dcrat | 13998cf5ce3fc1b1fb20635ef2c1e476c880d72eec7afb7e8ec74808928700da

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
Size

5.9MB
MD5

a7fd5ae1f0d16e9069ca216d2f21ccf8
SHA1

9c7a2f7d780bb05baa0b592ca1547ba25bbcf4ea
SHA256

0deb67b0ba108bc58c86e696234379a5bdfb1f3de00269944c28113001695e47
SHA512

a317655fd45bd7d86393d02cf3471ba145fa696b73f6a4d1463ed81030a44ea68308f34b8beca3382f678c797e95b8f9be70902d91870e5f98139debb21ac353
SSDEEP

98304:xyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw4r:xyeU11Rvqmu8TWKnF6N/1wO

Score

10^/10

dcrat defense_evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3412	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6064	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3356	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3192	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3876	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5920	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3548	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5900	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5156	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5592	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	5216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5756	5216	schtasks.exe	91

UAC bypass 3 TTPs 12 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1412	powershell.exe
2736	powershell.exe
5644	powershell.exe
3952	powershell.exe
4200	powershell.exe
544	powershell.exe
5384	powershell.exe
5552	powershell.exe
3940	powershell.exe
6068	powershell.exe
2984	powershell.exe
4820	powershell.exe
5616	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	Registry.exe

Executes dropped EXE 3 IoCs

pid	Process
4028	Registry.exe
5644	Registry.exe
4992	Registry.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
4028	Registry.exe
4028	Registry.exe
5644	Registry.exe
5644	Registry.exe
4992	Registry.exe
4992	Registry.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\9e8d7a4ca61bd9	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\RCX836D.tmp	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\fontdrvhost.exe	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RCX9483.tmp	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\RCX9687.tmp	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\fontdrvhost.exe	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\5b884080fd4f94	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\RuntimeBroker.exe	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RCX9405.tmp	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\RuntimeBroker.exe	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File created	C:\Program Files\Common Files\DESIGNER\5b884080fd4f94	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\RCX835D.tmp	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\fontdrvhost.exe	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\RCX9698.tmp	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File created	C:\Program Files\Common Files\DESIGNER\fontdrvhost.exe	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\bcastdvr\fontdrvhost.exe	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File created	C:\Windows\bcastdvr\5b884080fd4f94	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File created	C:\Windows\ModemLogs\conhost.exe	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File created	C:\Windows\ModemLogs\088424020bedd6	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File opened for modification	C:\Windows\bcastdvr\RCX8F4E.tmp	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File opened for modification	C:\Windows\bcastdvr\RCX8FCC.tmp	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File opened for modification	C:\Windows\bcastdvr\fontdrvhost.exe	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File opened for modification	C:\Windows\ModemLogs\RCX9B2F.tmp	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File opened for modification	C:\Windows\ModemLogs\RCX9B40.tmp	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
File opened for modification	C:\Windows\ModemLogs\conhost.exe	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	Registry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4984	schtasks.exe
2200	schtasks.exe
3876	schtasks.exe
4880	schtasks.exe
992	schtasks.exe
5900	schtasks.exe
920	schtasks.exe
5920	schtasks.exe
1600	schtasks.exe
3440	schtasks.exe
1320	schtasks.exe
5756	schtasks.exe
5080	schtasks.exe
5156	schtasks.exe
4960	schtasks.exe
3356	schtasks.exe
3192	schtasks.exe
1312	schtasks.exe
388	schtasks.exe
4852	schtasks.exe
5048	schtasks.exe
6064	schtasks.exe
1712	schtasks.exe
3548	schtasks.exe
5592	schtasks.exe
3412	schtasks.exe
372	schtasks.exe
1228	schtasks.exe
2848	schtasks.exe
1064	schtasks.exe
3700	schtasks.exe
2388	schtasks.exe
1880	schtasks.exe
1768	schtasks.exe
1016	schtasks.exe
2684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
1412	powershell.exe
1412	powershell.exe
5616	powershell.exe
5616	powershell.exe
3952	powershell.exe
3952	powershell.exe
544	powershell.exe
544	powershell.exe
5384	powershell.exe
5384	powershell.exe
4200	powershell.exe
4200	powershell.exe
2984	powershell.exe
2984	powershell.exe
5552	powershell.exe
5552	powershell.exe
5644	powershell.exe
5644	powershell.exe
2736	powershell.exe
2736	powershell.exe
6068	powershell.exe
6068	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	5616	powershell.exe
Token: SeDebugPrivilege	3952	powershell.exe
Token: SeDebugPrivilege	544	powershell.exe
Token: SeDebugPrivilege	5384	powershell.exe
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	5552	powershell.exe
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	4820	powershell.exe
Token: SeDebugPrivilege	5644	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeDebugPrivilege	4028	Registry.exe
Token: SeDebugPrivilege	5644	Registry.exe
Token: SeDebugPrivilege	4992	Registry.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 544	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	131
PID 2252 wrote to memory of 544	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	131
PID 2252 wrote to memory of 5616	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	132
PID 2252 wrote to memory of 5616	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	132
PID 2252 wrote to memory of 1412	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	133
PID 2252 wrote to memory of 1412	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	133
PID 2252 wrote to memory of 2984	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	134
PID 2252 wrote to memory of 2984	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	134
PID 2252 wrote to memory of 3952	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	135
PID 2252 wrote to memory of 3952	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	135
PID 2252 wrote to memory of 6068	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	136
PID 2252 wrote to memory of 6068	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	136
PID 2252 wrote to memory of 5644	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	137
PID 2252 wrote to memory of 5644	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	137
PID 2252 wrote to memory of 2736	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	139
PID 2252 wrote to memory of 2736	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	139
PID 2252 wrote to memory of 5552	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	140
PID 2252 wrote to memory of 5552	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	140
PID 2252 wrote to memory of 5384	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	142
PID 2252 wrote to memory of 5384	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	142
PID 2252 wrote to memory of 3940	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	144
PID 2252 wrote to memory of 3940	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	144
PID 2252 wrote to memory of 4820	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	145
PID 2252 wrote to memory of 4820	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	145
PID 2252 wrote to memory of 4200	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	146
PID 2252 wrote to memory of 4200	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	146
PID 2252 wrote to memory of 4028	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	157
PID 2252 wrote to memory of 4028	2252	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe	157
PID 4028 wrote to memory of 924	4028	Registry.exe	159
PID 4028 wrote to memory of 924	4028	Registry.exe	159
PID 4028 wrote to memory of 1548	4028	Registry.exe	160
PID 4028 wrote to memory of 1548	4028	Registry.exe	160
PID 924 wrote to memory of 5644	924	WScript.exe	169
PID 924 wrote to memory of 5644	924	WScript.exe	169
PID 5644 wrote to memory of 544	5644	Registry.exe	170
PID 5644 wrote to memory of 544	5644	Registry.exe	170
PID 5644 wrote to memory of 5672	5644	Registry.exe	171
PID 5644 wrote to memory of 5672	5644	Registry.exe	171
PID 544 wrote to memory of 4992	544	WScript.exe	173
PID 544 wrote to memory of 4992	544	WScript.exe	173
PID 4992 wrote to memory of 4656	4992	Registry.exe	174
PID 4992 wrote to memory of 4656	4992	Registry.exe	174
PID 4992 wrote to memory of 5188	4992	Registry.exe	175
PID 4992 wrote to memory of 5188	4992	Registry.exe	175

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a7fd5ae1f0d16e9069ca216d2f21ccf8.exe
"C:\Users\Admin\AppData\Local\Temp\a7fd5ae1f0d16e9069ca216d2f21ccf8.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/7330c8a20692d0b35002ea5a/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/f170d29a37c9c9775251/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4200
- C:\f170d29a37c9c9775251\Registry.exe
  "C:\f170d29a37c9c9775251\Registry.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4028
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d2f0d467-dbf7-46d9-a2c8-9fd1c9b14397.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\f170d29a37c9c9775251\Registry.exe
      C:\f170d29a37c9c9775251\Registry.exe
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:5644
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c8111ef-a548-4b77-be62-af5e14f9edeb.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:544
      - C:\f170d29a37c9c9775251\Registry.exe
        
        C:\f170d29a37c9c9775251\Registry.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4992
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fbfd83ba-fd1f-465f-878e-d1d8fc8570d3.vbs"
        7⤵
        
        PID:4656
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\053abf88-9d19-42c8-a5f0-9902536dbe50.vbs"
        7⤵
        
        PID:5188
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67008e17-f64e-4fe9-8171-b6c93708c27f.vbs"
        5⤵
        
        PID:5672
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72c1d055-ef74-46c6-9f6b-4a82034323c2.vbs"
    3⤵
    PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a7fd5ae1f0d16e9069ca216d2f21ccf8a" /sc MINUTE /mo 8 /tr "'C:\7330c8a20692d0b35002ea5a\a7fd5ae1f0d16e9069ca216d2f21ccf8.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a7fd5ae1f0d16e9069ca216d2f21ccf8" /sc ONLOGON /tr "'C:\7330c8a20692d0b35002ea5a\a7fd5ae1f0d16e9069ca216d2f21ccf8.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a7fd5ae1f0d16e9069ca216d2f21ccf8a" /sc MINUTE /mo 10 /tr "'C:\7330c8a20692d0b35002ea5a\a7fd5ae1f0d16e9069ca216d2f21ccf8.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\DESIGNER\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\DESIGNER\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a7fd5ae1f0d16e9069ca216d2f21ccf8a" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\a7fd5ae1f0d16e9069ca216d2f21ccf8.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a7fd5ae1f0d16e9069ca216d2f21ccf8" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\a7fd5ae1f0d16e9069ca216d2f21ccf8.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a7fd5ae1f0d16e9069ca216d2f21ccf8a" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\a7fd5ae1f0d16e9069ca216d2f21ccf8.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Documents\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\Documents\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Documents\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Templates\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Windows\bcastdvr\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\bcastdvr\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\bcastdvr\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Desktop\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Public\Desktop\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Desktop\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\f170d29a37c9c9775251\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\f170d29a37c9c9775251\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\f170d29a37c9c9775251\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Windows\ModemLogs\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\ModemLogs\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Windows\ModemLogs\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Photo Viewer\fr-FR\fontdrvhost.exe

Filesize
5.9MB

MD5
7b34d4c9c6ea5ea68bbcd611a682c110

SHA1
d1f3edec34c493151b4f33ef0d41ea67062dc05e

SHA256
546458f1be8ffe66dcb6d8b1bebfc1f2d1d295b20deee6c22a511cbfa0411a84

SHA512
4766527d36af965a712a087a662e0b6731973e8d521694f61d465934195f28154df93746c9e9a63a7039a5fb03ece2b5915ea207d4a10f6f6db51149b4f5e3f6

Download Submit
C:\ProgramData\Microsoft\Windows\Templates\csrss.exe

Filesize
5.9MB

MD5
a7fd5ae1f0d16e9069ca216d2f21ccf8

SHA1
9c7a2f7d780bb05baa0b592ca1547ba25bbcf4ea

SHA256
0deb67b0ba108bc58c86e696234379a5bdfb1f3de00269944c28113001695e47

SHA512
a317655fd45bd7d86393d02cf3471ba145fa696b73f6a4d1463ed81030a44ea68308f34b8beca3382f678c797e95b8f9be70902d91870e5f98139debb21ac353

Download Submit
C:\ProgramData\Microsoft\Windows\Templates\csrss.exe

Filesize
5.9MB

MD5
3018d01f32c6d3867f08a02c878ac04f

SHA1
b9b313d4256a3d463c188da6fa068eb2d4087f01

SHA256
a2405427fd3fa4b313d708de674fd04cc17aa20048029ac7eab5607662780d7e

SHA512
a4aec1a4266375206a5b5ab315cd4277920dca125d3111f660cc3d987993c3066789a1041a076ff9b9a5d23671ae27b72596930faf49fcb6b1cebc871f0092df

Download Submit
C:\Recovery\WindowsRE\dllhost.exe

Filesize
5.9MB

MD5
72fab280899b4d9fc767f6778314c985

SHA1
fc52da07da2f92f200bd19bb5d109a6d43728988

SHA256
fa359e5cd6abd3eb140110d46720ec2e6abb879700861dc30ac1f589a2342867

SHA512
3731b3e57adca8e8b013000d917bb6a6a64fc0b478f4b3c0f15ea9f3d98aa5e5281821425b2a60c2e2a81d3f39539c156f7adcb992a21d4aea91863db8909e7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log

Filesize
1KB

MD5
229da4b4256a6a948830de7ee5f9b298

SHA1
8118b8ddc115689ca9dc2fe8c244350333c5ba8b

SHA256
3d63b4a66e80ed97a8d74ea9dee7645942aafbd4abf1b31afed1027e5967fe11

SHA512
3a4ec8f720000a32bb1555b32db13236a73bb6e654e35b4de8bdb0fc0de535584bc08ebe25c7066324e86faa33e8f571a11cc4e5ef00be78e2993e228f615224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c667bc406c30dedf08683212c4a204b5

SHA1
4d713119a8483f32461a45e8291a2b8dc1fc4e7d

SHA256
0789d8328acb13062de330425e072019c1d81bea70923d5ef5428f9604d969cf

SHA512
1f6b49f11baf3b4289677d8b27537e016896fc878d14af3d8c132d6800a591a632b31203edd570f3f8b90e7c0047a4f4ecd938c10520832d2df55ba35a53bd48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
caf46b906a58e37d9a9d5830cca40ef7

SHA1
ba5b7fc4d909707ac0b0d23b0474a4ce4be344ea

SHA256
616b72a430081d6878826dc6ea2f1e4d3c890a7e084049fcaf30dcd2147727fd

SHA512
ba93462da88fea2be2fb3eecae32597c6c0248e77c6e05b43e0573a040f0784364e7abafede416c9eec466d9446a03d940628c977c45751b987a5da69c14ed00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
75b793d8785da13700a6ebd48c30d77d

SHA1
b7d004bac69f44d9c847a49933d1df3e4dafd5db

SHA256
ab63179aa6eded5be6820711bfa2b7a9ba0184e6247a9a2aa1ebd839aba08a6b

SHA512
37e43c7b8d21173bc02237c5e1871a79ec95a96984671eeb5f9863dfce157f5f2bc90a6102b1beac6c8c8f928aa5b5094ae822d953f3833ea4e119ec664d4070

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3c9a06205efb4ec6b1ca25ba605f9f6d

SHA1
53f4cbc7a0b1f493e53f99d49c08c56c2ac912f8

SHA256
4ef4ffb0f743afc2ee1bb8edcc10ec450439a82dbbbb9cbdebeee633db4cc61a

SHA512
e936041f7fe2278a939290bc2b5409a01ae070abc58df4e4bb938e4a406d0c96b19a1fa4db21b9f158efcfbe956f3ddbd97cb670215f2d6f2c1328fa4e455657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3fe089fecc1a7897c40a12707d788ca9

SHA1
97f8ab9020333729ec191b3dbd044c57227b84fc

SHA256
70d80df3a3a68fa45dd114205f58cc05df07e22940ec0f0f6172abfccf671e7c

SHA512
4e4feebea709ed3bbfd82ed507d04566593e9cb7bb02ca1056d8ecb6cbcd3b5118be5dee4ee80bf158565a009c05b217bd4c885fb1e01c7d61f5e3d430c940cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5fada736af27ab22d5e094bdb95102b0

SHA1
1f85d64684a657e88b138cfb7b3a51f472beb91f

SHA256
108d03e081aaef766e8052ffe6188c97e0ff663cc73516bc632aacb874b8876c

SHA512
9f9fecf23c0678eda9c19941f6565a1dd50185b86241a84a10b170c320d0d9f8e9187fc6c141e37d6e137167868df6f8838dac99cbfe44ac117aed605027873a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
82da496008a09abc336bf9adbe6453dd

SHA1
a57df6c2432c6bf7ab549a4333e636f9d9dfebd2

SHA256
69def38d01c34269e4e7be79130fc62befb01815c783fef6d4dc116672306810

SHA512
86d1efaf512d5ffc0af6a4508e63ffaa646971192762461957c0a544e77f9f24bbd0576927a6a996a87f147bcd6562bdc27a57caac6aad64354f485a7a7a7197

Download Submit
C:\Users\Admin\AppData\Local\Temp\1c8111ef-a548-4b77-be62-af5e14f9edeb.vbs

Filesize
712B

MD5
327b38f94276bd87490d2c873c912a0b

SHA1
9dd1d8646fc030dbaa4933e5944dd49c12c4f20b

SHA256
0346aadeabfefb2eaf5aac163089ce517ee92550feb88f484f71ed7c635a19b4

SHA512
6ca215a8b4b1c34743652efcce5cc0f93dc2f600968a020727e057322a784215dfefa9b19d747052473193b747b5bbd3d7fce7a1b466a0264b5cd7f7bd2e7b35

Download Submit
C:\Users\Admin\AppData\Local\Temp\72c1d055-ef74-46c6-9f6b-4a82034323c2.vbs

Filesize
488B

MD5
54b661ac60b50d189c9083452f1a4fee

SHA1
651a64fc3a5632a61592935582aef2075ff64cab

SHA256
a4d7e4adb0a23072b02900fe31cfb5272c31920ed998c46dc9e81b17d598f697

SHA512
39f4a9bda75450232b5f0d3269c9316bb706417a4ee3631ce7e6a2c4ed9b4d49691651ff14509d1966cce1baaba38d1caaef72c2e2476b063c83495ea37c8654

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ajsdeybu.e3q.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\d2f0d467-dbf7-46d9-a2c8-9fd1c9b14397.vbs

Filesize
712B

MD5
ec3abd95eb9ac67cba17496d8f930f47

SHA1
d9e2bab9d140d402ec429d21445ea8e781785c2b

SHA256
10661769c34d682f8e4db44b4c97bfac95395af8ff5b0906c53bf9304e730a88

SHA512
eef9307cfe0e5639d9dc8f489790f9d67769b6f08437a403dcc88649b962675a3048f2ff466c5822707eb94c0e845f5ea201fd401f311b1ca2e264f7d2909c14

Download Submit
C:\Users\Admin\AppData\Local\Temp\fbfd83ba-fd1f-465f-878e-d1d8fc8570d3.vbs

Filesize
712B

MD5
07b959d72f8554c60ca86605a4edf3bf

SHA1
d2daf7bf91d00e6a0a8f0c3418ec57510aebe193

SHA256
871cfa14c83d93c106703f1ae4b1c8c66edf07d080c81690f98511e7e422750d

SHA512
60d763ecbd97f1084e984b5744987878339fd2828f912f72e3bbc0c22d47c7a98680e219ea8695ce4ed19d951f59ebd40f231613e7feb4ab480cb99cfb5a90e9

Download Submit
C:\Windows\bcastdvr\fontdrvhost.exe

Filesize
5.9MB

MD5
1b2f3ac469468efbf210a5075a2e048c

SHA1
4e61388b1f93af1c7a599c5357f4527c139bba7a

SHA256
8af9463ee8e48ba65eb982a17711017a7390b8b4d47d839c1b7a97860b148f76

SHA512
315dca643ac38895daef5f227737be8390295c83033a1c54bc10e449022b3ab43390e8c2b2bbecd8019f78f892c8de93de94c1e0aa53c6d3380a348d3aac4cee

Download Submit
memory/2252-36-0x000000001D6A0000-0x000000001D6AE000-memory.dmp

Filesize
56KB

Download
memory/2252-18-0x000000001BBA0000-0x000000001BBF6000-memory.dmp

Filesize
344KB

Download
memory/2252-20-0x000000001BBF0000-0x000000001BBF8000-memory.dmp

Filesize
32KB

Download
memory/2252-24-0x000000001BC20000-0x000000001BC32000-memory.dmp

Filesize
72KB

Download
memory/2252-22-0x000000001BC10000-0x000000001BC18000-memory.dmp

Filesize
32KB

Download
memory/2252-27-0x000000001D420000-0x000000001D42C000-memory.dmp

Filesize
48KB

Download
memory/2252-26-0x000000001BC50000-0x000000001BC5C000-memory.dmp

Filesize
48KB

Download
memory/2252-25-0x000000001D950000-0x000000001DE78000-memory.dmp

Filesize
5.2MB

Download
memory/2252-29-0x000000001D440000-0x000000001D44C000-memory.dmp

Filesize
48KB

Download
memory/2252-28-0x000000001D430000-0x000000001D438000-memory.dmp

Filesize
32KB

Download
memory/2252-30-0x000000001D450000-0x000000001D45C000-memory.dmp

Filesize
48KB

Download
memory/2252-32-0x000000001D560000-0x000000001D56C000-memory.dmp

Filesize
48KB

Download
memory/2252-31-0x000000001D6D0000-0x000000001D6D8000-memory.dmp

Filesize
32KB

Download
memory/2252-0-0x00007FFAD8283000-0x00007FFAD8285000-memory.dmp

Filesize
8KB

Download
memory/2252-35-0x000000001D690000-0x000000001D698000-memory.dmp

Filesize
32KB

Download
memory/2252-34-0x000000001D580000-0x000000001D58E000-memory.dmp

Filesize
56KB

Download
memory/2252-33-0x000000001D570000-0x000000001D57A000-memory.dmp

Filesize
40KB

Download
memory/2252-37-0x000000001D6B0000-0x000000001D6B8000-memory.dmp

Filesize
32KB

Download
memory/2252-38-0x000000001D6C0000-0x000000001D6CC000-memory.dmp

Filesize
48KB

Download
memory/2252-39-0x000000001D6E0000-0x000000001D6E8000-memory.dmp

Filesize
32KB

Download
memory/2252-41-0x000000001D700000-0x000000001D70C000-memory.dmp

Filesize
48KB

Download
memory/2252-40-0x000000001D6F0000-0x000000001D6FA000-memory.dmp

Filesize
40KB

Download
memory/2252-19-0x000000001B980000-0x000000001B98C000-memory.dmp

Filesize
48KB

Download
memory/2252-21-0x000000001BC00000-0x000000001BC0C000-memory.dmp

Filesize
48KB

Download
memory/2252-17-0x000000001B970000-0x000000001B97A000-memory.dmp

Filesize
40KB

Download
memory/2252-16-0x000000001B940000-0x000000001B950000-memory.dmp

Filesize
64KB

Download
memory/2252-15-0x000000001B930000-0x000000001B938000-memory.dmp

Filesize
32KB

Download
memory/2252-198-0x00007FFAD8283000-0x00007FFAD8285000-memory.dmp

Filesize
8KB

Download
memory/2252-266-0x00007FFAD8280000-0x00007FFAD8D41000-memory.dmp

Filesize
10.8MB

Download
memory/2252-1-0x0000000000450000-0x0000000000D48000-memory.dmp

Filesize
9.0MB

Download
memory/2252-6-0x0000000003090000-0x0000000003098000-memory.dmp

Filesize
32KB

Download
memory/2252-390-0x00007FFAD8280000-0x00007FFAD8D41000-memory.dmp

Filesize
10.8MB

Download
memory/2252-8-0x000000001B8E0000-0x000000001B930000-memory.dmp

Filesize
320KB

Download
memory/2252-14-0x000000001B960000-0x000000001B96C000-memory.dmp

Filesize
48KB

Download
memory/2252-9-0x00000000030C0000-0x00000000030C8000-memory.dmp

Filesize
32KB

Download
memory/2252-11-0x00000000030E0000-0x00000000030F6000-memory.dmp

Filesize
88KB

Download
memory/2252-12-0x0000000003100000-0x0000000003108000-memory.dmp

Filesize
32KB

Download
memory/2252-13-0x000000001B950000-0x000000001B962000-memory.dmp

Filesize
72KB

Download
memory/2252-10-0x00000000030D0000-0x00000000030E0000-memory.dmp

Filesize
64KB

Download
memory/2252-7-0x00000000030A0000-0x00000000030BC000-memory.dmp

Filesize
112KB

Download
memory/2252-4-0x0000000002F50000-0x0000000002F5E000-memory.dmp

Filesize
56KB

Download
memory/2252-5-0x0000000002F60000-0x0000000002F6E000-memory.dmp

Filesize
56KB

Download
memory/2252-3-0x00007FFAD8280000-0x00007FFAD8D41000-memory.dmp

Filesize
10.8MB

Download
memory/2252-2-0x00000000014D0000-0x00000000014D1000-memory.dmp

Filesize
4KB

Download
memory/4992-445-0x000000001D740000-0x000000001D752000-memory.dmp

Filesize
72KB

Download
memory/5616-265-0x00000219ADCA0000-0x00000219ADCC2000-memory.dmp

Filesize
136KB

Download
memory/5644-432-0x000000001D080000-0x000000001D092000-memory.dmp

Filesize
72KB

Download