp

Filesize
48KB

Download
memory/3928-25-0x000000001C7B0000-0x000000001CCD8000-memory.dmp

Filesize
5.2MB

Download
memory/3928-0-0x00007FFAB59B3000-0x00007FFAB59B5000-memory.dmp

Filesize
8KB

Download
memory/3928-21-0x000000001C270000-0x000000001C27C000-memory.dmp

Filesize
48KB

Download
memory/3928-20-0x000000001C160000-0x000000001C168000-memory.dmp

Filesize
32KB

Download
memory/3928-17-0x000000001C0F0000-0x000000001C0FA000-memory.dmp

Filesize
40KB

Download
memory/3928-15-0x000000001B6F0000-0x000000001B6F8000-memory.dmp

Filesize
32KB

Download
memory/3928-14-0x000000001B6E0000-0x000000001B6EC000-memory.dmp

Filesize
48KB

Download
memory/3928-12-0x0000000002CC0000-0x0000000002CC8000-memory.dmp

Filesize
32KB

Download
memory/3928-11-0x000000001B6B0000-0x000000001B6C6000-memory.dmp

Filesize
88KB

Download
memory/3928-9-0x0000000002CA0000-0x0000000002CA8000-memory.dmp

Filesize
32KB

Download
memory/3928-8-0x000000001B700000-0x000000001B750000-memory.dmp

Filesize
320KB

Download
memory/3928-40-0x000000001C5A0000-0x000000001C5AA000-memory.dmp

Filesize
40KB

Download
memory/3928-6-0x0000000002C70000-0x0000000002C78000-memory.dmp

Filesize
32KB

Download
memory/3928-5-0x0000000002B50000-0x0000000002B5E000-memory.dmp

Filesize
56KB

Download
memory/3928-202-0x00007FFAB59B3000-0x00007FFAB59B5000-memory.dmp

Filesize
8KB

Download
memory/3928-217-0x00007FFAB59B0000-0x00007FFAB6471000-memory.dmp

Filesize
10.8MB

Download
memory/3928-41-0x000000001C4A0000-0x000000001C4AC000-memory.dmp

Filesize
48KB

Download
memory/3928-245-0x00007FFAB59B0000-0x00007FFAB6471000-memory.dmp

Filesize
10.8MB

Download
memory/3928-36-0x000000001C240000-0x000000001C24E000-memory.dmp

Filesize
56KB

Download
memory/3928-32-0x000000001C200000-0x000000001C20C000-memory.dmp

Filesize
48KB

Download
memory/3928-29-0x000000001C1E0000-0x000000001C1EC000-memory.dmp

Filesize
48KB

Download
memory/3928-26-0x000000001C1B0000-0x000000001C1BC000-memory.dmp

Filesize
48KB

Download
memory/3928-24-0x000000001C180000-0x000000001C192000-memory.dmp

Filesize
72KB

Download
memory/3928-19-0x000000001C150000-0x000000001C15C000-memory.dmp

Filesize
48KB

Download
memory/3928-18-0x000000001C100000-0x000000001C156000-memory.dmp

Filesize
344KB

Download
memory/3928-16-0x000000001C0E0000-0x000000001C0F0000-memory.dmp

Filesize
64KB

Download
memory/3928-13-0x000000001B6D0000-0x000000001B6E2000-memory.dmp

Filesize
72KB

Download
memory/3928-10-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Filesize
64KB

Download
memory/3928-4-0x0000000001300000-0x000000000130E000-memory.dmp

Filesize
56KB

Download
memory/3928-3-0x00007FFAB59B0000-0x00007FFAB6471000-memory.dmp

Filesize
10.8MB

Download
memory/3928-1-0x0000000000140000-0x0000000000A38000-memory.dmp

Filesize
9.0MB

Download
memory/3928-2-0x00000000012C0000-0x00000000012C1000-memory.dmp

Filesize
4KB

Download
memory/5352-411-0x000000001C4B0000-0x000000001C4C2000-memory.dmp

Filesize
72KB

Download
memory/6020-398-0x000000001BEA0000-0x000000001BEB2000-memory.dmp

Filesize
72KB

Download