dcrat | 189c456c653e587b81b4f3950b102a94c4570c2a7057c50b138b511162a2c46a

Analysis

max time kernel
94s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
Size

5.9MB
MD5

89ed231ad61a9e5a7fd0ab9f2bd75b9a
SHA1

9fef3b04fdadf7c3bc756603d55d26c6d77a9f9d
SHA256

403dbebad41f7ff4bc9292290673b4dc3cce92f06d0f710c674f315f6e8caae8
SHA512

50ee7cfba3b046d677c9aaa853ec100ed2b4b24c4c045212c2eada4caed628ea7771fd0a8b47cb03c266a300df34b5f3b9714e68fdec6229067cb9b18db4f5ae
SSDEEP

98304:hyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw41:hyeU11Rvqmu8TWKnF6N/1wk

Score

10^/10

dcrat defense_evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	328	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1316	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	1392	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	744	1392	schtasks.exe	30

UAC bypass 3 TTPs 9 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1964	powershell.exe
772	powershell.exe
828	powershell.exe
2856	powershell.exe
3012	powershell.exe
1180	powershell.exe
1980	powershell.exe
548	powershell.exe
2836	powershell.exe
536	powershell.exe
1920	powershell.exe
2876	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe

Executes dropped EXE 2 IoCs

pid	Process
2332	audiodg.exe
2492	audiodg.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2332	audiodg.exe
2332	audiodg.exe
2492	audiodg.exe
2492	audiodg.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\wininit.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File created	C:\Program Files\Common Files\SpeechEngines\WmiPrvSE.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File created	C:\Program Files\Common Files\SpeechEngines\24dbde2999530e	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\RCXD44.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Program Files\Windows NT\spoolsv.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File created	C:\Program Files\Reference Assemblies\56085415360792	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File created	C:\Program Files\Windows NT\spoolsv.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\RCXD55.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\RCX1DF5.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\RCX1DF6.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File created	C:\Program Files\Windows Defender\ja-JP\audiodg.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\audiodg.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Program Files\Reference Assemblies\wininit.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Program Files\Windows NT\RCX118C.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Program Files\Windows NT\RCX119D.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\WmiPrvSE.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File created	C:\Program Files\Windows Defender\ja-JP\42af1c969fbb7b	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File created	C:\Program Files\Windows NT\f3b6ecef712a24	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Program Files\Reference Assemblies\RCXF68.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Program Files\Reference Assemblies\RCXF79.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File created	C:\Windows\Panther\setup.exe\101b941d020240	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\6cb0b6c459d5d3	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File created	C:\Windows\debug\WIA\c5b4cb5e9653cc	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File created	C:\Windows\inf\de-DE\spoolsv.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File created	C:\Windows\inf\de-DE\f3b6ecef712a24	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File created	C:\Windows\ja-JP\explorer.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\dwm.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Windows\inf\de-DE\RCX15D4.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Windows\Panther\setup.exe\lsm.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File created	C:\Windows\ja-JP\7a0fd90576e088	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Windows\Panther\setup.exe\RCX3CA.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Windows\Panther\setup.exe\RCX3CB.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\RCX89F.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Windows\debug\WIA\RCX13B0.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Windows\ja-JP\RCX1884.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Windows\ja-JP\RCX1902.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File created	C:\Windows\debug\WIA\services.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Windows\debug\WIA\RCX13C1.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Windows\debug\WIA\services.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Windows\inf\de-DE\RCX1652.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Windows\ja-JP\explorer.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File created	C:\Windows\Panther\setup.exe\lsm.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\dwm.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\RCX88F.tmp	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
File opened for modification	C:\Windows\inf\de-DE\spoolsv.exe	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
328	schtasks.exe
2256	schtasks.exe
2140	schtasks.exe
1624	schtasks.exe
2508	schtasks.exe
1964	schtasks.exe
2868	schtasks.exe
2644	schtasks.exe
292	schtasks.exe
756	schtasks.exe
1960	schtasks.exe
1848	schtasks.exe
2188	schtasks.exe
2052	schtasks.exe
1868	schtasks.exe
668	schtasks.exe
2152	schtasks.exe
1732	schtasks.exe
1588	schtasks.exe
1976	schtasks.exe
1680	schtasks.exe
1640	schtasks.exe
744	schtasks.exe
2860	schtasks.exe
1936	schtasks.exe
1656	schtasks.exe
2028	schtasks.exe
2648	schtasks.exe
2532	schtasks.exe
2500	schtasks.exe
2088	schtasks.exe
1572	schtasks.exe
2196	schtasks.exe
1316	schtasks.exe
3012	schtasks.exe
1396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
772	powershell.exe
536	powershell.exe
2876	powershell.exe
3012	powershell.exe
1180	powershell.exe
2856	powershell.exe
1980	powershell.exe
1964	powershell.exe
828	powershell.exe
548	powershell.exe
1920	powershell.exe
2836	powershell.exe
2332	audiodg.exe
2332	audiodg.exe
2332	audiodg.exe
2332	audiodg.exe
2332	audiodg.exe
2332	audiodg.exe
2332	audiodg.exe
2332	audiodg.exe
2332	audiodg.exe
2332	audiodg.exe
2332	audiodg.exe
2332	audiodg.exe
2332	audiodg.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
Token: SeDebugPrivilege	772	powershell.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	828	powershell.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2332	audiodg.exe
Token: SeDebugPrivilege	2492	audiodg.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 1964	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	67
PID 2780 wrote to memory of 1964	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	67
PID 2780 wrote to memory of 1964	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	67
PID 2780 wrote to memory of 1180	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	68
PID 2780 wrote to memory of 1180	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	68
PID 2780 wrote to memory of 1180	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	68
PID 2780 wrote to memory of 2876	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	69
PID 2780 wrote to memory of 2876	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	69
PID 2780 wrote to memory of 2876	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	69
PID 2780 wrote to memory of 772	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	70
PID 2780 wrote to memory of 772	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	70
PID 2780 wrote to memory of 772	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	70
PID 2780 wrote to memory of 828	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	71
PID 2780 wrote to memory of 828	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	71
PID 2780 wrote to memory of 828	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	71
PID 2780 wrote to memory of 1980	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	72
PID 2780 wrote to memory of 1980	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	72
PID 2780 wrote to memory of 1980	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	72
PID 2780 wrote to memory of 3012	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	73
PID 2780 wrote to memory of 3012	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	73
PID 2780 wrote to memory of 3012	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	73
PID 2780 wrote to memory of 1920	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	74
PID 2780 wrote to memory of 1920	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	74
PID 2780 wrote to memory of 1920	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	74
PID 2780 wrote to memory of 536	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	75
PID 2780 wrote to memory of 536	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	75
PID 2780 wrote to memory of 536	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	75
PID 2780 wrote to memory of 2836	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	77
PID 2780 wrote to memory of 2836	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	77
PID 2780 wrote to memory of 2836	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	77
PID 2780 wrote to memory of 2856	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	80
PID 2780 wrote to memory of 2856	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	80
PID 2780 wrote to memory of 2856	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	80
PID 2780 wrote to memory of 548	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	81
PID 2780 wrote to memory of 548	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	81
PID 2780 wrote to memory of 548	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	81
PID 2780 wrote to memory of 1280	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	91
PID 2780 wrote to memory of 1280	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	91
PID 2780 wrote to memory of 1280	2780	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe	91
PID 1280 wrote to memory of 2088	1280	cmd.exe	93
PID 1280 wrote to memory of 2088	1280	cmd.exe	93
PID 1280 wrote to memory of 2088	1280	cmd.exe	93
PID 1280 wrote to memory of 2332	1280	cmd.exe	94
PID 1280 wrote to memory of 2332	1280	cmd.exe	94
PID 1280 wrote to memory of 2332	1280	cmd.exe	94
PID 2332 wrote to memory of 2888	2332	audiodg.exe	95
PID 2332 wrote to memory of 2888	2332	audiodg.exe	95
PID 2332 wrote to memory of 2888	2332	audiodg.exe	95
PID 2332 wrote to memory of 1156	2332	audiodg.exe	96
PID 2332 wrote to memory of 1156	2332	audiodg.exe	96
PID 2332 wrote to memory of 1156	2332	audiodg.exe	96
PID 2888 wrote to memory of 2492	2888	WScript.exe	97
PID 2888 wrote to memory of 2492	2888	WScript.exe	97
PID 2888 wrote to memory of 2492	2888	WScript.exe	97
PID 2492 wrote to memory of 1464	2492	audiodg.exe	98
PID 2492 wrote to memory of 1464	2492	audiodg.exe	98
PID 2492 wrote to memory of 1464	2492	audiodg.exe	98
PID 2492 wrote to memory of 1728	2492	audiodg.exe	99
PID 2492 wrote to memory of 1728	2492	audiodg.exe	99
PID 2492 wrote to memory of 1728	2492	audiodg.exe	99

System policy modification 1 TTPs 9 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
"C:\Users\Admin\AppData\Local\Temp\89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\w1O57cI28R.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2088
- - C:\Program Files\Windows Defender\ja-JP\audiodg.exe
    "C:\Program Files\Windows Defender\ja-JP\audiodg.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2332
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a64efe66-452d-4f76-b242-2e21072202af.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2888
    - - C:\Program Files\Windows Defender\ja-JP\audiodg.exe
        
        "C:\Program Files\Windows Defender\ja-JP\audiodg.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2492
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b3f0d929-ffa5-4f8c-a04c-4c67aa5b44b2.vbs"
        6⤵
        
        PID:1464
        
        C:\Program Files\Windows Defender\ja-JP\audiodg.exe
        
        "C:\Program Files\Windows Defender\ja-JP\audiodg.exe"
        7⤵
        
        PID:536
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d51a8f9e-4795-4956-9cd0-9efb6c118f76.vbs"
        8⤵
        
        PID:1972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84295425-41d0-4af9-b60a-1097af34a2be.vbs"
        8⤵
        
        PID:2688
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fc3bced9-4d35-485c-acd3-fe53bfb4e76b.vbs"
        6⤵
        
        PID:1728
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\95d2bea7-8e02-4bee-ad54-190c423079fd.vbs"
      4⤵
      PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Windows\Panther\setup.exe\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\Panther\setup.exe\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Windows\Panther\setup.exe\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\ja-JP\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\ja-JP\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\ja-JP\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Reference Assemblies\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows NT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Windows\debug\WIA\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\debug\WIA\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Windows\debug\WIA\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Windows\inf\de-DE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\inf\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\inf\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Windows\ja-JP\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\ja-JP\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Windows\ja-JP\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\SpeechEngines\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Common Files\SpeechEngines\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files\Common Files\SpeechEngines\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\audiodg.exe

Filesize
5.9MB

MD5
6d22db1ee5e47a7a8475ab5befe01849

SHA1
79dd7b0b9229f2f2fdce74935914f1bb2665b734

SHA256
78075d92c9e24f026d1efe36e8022a64179c99d3f1775f56bcdfe8a94b75d724

SHA512
c0b8aaaf73cd0fadf76aada7471007c3d3f3b1026709918351ac03b743f2faa0050b6aa46d36d006a48bf4f32818633895f247dbbdb161eeef6a656baef6a9e8

Download Submit
C:\Program Files\Windows Defender\ja-JP\audiodg.exe

Filesize
5.9MB

MD5
89ed231ad61a9e5a7fd0ab9f2bd75b9a

SHA1
9fef3b04fdadf7c3bc756603d55d26c6d77a9f9d

SHA256
403dbebad41f7ff4bc9292290673b4dc3cce92f06d0f710c674f315f6e8caae8

SHA512
50ee7cfba3b046d677c9aaa853ec100ed2b4b24c4c045212c2eada4caed628ea7771fd0a8b47cb03c266a300df34b5f3b9714e68fdec6229067cb9b18db4f5ae

Download Submit
C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\csrss.exe

Filesize
5.9MB

MD5
14afa9dda5958836ab2e3d1ac6a2803e

SHA1
b8f196193e21b5b12c3dc9c84ec991ea207db16a

SHA256
d2103099d886ae7cf4a6b577034571ed3175a8e06660ef692b5e7831b0b16e03

SHA512
530b7be4a3f8f6dabefe652b3e75e0f3844bafacd49beb51075bac887d3ca4c617a55beaed083ba3b6e6b269bd85ee4362f6e5e3ea499fa828214838626cedf1

Download Submit
C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\winlogon.exe

Filesize
5.9MB

MD5
b6c0334e64ad34e83b200eae5ff2d960

SHA1
75ddf0a0847bba3c708488ec9744a0d5b995efe5

SHA256
c6d0d80a73550ff54b1c096cb761b2c6a83332ab6488352f1948b7c0ed4daf92

SHA512
5f64bfa1f142cb7dd8e39a01ab3f936c3adea92e86fe8eefb992827db47ba2ff17a5897514064b4008e3b415589f718a3b915a7cf84a670f54bef3dc0fec3836

Download Submit
C:\Users\Admin\AppData\Local\Temp\95d2bea7-8e02-4bee-ad54-190c423079fd.vbs

Filesize
503B

MD5
d4d83b00ca26a9b4ac4b7d22589908ea

SHA1
7022046da22c0021a1d4974c68b352888b1f3799

SHA256
0ee0aa41c5fcba09c90ea3c2e33d684009e7635cc3436aa63e3de550102650b6

SHA512
164fea1ed216c71d63f6a663c0eaab7503487039a0aba03a39c43864b344bec545e6b76f1f182b92000bb02a9089d8bfc1d0e06d6c99280bf1863109ce05600c

Download Submit
C:\Users\Admin\AppData\Local\Temp\a64efe66-452d-4f76-b242-2e21072202af.vbs

Filesize
727B

MD5
a8db68838a71be170656196f26a95569

SHA1
5bd3bf8c458d2acafbb5ef94a294a0b8bfb33273

SHA256
2685bed1b1e2c17c57bfc67cad70c619b81feb67aa8ffb4ea3e2801830488553

SHA512
d0eda350dc88c37a13a958089d954ae89a3f7b17700ad3dd9e40d0ef710b6f9d13dc882c071c9c0d7d6ba33ab64ee7383738484978a0294dc152101f73fe4ccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\b3f0d929-ffa5-4f8c-a04c-4c67aa5b44b2.vbs

Filesize
727B

MD5
46e56f1a57a7e6bb7792aa813cd92863

SHA1
eb0144d8cceac6d4be18d8e2e27de89a9e8ac611

SHA256
aadda70dc8f829465c46ac0f680427d1d7ba0048fd23742cf159fa43b892bd42

SHA512
3aa5918bd6a7a4c7a56b3a022480925f262f181da7cc459d2b94f9cd2ed6d3e55ae8309cadc3706d21637d1daff9b90deaf7141202136420b346f1e9ecdce0f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\d51a8f9e-4795-4956-9cd0-9efb6c118f76.vbs

Filesize
726B

MD5
bbfae44f689cc2e00ee5d777b4dd95ed

SHA1
a523fa9433c7a4ff843b42f44b91f8d80082d454

SHA256
18e5187eddb53f2eed3c83b5078d6b9d0fe7fedd1cd447a954ad16fc87cf7a0b

SHA512
5ebd8bde0ae6a9e8194e757d0c4b03906294703d5a371c61c6ab094c96d7cb1795f140b0b5fc7b1a1526a86eb12172f12833ad8d7e02bf4c742b5034d63d4267

Download Submit
C:\Users\Admin\AppData\Local\Temp\w1O57cI28R.bat

Filesize
216B

MD5
e0eb74587cde6831ea928cdbeaa0a121

SHA1
701f5467739b5a33225ceb826818f3ad4b2787aa

SHA256
4171550a41d1e1088c70db7d474a605e883dc0d3cf639b3e3cddb4dd6d090ef8

SHA512
dfdb8d5896a49dd944a00cbfb26f1048939e03594a30acf721b14dbc4a3bf700438a12bcb40109ecab21dcb2de30aa67b8f11f215e72b4f3d7b5e0856d2be042

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b36b0c997f37e38cd64e491d9be46e31

SHA1
23b9fa5e1ceabafe4fa36447209253f227ab8642

SHA256
93e19c7ae8c23c246927e0205dc8461380ae6c560cc0154e7dd5e4add288b152

SHA512
3ccb2368cb174bb883cf8154bae8658f6cdc1e383da2891dabcb82dce568810d9332c036ac678825ad047e02d99d8c4702dfe7036899596369baae9c27cc4c3b

Download Submit
C:\Windows\inf\de-DE\spoolsv.exe

Filesize
5.9MB

MD5
dbfc13edc5b2dff23b8e7ce14f659574

SHA1
20948a9ee7cd4d5997e56d1b2e0aa822a7b9bdb2

SHA256
1d012787fd402d8cfec63499a53d285c49894ac78cfe188b84ae85917c27beb3

SHA512
24776561974f126570f9beef41b2e04bd2f5ddfef143e69f230a11c61dbdf11fbd2579962a2e3b9c50596eef94c59b18a304d77773d338fe983541b44ca15201

Download Submit
memory/536-299-0x0000000000D40000-0x0000000001638000-memory.dmp

Filesize
9.0MB

Download
memory/536-233-0x000000001B540000-0x000000001B822000-memory.dmp

Filesize
2.9MB

Download
memory/772-234-0x0000000002000000-0x0000000002008000-memory.dmp

Filesize
32KB

Download
memory/2332-273-0x0000000001280000-0x0000000001B78000-memory.dmp

Filesize
9.0MB

Download
memory/2332-275-0x0000000000AB0000-0x0000000000AC2000-memory.dmp

Filesize
72KB

Download
memory/2492-286-0x00000000001B0000-0x0000000000AA8000-memory.dmp

Filesize
9.0MB

Download
memory/2780-14-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/2780-39-0x000000001BB40000-0x000000001BB4C000-memory.dmp

Filesize
48KB

Download
memory/2780-19-0x0000000002A90000-0x0000000002A98000-memory.dmp

Filesize
32KB

Download
memory/2780-20-0x000000001AEA0000-0x000000001AEAC000-memory.dmp

Filesize
48KB

Download
memory/2780-21-0x000000001AEB0000-0x000000001AEB8000-memory.dmp

Filesize
32KB

Download
memory/2780-23-0x000000001B290000-0x000000001B2A2000-memory.dmp

Filesize
72KB

Download
memory/2780-24-0x000000001B2A0000-0x000000001B2AC000-memory.dmp

Filesize
48KB

Download
memory/2780-25-0x000000001B3D0000-0x000000001B3DC000-memory.dmp

Filesize
48KB

Download
memory/2780-26-0x000000001B3E0000-0x000000001B3E8000-memory.dmp

Filesize
32KB

Download
memory/2780-27-0x000000001B8B0000-0x000000001B8BC000-memory.dmp

Filesize
48KB

Download
memory/2780-28-0x000000001B8C0000-0x000000001B8CC000-memory.dmp

Filesize
48KB

Download
memory/2780-29-0x000000001B8D0000-0x000000001B8D8000-memory.dmp

Filesize
32KB

Download
memory/2780-30-0x000000001B8E0000-0x000000001B8EC000-memory.dmp

Filesize
48KB

Download
memory/2780-31-0x000000001B9F0000-0x000000001B9FA000-memory.dmp

Filesize
40KB

Download
memory/2780-32-0x000000001BA00000-0x000000001BA0E000-memory.dmp

Filesize
56KB

Download
memory/2780-33-0x000000001BA10000-0x000000001BA18000-memory.dmp

Filesize
32KB

Download
memory/2780-34-0x000000001BA20000-0x000000001BA2E000-memory.dmp

Filesize
56KB

Download
memory/2780-35-0x000000001BB00000-0x000000001BB08000-memory.dmp

Filesize
32KB

Download
memory/2780-36-0x000000001BB10000-0x000000001BB1C000-memory.dmp

Filesize
48KB

Download
memory/2780-37-0x000000001BB20000-0x000000001BB28000-memory.dmp

Filesize
32KB

Download
memory/2780-38-0x000000001BB30000-0x000000001BB3A000-memory.dmp

Filesize
40KB

Download
memory/2780-18-0x0000000002A80000-0x0000000002A8C000-memory.dmp

Filesize
48KB

Download
memory/2780-17-0x000000001BAB0000-0x000000001BB06000-memory.dmp

Filesize
344KB

Download
memory/2780-16-0x0000000002A70000-0x0000000002A7A000-memory.dmp

Filesize
40KB

Download
memory/2780-15-0x00000000028D0000-0x00000000028E0000-memory.dmp

Filesize
64KB

Download
memory/2780-0-0x000007FEF5BC3000-0x000007FEF5BC4000-memory.dmp

Filesize
4KB

Download
memory/2780-174-0x000007FEF5BC3000-0x000007FEF5BC4000-memory.dmp

Filesize
4KB

Download
memory/2780-13-0x00000000027C0000-0x00000000027CC000-memory.dmp

Filesize
48KB

Download
memory/2780-208-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2780-11-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2780-12-0x00000000027B0000-0x00000000027C2000-memory.dmp

Filesize
72KB

Download
memory/2780-10-0x0000000000DD0000-0x0000000000DE6000-memory.dmp

Filesize
88KB

Download
memory/2780-236-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2780-9-0x0000000000DC0000-0x0000000000DD0000-memory.dmp

Filesize
64KB

Download
memory/2780-8-0x0000000000B10000-0x0000000000B18000-memory.dmp

Filesize
32KB

Download
memory/2780-7-0x0000000000DA0000-0x0000000000DBC000-memory.dmp

Filesize
112KB

Download
memory/2780-6-0x0000000000B00000-0x0000000000B08000-memory.dmp

Filesize
32KB

Download
memory/2780-5-0x0000000000AF0000-0x0000000000AFE000-memory.dmp

Filesize
56KB

Download
memory/2780-4-0x0000000000AE0000-0x0000000000AEE000-memory.dmp

Filesize
56KB

Download
memory/2780-3-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2780-2-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Filesize
4KB

Download
memory/2780-1-0x00000000000E0000-0x00000000009D8000-memory.dmp

Filesize
9.0MB

Download