dcrat | ec57a5693533b024615c157ec0e3867b2eb73a65a12c20501ef8ff00ffd8f65c

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c2f113ba8a501582e5be7ba0c0bf0fb.exe
Size

5.9MB
MD5

7c2f113ba8a501582e5be7ba0c0bf0fb
SHA1

ff9cf8d30af6127eb666f6beef694468aa4635e9
SHA256

de9937ea08cc871fea712bab7d3206d845f302b33cf1c469ec57f26017abf196
SHA512

86cb31695c72d27f26acfa889726be42a24fe8e4ea63b18b6c6d485ea4a0a26199b8dced77fb2dea3da10643307cf11ab5abd52f8b8b85a3e70bb121f037b7b8
SSDEEP

98304:RyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw4j:RyeU11Rvqmu8TWKnF6N/1wW

Score

10^/10

dcrat defense_evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	808	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4104	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1188	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	416	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	4928	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	4928	schtasks.exe	90

UAC bypass 3 TTPs 12 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
840	powershell.exe
3224	powershell.exe
2688	powershell.exe
2776	powershell.exe
4080	powershell.exe
4544	powershell.exe
4092	powershell.exe
1336	powershell.exe
3440	powershell.exe
4084	powershell.exe
4412	powershell.exe
4160	powershell.exe
2800	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	7c2f113ba8a501582e5be7ba0c0bf0fb.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	Registry.exe

Executes dropped EXE 3 IoCs

pid	Process
5412	Registry.exe
2752	Registry.exe
3168	Registry.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
5412	Registry.exe
5412	Registry.exe
2752	Registry.exe
2752	Registry.exe
3168	Registry.exe
3168	Registry.exe

Drops file in Program Files directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\RCX9D1B.tmp	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\lsass.exe	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Registry.exe	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File created	C:\Program Files\MSBuild\Microsoft\dllhost.exe	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX98C3.tmp	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RCXA93B.tmp	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File created	C:\Program Files (x86)\Microsoft.NET\backgroundTaskHost.exe	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\fontdrvhost.exe	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\taskhostw.exe	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RCXAB50.tmp	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\RCXA202.tmp	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\RCXA484.tmp	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File created	C:\Program Files (x86)\Windows Defender\ea9f0e6c9e2dcd	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\RCX9D99.tmp	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\lsass.exe	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Registry.exe	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\RCXA1F1.tmp	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\dllhost.exe	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File created	C:\Program Files (x86)\Windows Mail\eddb19405b7ce1	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\5b884080fd4f94	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\ee2ad38f3d4382	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\backgroundTaskHost.exe	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\fontdrvhost.exe	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RCXA93C.tmp	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File created	C:\Program Files (x86)\Windows Mail\backgroundTaskHost.exe	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File created	C:\Program Files (x86)\Windows Defender\taskhostw.exe	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\6203df4a6bafc7	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File created	C:\Program Files\MSBuild\Microsoft\5940a34987c991	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RCXAB61.tmp	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\backgroundTaskHost.exe	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\RCXA494.tmp	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File created	C:\Program Files (x86)\Microsoft.NET\eddb19405b7ce1	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX9854.tmp	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\RCX9AF6.tmp	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\RCX9B07.tmp	7c2f113ba8a501582e5be7ba0c0bf0fb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	Registry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4632	schtasks.exe
4040	schtasks.exe
2068	schtasks.exe
4396	schtasks.exe
5008	schtasks.exe
1472	schtasks.exe
2656	schtasks.exe
416	schtasks.exe
1784	schtasks.exe
1576	schtasks.exe
4688	schtasks.exe
3440	schtasks.exe
2148	schtasks.exe
4192	schtasks.exe
2724	schtasks.exe
808	schtasks.exe
1748	schtasks.exe
680	schtasks.exe
1640	schtasks.exe
4552	schtasks.exe
4160	schtasks.exe
2776	schtasks.exe
1676	schtasks.exe
1188	schtasks.exe
2920	schtasks.exe
1128	schtasks.exe
1508	schtasks.exe
2212	schtasks.exe
1988	schtasks.exe
3656	schtasks.exe
3244	schtasks.exe
4840	schtasks.exe
1448	schtasks.exe
4104	schtasks.exe
1412	schtasks.exe
4532	schtasks.exe
4544	schtasks.exe
4452	schtasks.exe
2132	schtasks.exe
1756	schtasks.exe
3048	schtasks.exe
468	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
4160	powershell.exe
4160	powershell.exe
4092	powershell.exe
4092	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
Token: SeDebugPrivilege	4160	powershell.exe
Token: SeDebugPrivilege	4092	powershell.exe
Token: SeDebugPrivilege	3440	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	3224	powershell.exe
Token: SeDebugPrivilege	4084	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	5412	Registry.exe
Token: SeDebugPrivilege	2752	Registry.exe
Token: SeDebugPrivilege	3168	Registry.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2800	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	138
PID 1960 wrote to memory of 2800	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	138
PID 1960 wrote to memory of 4160	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	139
PID 1960 wrote to memory of 4160	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	139
PID 1960 wrote to memory of 1336	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	140
PID 1960 wrote to memory of 1336	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	140
PID 1960 wrote to memory of 3440	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	141
PID 1960 wrote to memory of 3440	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	141
PID 1960 wrote to memory of 840	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	142
PID 1960 wrote to memory of 840	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	142
PID 1960 wrote to memory of 4092	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	143
PID 1960 wrote to memory of 4092	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	143
PID 1960 wrote to memory of 4544	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	144
PID 1960 wrote to memory of 4544	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	144
PID 1960 wrote to memory of 4412	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	145
PID 1960 wrote to memory of 4412	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	145
PID 1960 wrote to memory of 4080	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	147
PID 1960 wrote to memory of 4080	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	147
PID 1960 wrote to memory of 2776	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	148
PID 1960 wrote to memory of 2776	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	148
PID 1960 wrote to memory of 2688	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	149
PID 1960 wrote to memory of 2688	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	149
PID 1960 wrote to memory of 3224	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	150
PID 1960 wrote to memory of 3224	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	150
PID 1960 wrote to memory of 4084	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	151
PID 1960 wrote to memory of 4084	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	151
PID 1960 wrote to memory of 60	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	164
PID 1960 wrote to memory of 60	1960	7c2f113ba8a501582e5be7ba0c0bf0fb.exe	164
PID 60 wrote to memory of 1804	60	cmd.exe	166
PID 60 wrote to memory of 1804	60	cmd.exe	166
PID 60 wrote to memory of 5412	60	cmd.exe	168
PID 60 wrote to memory of 5412	60	cmd.exe	168
PID 5412 wrote to memory of 5672	5412	Registry.exe	169
PID 5412 wrote to memory of 5672	5412	Registry.exe	169
PID 5412 wrote to memory of 5716	5412	Registry.exe	170
PID 5412 wrote to memory of 5716	5412	Registry.exe	170
PID 5672 wrote to memory of 2752	5672	WScript.exe	181
PID 5672 wrote to memory of 2752	5672	WScript.exe	181
PID 2752 wrote to memory of 5192	2752	Registry.exe	183
PID 2752 wrote to memory of 5192	2752	Registry.exe	183
PID 2752 wrote to memory of 3196	2752	Registry.exe	184
PID 2752 wrote to memory of 3196	2752	Registry.exe	184
PID 5192 wrote to memory of 3168	5192	WScript.exe	185
PID 5192 wrote to memory of 3168	5192	WScript.exe	185
PID 3168 wrote to memory of 5692	3168	Registry.exe	186
PID 3168 wrote to memory of 5692	3168	Registry.exe	186
PID 3168 wrote to memory of 5696	3168	Registry.exe	187
PID 3168 wrote to memory of 5696	3168	Registry.exe	187

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7c2f113ba8a501582e5be7ba0c0bf0fb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7c2f113ba8a501582e5be7ba0c0bf0fb.exe
"C:\Users\Admin\AppData\Local\Temp\7c2f113ba8a501582e5be7ba0c0bf0fb.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/d9c22b4eaa3c0b9c12c7/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/dfe2e59cddd00040f555dab607351a1d/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GV8rcJbRe2.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1804
- - C:\dfe2e59cddd00040f555dab607351a1d\Registry.exe
    "C:\dfe2e59cddd00040f555dab607351a1d\Registry.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:5412
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5b9f123-de8b-40d7-ae37-3ea9480d7b1b.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5672
    - - C:\dfe2e59cddd00040f555dab607351a1d\Registry.exe
        
        C:\dfe2e59cddd00040f555dab607351a1d\Registry.exe
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2752
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\68e5761a-eae2-4415-9fd9-e65927bced7a.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5192
        
        C:\dfe2e59cddd00040f555dab607351a1d\Registry.exe
        
        C:\dfe2e59cddd00040f555dab607351a1d\Registry.exe
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3168
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc6d5e0f-32e9-453a-b204-83d859a15708.vbs"
        8⤵
        
        PID:5692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1e8deeae-92d2-4ac0-bca3-18850bc7e205.vbs"
        8⤵
        
        PID:5696
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ba82c303-de28-4986-9b14-980dbccd683f.vbs"
        6⤵
        
        PID:3196
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d29ba54-9fb2-449a-9784-5887f4d9b23b.vbs"
      4⤵
      PID:5716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\dfe2e59cddd00040f555dab607351a1d\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\dfe2e59cddd00040f555dab607351a1d\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\dfe2e59cddd00040f555dab607351a1d\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\d9c22b4eaa3c0b9c12c7\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\d9c22b4eaa3c0b9c12c7\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\d9c22b4eaa3c0b9c12c7\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\d9c22b4eaa3c0b9c12c7\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\d9c22b4eaa3c0b9c12c7\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\d9c22b4eaa3c0b9c12c7\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\Microsoft\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\lsass.exe

Filesize
5.9MB

MD5
e583343c0b299fbe9dcb64757361d20d

SHA1
5decc744ac43396e34850eb1fbefbae74d492a4a

SHA256
11723717cc0a0147aa814498b8d10b5112634a4a80a89f2d99aca7c28b647f45

SHA512
49f379540e67922acfbd4d4cb9eb2ffd29ecafe96df275fc2bc764f1a72c81883350d2c0f3d14d965ba56f5522c4f1d52f2db647b62d93e2f27aff1e20890774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log

Filesize
1KB

MD5
229da4b4256a6a948830de7ee5f9b298

SHA1
8118b8ddc115689ca9dc2fe8c244350333c5ba8b

SHA256
3d63b4a66e80ed97a8d74ea9dee7645942aafbd4abf1b31afed1027e5967fe11

SHA512
3a4ec8f720000a32bb1555b32db13236a73bb6e654e35b4de8bdb0fc0de535584bc08ebe25c7066324e86faa33e8f571a11cc4e5ef00be78e2993e228f615224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
47d9df7fab0d0c96afdd2ca49f2b5030

SHA1
92583883bcf376062ddef5db2333f066d8d36612

SHA256
0f244dd39698dace2c650435886b1175ea01131e581d6c13888576c07fa40b02

SHA512
1844ce4f35849b70c246127482040986caa1bbae2d81119c77e9841f2a3280aabae0ad0db52fc29fe48023b4f4c073fe759b1f54e70e1562289d5e349c015200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
414d3c7be38a289ed476cbb4ac51ae02

SHA1
da5113d85edeefb5a20093e40bb548356316f3d4

SHA256
d8ce1dc945725e1a003fcad77de1db795d498003228c088506d286c613cd2e31

SHA512
a6db753e6e9515ad845b8073e725b2d0182697c6dd77475291aefd19e7331d78039c00b9d41ee8cccfabe9a2e0e2ab25753ebf9a865c4a3c18d77ee27cbbae93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
7ebbb17f3791dea62cf267d83cf036a4

SHA1
266c27acf64b85afd8380277f767cc54f91ab2b0

SHA256
2345628c466a33c557a0fba468c06436ce7121c56e6260492c5d6ce52d05ba19

SHA512
6e519f44c8d4e9fe752471f19ec9956e3cd6d73f741496d09bb0fb0c8f0048636b6a52204fa475436c0403d022500fd33452e0ad8f18b3ed2245b24b5bd7bb51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0905ae614762fa70e8327971f5d9ac26

SHA1
0137b0e5ec591952deb58effe1226ba44a342bc4

SHA256
fa0c054c25dd4d8d2e608d91248c7587372869fc8437b1b2978c6483dd26837d

SHA512
f7476a9425a6170d88e174b23ff9727ca9734e74ba306f221830ea7bc239e3c8c6dd956f90634e663bd0a881cfe6b5568e910961336dc953d097d597ad8b9dc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0f29d4b03e157fa020f2b793683543af

SHA1
1b0603266b02dd38444489e0d5e18ee93b6b766a

SHA256
eec5516679b34fb0efe983a81cc19b0b5cf33fd3191d5d8fd5c3fb082a55d410

SHA512
b0cca3aa1373f813a7a16a1ca94b7e048d83f8875b28949d7ece9668c5cb847250d1468080a85e478833a8876b668a8a6e0ef4df4a289ca66badac3af00dc5c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
104B

MD5
a5ba257a5b9def2bdc7215a480c0b1a2

SHA1
c3c43d528fa73ca82f46c987e9a10e9e8cca12a6

SHA256
c1ca7d66d45da4d2ccffea368effab1d5c1df5ce861857ff9a02f7be5e50795f

SHA512
1f48721c513270c382a632491827d1562bf8be4dc7153b5948ede894876cad4a8d179904b913e4f1338f2e4d95df3dcbd1597c5617a4a1d554ee16baaabad56a

Download Submit
C:\Users\Admin\AppData\Local\Temp\5d29ba54-9fb2-449a-9784-5887f4d9b23b.vbs

Filesize
500B

MD5
6718412c3f8782485f5237ff0f17a3d1

SHA1
83c687431a06a7b4a30b2d104f34f505fe0764f4

SHA256
5c4108a253427c594b07528ef2fad51443d785552067304e424341e412aa1359

SHA512
a2959d77431bb7d12aada218c4ab6177e2f91e1da971b2c929027f41652d1445f5ecc96154eff28163f8bfd672491c3dac8b95dc6c1ec0aff7ca9d0f2a92e7c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\68e5761a-eae2-4415-9fd9-e65927bced7a.vbs

Filesize
724B

MD5
5fd94254f4b1f0dfa45e482d4b6dc2c3

SHA1
8b22afebf4b18277a8123f525b8b84788d19b5db

SHA256
35a3feb1b273962816e9a53e6f9936913ff2ff08abfee1ad14daacd83761212e

SHA512
00de223d2cf5df140437f76f041abec452f0e1b7c84a0dd18d52c479dea7fb45c304ac817f636f64d03be1a5b56b8426b2c078c3e8ed46e50df1b57c3f88cf46

Download Submit
C:\Users\Admin\AppData\Local\Temp\GV8rcJbRe2.bat

Filesize
213B

MD5
8784c9a01929dde88b4187527997adc4

SHA1
388ac5fcfd4b7f0c26aad192e0f56a5a33966069

SHA256
e0b8d842bb9fc4ab3e85f28c6d448f10f83e5e1efb4aec3fe9a045756f055836

SHA512
87fa9f79110bef2c0ff8f18822db1177ff61adfd1dc8d98f24bfd8e8b69c40ccf25003f2f8cf2971001fc75aeb97db83d05763d92c39bc8ffb2803353c298550

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eayq5jzz.wpr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bc6d5e0f-32e9-453a-b204-83d859a15708.vbs

Filesize
724B

MD5
2978c539816853d4c83ca50d61e54f5e

SHA1
a6851e5f420ee913396f7f115395386f9ca88d93

SHA256
36c46027d1e43f0a76996a0ee1113a2a1642b54dd6d3bce2db7629944aa27d54

SHA512
06907b60361a389f738883b74482eeca8a72722c516e2ca4da14b901f0954260a70878ac9d7d549beef51552723bf706dc4ae6d41d0508d451e19fe45e8745b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\f5b9f123-de8b-40d7-ae37-3ea9480d7b1b.vbs

Filesize
724B

MD5
8b98aec235986949420c28524096a282

SHA1
6a4b71e4a98ceb48d2df831d916a3ca0b59c9e3a

SHA256
79ef5755280c1dacd11867c5fecd0909757540a208e73a86972556968a460dc5

SHA512
24afb5dc9aae5dafd4dd4f2f697e03124d91fe41257a4efa7fc5b2b0cfa65cd80c95c9d09ebf97ccbcf6360aaba1d917d1f7dec87ff3355ea15d2a9ca3b26239

Download Submit
C:\d9c22b4eaa3c0b9c12c7\OfficeClickToRun.exe

Filesize
5.9MB

MD5
7c2f113ba8a501582e5be7ba0c0bf0fb

SHA1
ff9cf8d30af6127eb666f6beef694468aa4635e9

SHA256
de9937ea08cc871fea712bab7d3206d845f302b33cf1c469ec57f26017abf196

SHA512
86cb31695c72d27f26acfa889726be42a24fe8e4ea63b18b6c6d485ea4a0a26199b8dced77fb2dea3da10643307cf11ab5abd52f8b8b85a3e70bb121f037b7b8

Download Submit
memory/1960-17-0x000000001D410000-0x000000001D41A000-memory.dmp

Filesize
40KB

Download
memory/1960-32-0x000000001D640000-0x000000001D64C000-memory.dmp

Filesize
48KB

Download
memory/1960-18-0x000000001D420000-0x000000001D476000-memory.dmp

Filesize
344KB

Download
memory/1960-20-0x000000001D480000-0x000000001D488000-memory.dmp

Filesize
32KB

Download
memory/1960-21-0x000000001D490000-0x000000001D49C000-memory.dmp

Filesize
48KB

Download
memory/1960-24-0x000000001D4B0000-0x000000001D4C2000-memory.dmp

Filesize
72KB

Download
memory/1960-22-0x000000001D4A0000-0x000000001D4A8000-memory.dmp

Filesize
32KB

Download
memory/1960-25-0x000000001DA10000-0x000000001DF38000-memory.dmp

Filesize
5.2MB

Download
memory/1960-26-0x000000001D4E0000-0x000000001D4EC000-memory.dmp

Filesize
48KB

Download
memory/1960-28-0x000000001D500000-0x000000001D508000-memory.dmp

Filesize
32KB

Download
memory/1960-30-0x000000001D520000-0x000000001D52C000-memory.dmp

Filesize
48KB

Download
memory/1960-29-0x000000001D510000-0x000000001D51C000-memory.dmp

Filesize
48KB

Download
memory/1960-27-0x000000001D4F0000-0x000000001D4FC000-memory.dmp

Filesize
48KB

Download
memory/1960-31-0x000000001D630000-0x000000001D638000-memory.dmp

Filesize
32KB

Download
memory/1960-40-0x000000001D8C0000-0x000000001D8CA000-memory.dmp

Filesize
40KB

Download
memory/1960-41-0x000000001D7C0000-0x000000001D7CC000-memory.dmp

Filesize
48KB

Download
memory/1960-39-0x000000001D7B0000-0x000000001D7B8000-memory.dmp

Filesize
32KB

Download
memory/1960-38-0x000000001D7A0000-0x000000001D7AC000-memory.dmp

Filesize
48KB

Download
memory/1960-37-0x000000001D790000-0x000000001D798000-memory.dmp

Filesize
32KB

Download
memory/1960-36-0x000000001D780000-0x000000001D78E000-memory.dmp

Filesize
56KB

Download
memory/1960-35-0x000000001D770000-0x000000001D778000-memory.dmp

Filesize
32KB

Download
memory/1960-34-0x000000001D760000-0x000000001D76E000-memory.dmp

Filesize
56KB

Download
memory/1960-33-0x000000001D650000-0x000000001D65A000-memory.dmp

Filesize
40KB

Download
memory/1960-19-0x000000001D470000-0x000000001D47C000-memory.dmp

Filesize
48KB

Download
memory/1960-14-0x000000001BC20000-0x000000001BC2C000-memory.dmp

Filesize
48KB

Download
memory/1960-0-0x00007FFEC9393000-0x00007FFEC9395000-memory.dmp

Filesize
8KB

Download
memory/1960-203-0x00007FFEC9393000-0x00007FFEC9395000-memory.dmp

Filesize
8KB

Download
memory/1960-215-0x00007FFEC9390000-0x00007FFEC9E51000-memory.dmp

Filesize
10.8MB

Download
memory/1960-1-0x0000000000520000-0x0000000000E18000-memory.dmp

Filesize
9.0MB

Download
memory/1960-15-0x000000001BC30000-0x000000001BC38000-memory.dmp

Filesize
32KB

Download
memory/1960-274-0x00007FFEC9390000-0x00007FFEC9E51000-memory.dmp

Filesize
10.8MB

Download
memory/1960-16-0x000000001D400000-0x000000001D410000-memory.dmp

Filesize
64KB

Download
memory/1960-6-0x0000000003170000-0x0000000003178000-memory.dmp

Filesize
32KB

Download
memory/1960-8-0x000000001BBD0000-0x000000001BC20000-memory.dmp

Filesize
320KB

Download
memory/1960-9-0x0000000003180000-0x0000000003188000-memory.dmp

Filesize
32KB

Download
memory/1960-10-0x000000001BB80000-0x000000001BB90000-memory.dmp

Filesize
64KB

Download
memory/1960-13-0x000000001BBC0000-0x000000001BBD2000-memory.dmp

Filesize
72KB

Download
memory/1960-11-0x000000001BB90000-0x000000001BBA6000-memory.dmp

Filesize
88KB

Download
memory/1960-12-0x000000001BBB0000-0x000000001BBB8000-memory.dmp

Filesize
32KB

Download
memory/1960-7-0x000000001BB60000-0x000000001BB7C000-memory.dmp

Filesize
112KB

Download
memory/1960-2-0x00000000016A0000-0x00000000016A1000-memory.dmp

Filesize
4KB

Download
memory/1960-5-0x0000000003160000-0x000000000316E000-memory.dmp

Filesize
56KB

Download
memory/1960-4-0x0000000001740000-0x000000000174E000-memory.dmp

Filesize
56KB

Download
memory/1960-3-0x00007FFEC9390000-0x00007FFEC9E51000-memory.dmp

Filesize
10.8MB

Download
memory/2752-409-0x000000001C4A0000-0x000000001C4B2000-memory.dmp

Filesize
72KB

Download
memory/3168-422-0x000000001BC10000-0x000000001BC22000-memory.dmp

Filesize
72KB

Download
memory/4160-252-0x0000023B20DE0000-0x0000023B20E02000-memory.dmp

Filesize
136KB

Download
memory/5412-395-0x000000001DD80000-0x000000001DD92000-memory.dmp

Filesize
72KB

Download