dcrat | d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
26/03/2025, 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Size

1.1MB
MD5

66c9a250fe9e60c4df2c9a157ae39211
SHA1

cabc35fd42f4534f5e05b5b9bd65dcfc85e469a7
SHA256

d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd
SHA512

1439934414be0b92acf1b51e6b3ba0a1ad296b879361f42fc557b740bde42204515bbbccfe5e9c74b702caf786c201ececee76bc5841618560f56de047c9cdc8
SSDEEP

12288:amc4TfAkdN7TPPl2Eh8Nv6L1FMCubuoGTeh46qTnnCPQeB89hNuD1hOp1i3l10gR:ah4TbLUEhZL/GspeYhkc9Soh2SfwJ

Score

10^/10

dcrat defense_evasion execution infostealer persistence rat trojan

Malware Config

Signatures

DcRat 10 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2928	schtasks.exe
		2656	schtasks.exe
		2628	schtasks.exe
		2432	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
		2740	schtasks.exe
		2620	schtasks.exe
		2696	schtasks.exe
		2580	schtasks.exe
		2472	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 9 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\Idle.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\WmiPrvSE.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\kbdnecnt\\sppsvc.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\PerfLogs\\Admin\\csrss.exe\", \"C:\\Windows\\System32\\wininet\\dwm.exe\", \"C:\\Windows\\Setup\\State\\taskhost.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\Idle.exe\", \"C:\\Windows\\System32\\DiagCpl\\dllhost.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\kbdnecnt\\sppsvc.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\kbdnecnt\\sppsvc.exe\", \"C:\\Users\\Default User\\csrss.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\kbdnecnt\\sppsvc.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\PerfLogs\\Admin\\csrss.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\kbdnecnt\\sppsvc.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\PerfLogs\\Admin\\csrss.exe\", \"C:\\Windows\\System32\\wininet\\dwm.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\kbdnecnt\\sppsvc.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\PerfLogs\\Admin\\csrss.exe\", \"C:\\Windows\\System32\\wininet\\dwm.exe\", \"C:\\Windows\\Setup\\State\\taskhost.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\kbdnecnt\\sppsvc.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\PerfLogs\\Admin\\csrss.exe\", \"C:\\Windows\\System32\\wininet\\dwm.exe\", \"C:\\Windows\\Setup\\State\\taskhost.exe\", \"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\Idle.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	2784	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	2784	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2784	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2784	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2784	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2784	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2784	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2784	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2784	schtasks.exe	30

UAC bypass 3 TTPs 48 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
292	powershell.exe
2224	powershell.exe
800	powershell.exe
2180	powershell.exe
2624	powershell.exe
2188	powershell.exe
1572	powershell.exe
1736	powershell.exe
1740	powershell.exe
1688	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe

Executes dropped EXE 15 IoCs

pid	Process
1300	taskhost.exe
3052	taskhost.exe
1488	taskhost.exe
1404	taskhost.exe
2672	taskhost.exe
2604	taskhost.exe
1004	taskhost.exe
2548	taskhost.exe
2464	taskhost.exe
988	taskhost.exe
1480	taskhost.exe
1016	taskhost.exe
1304	taskhost.exe
1700	taskhost.exe
988	taskhost.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\Setup\\State\\taskhost.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\Idle.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\wininet\\dwm.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\DiagCpl\\dllhost.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\\Idle.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\WmiPrvSE.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\WmiPrvSE.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default User\\csrss.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\PerfLogs\\Admin\\csrss.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default User\\csrss.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\Setup\\State\\taskhost.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\DiagCpl\\dllhost.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\kbdnecnt\\sppsvc.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\kbdnecnt\\sppsvc.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\PerfLogs\\Admin\\csrss.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\wininet\\dwm.exe\""	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe

Checks whether UAC is enabled 1 TTPs 32 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\kbdnecnt\sppsvc.exe	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
File opened for modification	C:\Windows\System32\wininet\RCX9F51.tmp	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
File created	C:\Windows\System32\kbdnecnt\0a1fd5f707cd16	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
File opened for modification	C:\Windows\System32\kbdnecnt\RCX9946.tmp	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
File opened for modification	C:\Windows\System32\wininet\dwm.exe	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
File opened for modification	C:\Windows\System32\DiagCpl\RCXA55C.tmp	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
File opened for modification	C:\Windows\System32\DiagCpl\dllhost.exe	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
File created	C:\Windows\System32\kbdnecnt\sppsvc.exe	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
File created	C:\Windows\System32\wininet\dwm.exe	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
File created	C:\Windows\System32\wininet\6cb0b6c459d5d3	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
File created	C:\Windows\System32\DiagCpl\dllhost.exe	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
File created	C:\Windows\System32\DiagCpl\5940a34987c991	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\24dbde2999530e	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX96D5.tmp	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Setup\State\taskhost.exe	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
File created	C:\Windows\Setup\State\b75386f1303e64	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
File opened for modification	C:\Windows\Setup\State\RCXA155.tmp	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
File opened for modification	C:\Windows\Setup\State\taskhost.exe	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2472	schtasks.exe
2928	schtasks.exe
2656	schtasks.exe
2628	schtasks.exe
2432	schtasks.exe
2740	schtasks.exe
2620	schtasks.exe
2696	schtasks.exe
2580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
800	powershell.exe
2188	powershell.exe
1572	powershell.exe
1736	powershell.exe
292	powershell.exe
1740	powershell.exe
2180	powershell.exe
2624	powershell.exe
2224	powershell.exe
1688	powershell.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
1300	taskhost.exe
3052	taskhost.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Token: SeDebugPrivilege	800	powershell.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	292	powershell.exe
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	1300	taskhost.exe
Token: SeDebugPrivilege	3052	taskhost.exe
Token: SeDebugPrivilege	1488	taskhost.exe
Token: SeDebugPrivilege	1404	taskhost.exe
Token: SeDebugPrivilege	2672	taskhost.exe
Token: SeDebugPrivilege	2604	taskhost.exe
Token: SeDebugPrivilege	1004	taskhost.exe
Token: SeDebugPrivilege	2548	taskhost.exe
Token: SeDebugPrivilege	2464	taskhost.exe
Token: SeDebugPrivilege	988	taskhost.exe
Token: SeDebugPrivilege	1480	taskhost.exe
Token: SeDebugPrivilege	1016	taskhost.exe
Token: SeDebugPrivilege	1304	taskhost.exe
Token: SeDebugPrivilege	1700	taskhost.exe
Token: SeDebugPrivilege	988	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1740	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	40
PID 1628 wrote to memory of 1740	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	40
PID 1628 wrote to memory of 1740	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	40
PID 1628 wrote to memory of 1736	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	41
PID 1628 wrote to memory of 1736	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	41
PID 1628 wrote to memory of 1736	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	41
PID 1628 wrote to memory of 1572	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	42
PID 1628 wrote to memory of 1572	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	42
PID 1628 wrote to memory of 1572	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	42
PID 1628 wrote to memory of 1688	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	44
PID 1628 wrote to memory of 1688	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	44
PID 1628 wrote to memory of 1688	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	44
PID 1628 wrote to memory of 2188	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	45
PID 1628 wrote to memory of 2188	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	45
PID 1628 wrote to memory of 2188	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	45
PID 1628 wrote to memory of 800	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	47
PID 1628 wrote to memory of 800	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	47
PID 1628 wrote to memory of 800	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	47
PID 1628 wrote to memory of 2624	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	48
PID 1628 wrote to memory of 2624	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	48
PID 1628 wrote to memory of 2624	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	48
PID 1628 wrote to memory of 292	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	50
PID 1628 wrote to memory of 292	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	50
PID 1628 wrote to memory of 292	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	50
PID 1628 wrote to memory of 2180	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	51
PID 1628 wrote to memory of 2180	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	51
PID 1628 wrote to memory of 2180	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	51
PID 1628 wrote to memory of 2224	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	52
PID 1628 wrote to memory of 2224	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	52
PID 1628 wrote to memory of 2224	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	52
PID 1628 wrote to memory of 1300	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	60
PID 1628 wrote to memory of 1300	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	60
PID 1628 wrote to memory of 1300	1628	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe	60
PID 1300 wrote to memory of 2132	1300	taskhost.exe	61
PID 1300 wrote to memory of 2132	1300	taskhost.exe	61
PID 1300 wrote to memory of 2132	1300	taskhost.exe	61
PID 1300 wrote to memory of 1616	1300	taskhost.exe	62
PID 1300 wrote to memory of 1616	1300	taskhost.exe	62
PID 1300 wrote to memory of 1616	1300	taskhost.exe	62
PID 2132 wrote to memory of 3052	2132	WScript.exe	64
PID 2132 wrote to memory of 3052	2132	WScript.exe	64
PID 2132 wrote to memory of 3052	2132	WScript.exe	64
PID 3052 wrote to memory of 2848	3052	taskhost.exe	65
PID 3052 wrote to memory of 2848	3052	taskhost.exe	65
PID 3052 wrote to memory of 2848	3052	taskhost.exe	65
PID 3052 wrote to memory of 2836	3052	taskhost.exe	66
PID 3052 wrote to memory of 2836	3052	taskhost.exe	66
PID 3052 wrote to memory of 2836	3052	taskhost.exe	66
PID 2848 wrote to memory of 1488	2848	WScript.exe	67
PID 2848 wrote to memory of 1488	2848	WScript.exe	67
PID 2848 wrote to memory of 1488	2848	WScript.exe	67
PID 1488 wrote to memory of 2332	1488	taskhost.exe	68
PID 1488 wrote to memory of 2332	1488	taskhost.exe	68
PID 1488 wrote to memory of 2332	1488	taskhost.exe	68
PID 1488 wrote to memory of 2416	1488	taskhost.exe	69
PID 1488 wrote to memory of 2416	1488	taskhost.exe	69
PID 1488 wrote to memory of 2416	1488	taskhost.exe	69
PID 2332 wrote to memory of 1404	2332	WScript.exe	70
PID 2332 wrote to memory of 1404	2332	WScript.exe	70
PID 2332 wrote to memory of 1404	2332	WScript.exe	70
PID 1404 wrote to memory of 1648	1404	taskhost.exe	71
PID 1404 wrote to memory of 1648	1404	taskhost.exe	71
PID 1404 wrote to memory of 1648	1404	taskhost.exe	71
PID 1404 wrote to memory of 1900	1404	taskhost.exe	72

System policy modification 1 TTPs 48 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
"C:\Users\Admin\AppData\Local\Temp\d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\kbdnecnt\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PerfLogs\Admin\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\wininet\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Setup\State\taskhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\DiagCpl\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2224
- C:\Windows\Setup\State\taskhost.exe
  "C:\Windows\Setup\State\taskhost.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1300
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e12681ab-8eb0-4298-94a5-16ef971554d5.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Windows\Setup\State\taskhost.exe
      C:\Windows\Setup\State\taskhost.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3052
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\404422ea-99b6-4d48-8c07-3ad763969928.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2848
      - C:\Windows\Setup\State\taskhost.exe
        
        C:\Windows\Setup\State\taskhost.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\53c7bfb3-6d82-4b16-8901-d4e6782a7728.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Windows\Setup\State\taskhost.exe
        
        C:\Windows\Setup\State\taskhost.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1404
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4571d38e-18cf-4691-98bd-68662e526b43.vbs"
        9⤵
        
        PID:1648
        
        C:\Windows\Setup\State\taskhost.exe
        
        C:\Windows\Setup\State\taskhost.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2672
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d4db6cb-ccae-40fd-846c-a531fbd2f2af.vbs"
        11⤵
        
        PID:1492
        
        C:\Windows\Setup\State\taskhost.exe
        
        C:\Windows\Setup\State\taskhost.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2604
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d9712ff9-c267-43e1-81b4-962f660e9afa.vbs"
        13⤵
        
        PID:2140
        
        C:\Windows\Setup\State\taskhost.exe
        
        C:\Windows\Setup\State\taskhost.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1004
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7c3b44ab-138f-487d-9f61-9e45ceae1191.vbs"
        15⤵
        
        PID:2228
        
        C:\Windows\Setup\State\taskhost.exe
        
        C:\Windows\Setup\State\taskhost.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d4233b04-fe2a-411d-8c9a-169ebb3f7e34.vbs"
        17⤵
        
        PID:2280
        
        C:\Windows\Setup\State\taskhost.exe
        
        C:\Windows\Setup\State\taskhost.exe
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0ad69e25-e49d-4265-8ee5-e754931d7c15.vbs"
        19⤵
        
        PID:2812
        
        C:\Windows\Setup\State\taskhost.exe
        
        C:\Windows\Setup\State\taskhost.exe
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\138bb80b-0744-452b-a4b1-c8659076315a.vbs"
        21⤵
        
        PID:1792
        
        C:\Windows\Setup\State\taskhost.exe
        
        C:\Windows\Setup\State\taskhost.exe
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1480
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a6b18df-f87b-4006-a958-d16134b4ce32.vbs"
        23⤵
        
        PID:2820
        
        C:\Windows\Setup\State\taskhost.exe
        
        C:\Windows\Setup\State\taskhost.exe
        24⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1016
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\382a35fc-4aff-44ee-a498-68d06ca3431e.vbs"
        25⤵
        
        PID:556
        
        C:\Windows\Setup\State\taskhost.exe
        
        C:\Windows\Setup\State\taskhost.exe
        26⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1304
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c710ac98-2b1c-4c15-ab2d-8ee1737b9f15.vbs"
        27⤵
        
        PID:1040
        
        C:\Windows\Setup\State\taskhost.exe
        
        C:\Windows\Setup\State\taskhost.exe
        28⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1700
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f824855-159c-4bc8-ac41-a429c9eafe54.vbs"
        29⤵
        
        PID:2544
        
        C:\Windows\Setup\State\taskhost.exe
        
        C:\Windows\Setup\State\taskhost.exe
        30⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4835ec2a-6c68-424d-bca8-86c9a072a3f6.vbs"
        31⤵
        
        PID:560
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8eb9cff-63b6-4f1e-920c-82f75a4cf2ea.vbs"
        31⤵
        
        PID:1452
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36f02cb8-54bd-41e4-bbe8-a48fc2df236c.vbs"
        29⤵
        
        PID:2688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a63af484-c1a3-4fa0-b702-c2f8f73a77d7.vbs"
        27⤵
        
        PID:288
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\431972bc-3c27-4d5d-9b06-93ef03f6f710.vbs"
        25⤵
        
        PID:1436
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ecc552dd-ddfc-4907-bae3-5e9247b40c0e.vbs"
        23⤵
        
        PID:1384
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc26dc52-8fe0-4fcd-9fe2-677e2f8073c5.vbs"
        21⤵
        
        PID:2860
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\549b4482-d3bf-4afe-a6c8-0e814c6d4337.vbs"
        19⤵
        
        PID:2344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9b0aedb0-6123-4330-b6e5-7344860e7002.vbs"
        17⤵
        
        PID:2052
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e6c2df0-5dd2-4654-a98a-f5c9b20e3f5e.vbs"
        15⤵
        
        PID:3024
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9d5c45c2-c1e3-42f7-b46a-9ef4aad4b495.vbs"
        13⤵
        
        PID:2284
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb4be401-2e8c-4c31-bdc3-7aba94d0a042.vbs"
        11⤵
        
        PID:2472
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3eb8e001-8294-46b9-9c75-2c83010c81a0.vbs"
        9⤵
        
        PID:1900
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b1888c43-bd4a-4cbb-bcab-a858435a0c91.vbs"
        7⤵
        
        PID:2416
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ac5865c-e768-44a1-9ed6-633f55163181.vbs"
        5⤵
        
        PID:2836
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a223cbba-51e4-44ff-8810-a33b51441a2b.vbs"
    3⤵
    PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\kbdnecnt\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\PerfLogs\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\wininet\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\Setup\State\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\DiagCpl\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\csrss.exe

Filesize
1.1MB

MD5
66c9a250fe9e60c4df2c9a157ae39211

SHA1
cabc35fd42f4534f5e05b5b9bd65dcfc85e469a7

SHA256
d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd

SHA512
1439934414be0b92acf1b51e6b3ba0a1ad296b879361f42fc557b740bde42204515bbbccfe5e9c74b702caf786c201ececee76bc5841618560f56de047c9cdc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\0ad69e25-e49d-4265-8ee5-e754931d7c15.vbs

Filesize
711B

MD5
efd10f08773f4b5899b2d4a1dcf09875

SHA1
b5a15a321674c0a9929751423a8ff6575b72df30

SHA256
e621c277dda3a1b95fed0230d708b874e5ca7e533af5d7728ca12ebba39c39a7

SHA512
a26c0bf72c314a8e533fbb593ae47ed46058502fe7f0704f4c5c6881504b81c880fede24a99b8b8c9e66eb68e97b8c1f0a6c3e487db198c52ca72de3824334db

Download Submit
C:\Users\Admin\AppData\Local\Temp\0f824855-159c-4bc8-ac41-a429c9eafe54.vbs

Filesize
711B

MD5
c2ee4a0a8af3a868a6b00ae7f8a84b9a

SHA1
fbeb54ace88a052c85631e7532780f01a27b40e0

SHA256
7b35954be99ba45f2502fe131326fb2722ffda47c712e87b0c2f4d9695464391

SHA512
7a776c31f7b1c85099c1f4c4bb5ba7d1181b267b73beb613e9d5d07cea2d3bb40c214a33f73080a0d735af7278ba080894fb934789a13764476975ae8be07105

Download Submit
C:\Users\Admin\AppData\Local\Temp\138bb80b-0744-452b-a4b1-c8659076315a.vbs

Filesize
710B

MD5
67f99f5b3eb2e345306e65f94d8dda3d

SHA1
bf5f8191a0c2fa3bda961ce2b3bea62ad808338d

SHA256
7f45aabb63c8106f3380b16da34f36ab293e0c80200487f2a240c2c9226b0009

SHA512
9f456e0f1390d6fa299047f4b49588e3b7d290a99043457323b65a191bec4554d3fbca974002d9b6eb9d6196b09fff4f114662d65325b02c400ec172f58c0718

Download Submit
C:\Users\Admin\AppData\Local\Temp\382a35fc-4aff-44ee-a498-68d06ca3431e.vbs

Filesize
711B

MD5
26bec5d637ccddb091531a34170cbd0a

SHA1
de8c379931dbc962f4b90a3e265e035f60e37b08

SHA256
a49eb26d68f49aaec2a3abf981358ca44605e31e68de038d0e7d2a4a80772c35

SHA512
122ab6a7593577bacc45e85aa17c23bb7744bcbecdfc9d0a274347d3603b06d2102531b2ab726bda074da2b83396a1c3561224dee9241b574997420ff284589b

Download Submit
C:\Users\Admin\AppData\Local\Temp\404422ea-99b6-4d48-8c07-3ad763969928.vbs

Filesize
711B

MD5
afcbacfe1761f7399b840baf9e000f99

SHA1
d93f5c1780e5f393a75ac614def3704405d2a2ea

SHA256
3b4ca81a8eab65adb5ca26edbb9d08af1521d5a9a7421557913ebd1106e78eb0

SHA512
2de5d27fef1459af1b78f518fb5a82e7da9cf697ee1735b7cdc050330441f06b498c2117ced88ec6bc485b5a49ae694af6712a16f2cbd8b67326daaf04411257

Download Submit
C:\Users\Admin\AppData\Local\Temp\4571d38e-18cf-4691-98bd-68662e526b43.vbs

Filesize
711B

MD5
d51b10b96851d82d79d8f062559d70cc

SHA1
2c1b786a6b3cb8ed5b3e7606ad7bd36219a55907

SHA256
4d3a0534b59539f2f0603a18071fa70fd2509db0b0d1975c3d9a9efb02d24d1f

SHA512
82a3a0793d0cb246598cf129cbc079d997888bf0cdf772055478414941bd36a694bb5e76e0a0e2bc8535ffb6441ee97f7b162485f3c8f36c53eba4faa7ea46e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\53c7bfb3-6d82-4b16-8901-d4e6782a7728.vbs

Filesize
711B

MD5
875e67cc38d00dd9ef7b33f325d2fa35

SHA1
4a11ce63c57813d87cfa7ea91832093434a51a46

SHA256
e358a1602c2f17afe6a7518ca3e6876850377d09d36b501dff74daecfa604bc3

SHA512
a6efbdd09fb7908162daf668aa1be0bc4bd732a857a9e651e8b2f72a85ddf9a346ea7a888e2de0e08bbe71e03a95ce43d87f93a3974ab257068a0a4ed32ff012

Download Submit
C:\Users\Admin\AppData\Local\Temp\6a6b18df-f87b-4006-a958-d16134b4ce32.vbs

Filesize
711B

MD5
7197ab1645ed91db01f19508c64cc49d

SHA1
3a14cf030213381bd7cea79a23adba1c23f79a8f

SHA256
5cedb68b3f90b501fddabc3f4cc3b7cadb825d30358e07c2cecf91e4f399c80a

SHA512
76967aaeb16cbaabd71a1ebe33ea6da6dc511f838ddcfab6e1c56c45ee4c5076f0bc0715b518c042808fdf774bfb545f1001264e24e55320e787c48c2e76b620

Download Submit
C:\Users\Admin\AppData\Local\Temp\7c3b44ab-138f-487d-9f61-9e45ceae1191.vbs

Filesize
711B

MD5
620d12ac6072949ae45a1b09b6f0b94c

SHA1
b3960bb3c209e52f0046e31a230250c920e3077e

SHA256
bc604dc194fe4fe9d04a943d8dd4a89acb67c99737c105db324f654f63b54d20

SHA512
68174905e872f2193f0bc1c86a0771c9ac600c4622da25b86f78ee92b611b7170d94c0f5a7d75932fb9ec96884583666fd8b62b5230980f3777f6b4dd09970fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\8d4db6cb-ccae-40fd-846c-a531fbd2f2af.vbs

Filesize
711B

MD5
f6e27c57fdb696e6c7a50a91bce9fa69

SHA1
2b3b03ae6d81f48d71f33271b79c319274d0fe6d

SHA256
a6344409e81ab1f0b79f46310b2059056a524991fa1a88098971173d61a24d47

SHA512
03f7554c763905f38e8bbbc147120ed4e0aeb51103f8ad216a00adb237ccc9b30f3bff08bffdad1ca3a366f87053fcddabe8b44a5cec69ed1ea7aecdef8505b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\a223cbba-51e4-44ff-8810-a33b51441a2b.vbs

Filesize
487B

MD5
f9650d298b6ef335aed63dca00da4243

SHA1
dd0eb9d45709fb2daf1e80cbf94d5cc0faa15889

SHA256
c62dee5344ee82a4e29a0b19ae9bf286e31036665834b20a8768a7df72fbe5e4

SHA512
2cdc6297b04aa9d1ba724a23289e302f21a19679c01a5cd7090e8c9a666219798c2a4156c88be51f6c6cf46c7bbaae2261b4262c9b21418759a5f0faf34943da

Download Submit
C:\Users\Admin\AppData\Local\Temp\c710ac98-2b1c-4c15-ab2d-8ee1737b9f15.vbs

Filesize
711B

MD5
2e0b5085195264ae4e7c82980781d491

SHA1
41d7b914a196ad55b63ea9bf4e530497dbfd2d8b

SHA256
da1973dffa81aa8060cff31cc5d538ca42fe00af086a7d59b50d7e30d9d376d7

SHA512
38e9fb0e78a5fb40f6664321190eb6167f5d25521be7b735ad03ddbd3158ad08be98ca1f6caba7a877078e073a0e167c97f357f822c08b7f3b74086802e80ac8

Download Submit
C:\Users\Admin\AppData\Local\Temp\d4233b04-fe2a-411d-8c9a-169ebb3f7e34.vbs

Filesize
711B

MD5
bab87d743327426d3a350d4518bd331a

SHA1
59fcac833d22485d975effc4488b0619e7aaabfc

SHA256
08780b85e7320b9d67000726f3ba9b8520d066795cf65674d1fcc15012da16d7

SHA512
3d0706e0d47085fda3b2fb75f6aa6e915c1ef7187b71add38a18d25d824e6ae8a2fd19c40f86df5ecb96449a18b34e7db7e0ba49c5a6c9ad10480461144a3990

Download Submit
C:\Users\Admin\AppData\Local\Temp\d9712ff9-c267-43e1-81b4-962f660e9afa.vbs

Filesize
711B

MD5
9ac245b05fff63806880987d15847de7

SHA1
50752e5961b61f6bb03e4d25cc6924b4cede58e6

SHA256
60b4ff335029428604e4df9fa293fb88dfea81be2a901492d99b8349309f4ad8

SHA512
16a6ea8120aa6b823959bb20ecdd294843c60c99bc97a779f73aa70f34db0e8ba400274be75069bd613e50c6a9952f3a65114f18d23f19a20ab06e13132d4f5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\e12681ab-8eb0-4298-94a5-16ef971554d5.vbs

Filesize
711B

MD5
65e8225b0821a86ecb508a7a883eeb7b

SHA1
113c8fe2c37ce1600ecc03ebbfaf2df8a8365612

SHA256
586e587719ef32bb70c7257ded8b4ac28ef468bf9815fb371dbc2452f8a310ee

SHA512
10e471b16a627bf7924c5fe315c55c2177f2c70b86e56f8284ad8d08db8b204ded0e001e791c7db9d9a344be33a2cd57d40f54e8fc241250fd8eb0c5456b87f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\78SLGGIAGS0P3LRT6458.temp

Filesize
7KB

MD5
c4742dc63f84ab8f0274c786b48066fd

SHA1
74a3f2a8fe46c547d82c8603e4b2c9daa279e37b

SHA256
1e4d3a3772c7520daec13c8b75ed6dd2a142079c876ac5898a51e7f2b2f8505d

SHA512
b20d42fe46df9f4a7e0b234576e64a5807265cefda54f69324b6134d2a35349ea158aecf15994f744e4fb7bb50634803690f7ce9d9c40dc97c2f564615e8bb15

Download Submit
memory/800-113-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/988-326-0x0000000000320000-0x0000000000434000-memory.dmp

Filesize
1.1MB

Download
memory/988-268-0x0000000000D20000-0x0000000000E34000-memory.dmp

Filesize
1.1MB

Download
memory/1004-232-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/1016-292-0x0000000001320000-0x0000000001434000-memory.dmp

Filesize
1.1MB

Download
memory/1300-159-0x0000000000A20000-0x0000000000B34000-memory.dmp

Filesize
1.1MB

Download
memory/1404-197-0x0000000000EB0000-0x0000000000FC4000-memory.dmp

Filesize
1.1MB

Download
memory/1480-280-0x0000000000370000-0x0000000000484000-memory.dmp

Filesize
1.1MB

Download
memory/1488-184-0x0000000000170000-0x0000000000284000-memory.dmp

Filesize
1.1MB

Download
memory/1488-185-0x0000000000160000-0x0000000000172000-memory.dmp

Filesize
72KB

Download
memory/1628-9-0x00000000008E0000-0x00000000008EC000-memory.dmp

Filesize
48KB

Download
memory/1628-20-0x000000001AC50000-0x000000001AC5C000-memory.dmp

Filesize
48KB

Download
memory/1628-0-0x000007FEF5903000-0x000007FEF5904000-memory.dmp

Filesize
4KB

Download
memory/1628-17-0x000000001AC30000-0x000000001AC3C000-memory.dmp

Filesize
48KB

Download
memory/1628-1-0x0000000000090000-0x00000000001A4000-memory.dmp

Filesize
1.1MB

Download
memory/1628-13-0x000000001ABF0000-0x000000001ABFA000-memory.dmp

Filesize
40KB

Download
memory/1628-160-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/1628-24-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/1628-12-0x000000001A810000-0x000000001A818000-memory.dmp

Filesize
32KB

Download
memory/1628-16-0x000000001AC20000-0x000000001AC28000-memory.dmp

Filesize
32KB

Download
memory/1628-11-0x0000000000900000-0x0000000000910000-memory.dmp

Filesize
64KB

Download
memory/1628-2-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/1628-10-0x00000000008F0000-0x0000000000900000-memory.dmp

Filesize
64KB

Download
memory/1628-15-0x000000001AC10000-0x000000001AC1A000-memory.dmp

Filesize
40KB

Download
memory/1628-14-0x000000001AC00000-0x000000001AC0C000-memory.dmp

Filesize
48KB

Download
memory/1628-21-0x000000001AC60000-0x000000001AC68000-memory.dmp

Filesize
32KB

Download
memory/1628-3-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/1628-18-0x000000001AC40000-0x000000001AC48000-memory.dmp

Filesize
32KB

Download
memory/1628-4-0x0000000000570000-0x0000000000582000-memory.dmp

Filesize
72KB

Download
memory/1628-6-0x0000000000580000-0x000000000058A000-memory.dmp

Filesize
40KB

Download
memory/1628-8-0x00000000008D0000-0x00000000008D8000-memory.dmp

Filesize
32KB

Download
memory/1628-5-0x0000000000590000-0x000000000059C000-memory.dmp

Filesize
48KB

Download
memory/1628-7-0x00000000008C0000-0x00000000008CC000-memory.dmp

Filesize
48KB

Download
memory/1700-315-0x0000000000140000-0x0000000000254000-memory.dmp

Filesize
1.1MB

Download
memory/2188-118-0x0000000001D20000-0x0000000001D28000-memory.dmp

Filesize
32KB

Download
memory/2464-256-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2464-255-0x0000000000360000-0x0000000000474000-memory.dmp

Filesize
1.1MB

Download
memory/2672-209-0x00000000011E0000-0x00000000012F4000-memory.dmp

Filesize
1.1MB

Download
memory/3052-172-0x0000000000380000-0x0000000000392000-memory.dmp

Filesize
72KB

Download
memory/3052-171-0x0000000000200000-0x0000000000314000-memory.dmp

Filesize
1.1MB

Download