dcrat | 54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88

Analysis

max time kernel
136s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
Size

1.3MB
MD5

48c2137034bee9bdfc2c9df1e71e9e04
SHA1

573e8453bc08e2b4e8e65b8560d81b150a9acdd8
SHA256

54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88
SHA512

5c854bfa2b963039db83cf764ea0ddb513c612896c325acdd944bbb115858153cac15addbf18da208cf8753b60f774e7a61e0540fd82445f29f9d47a31c2b247
SSDEEP

24576:q0bcg1vqd25Gl35KcbOwGqq+AZbPxtDSk5/FX5vDlIXNQdS:qGy/3dSnEYFJvxS

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	508	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	392	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3712	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	4992	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	4992	schtasks.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

RuntimeBroker.exeRuntimeBroker.exe54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exeRuntimeBroker.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe

DCRat payload 2 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
rat

Processes:

resource yara_rule

behavioral2/memory/2920-1-0x00000000008B0000-0x0000000000A06000-memory.dmp dcrat
C:\Program Files\Windows Photo Viewer\ja-JP\csrss.exe dcrat
Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

2328 powershell.exe
1744 powershell.exe
3008 powershell.exe
1896 powershell.exe
3844 powershell.exe
1448 powershell.exe
4596 powershell.exe
900 powershell.exe
2456 powershell.exe
1584 powershell.exe

resource	yara_rule
behavioral2/memory/2920-1-0x00000000008B0000-0x0000000000A06000-memory.dmp	dcrat
C:\Program Files\Windows Photo Viewer\ja-JP\csrss.exe	dcrat

pid	process
2328	powershell.exe
1744	powershell.exe
3008	powershell.exe
1896	powershell.exe
3844	powershell.exe
1448	powershell.exe
4596	powershell.exe
900	powershell.exe
2456	powershell.exe
1584	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RuntimeBroker.exeRuntimeBroker.exe54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exeRuntimeBroker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 7 IoCs

Processes:

RuntimeBroker.exeRuntimeBroker.exeRuntimeBroker.exeRuntimeBroker.exeRuntimeBroker.exeRuntimeBroker.exeRuntimeBroker.exe

pid process

3292 RuntimeBroker.exe
4196 RuntimeBroker.exe
2448 RuntimeBroker.exe
4576 RuntimeBroker.exe
3728 RuntimeBroker.exe
1184 RuntimeBroker.exe
1096 RuntimeBroker.exe

pid	process
3292	RuntimeBroker.exe
4196	RuntimeBroker.exe
2448	RuntimeBroker.exe
4576	RuntimeBroker.exe
3728	RuntimeBroker.exe
1184	RuntimeBroker.exe
1096	RuntimeBroker.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

RuntimeBroker.exeRuntimeBroker.exe54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exeRuntimeBroker.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

28 pastebin.com
29 pastebin.com
31 pastebin.com
45 pastebin.com

flow	ioc
28	pastebin.com
29	pastebin.com
31	pastebin.com
45	pastebin.com

Drops file in Program Files directory 7 IoCs

Processes:

54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe

description	ioc	process
File created	C:\Program Files\Windows Security\BrowserCore\9e8d7a4ca61bd9	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\sppsvc.exe	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\sppsvc.exe	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\0a1fd5f707cd16	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\csrss.exe	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\886983d96e3d3e	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
File created	C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe

Drops file in Windows directory 4 IoCs

Processes:

54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe

description	ioc	process
File created	C:\Windows\BitLockerDiscoveryVolumeContents\dllhost.exe	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\5940a34987c991	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
File created	C:\Windows\PLA\SearchApp.exe	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
File created	C:\Windows\PLA\38384e6a620884	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

Processes:

54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exeRuntimeBroker.exeRuntimeBroker.exeRuntimeBroker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	process
1728	schtasks.exe
1364	schtasks.exe
3148	schtasks.exe
2552	schtasks.exe
1468	schtasks.exe
452	schtasks.exe
1716	schtasks.exe
3712	schtasks.exe
2016	schtasks.exe
2256	schtasks.exe
4348	schtasks.exe
508	schtasks.exe
392	schtasks.exe
4604	schtasks.exe
4392	schtasks.exe
3808	schtasks.exe
2500	schtasks.exe
2572	schtasks.exe
1568	schtasks.exe
532	schtasks.exe
4536	schtasks.exe
2240	schtasks.exe
4720	schtasks.exe
4748	schtasks.exe
4492	schtasks.exe
4856	schtasks.exe
812	schtasks.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

Processes:

54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeRuntimeBroker.exeRuntimeBroker.exeRuntimeBroker.exe

pid	process
2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
1584	powershell.exe
1584	powershell.exe
900	powershell.exe
900	powershell.exe
1448	powershell.exe
1448	powershell.exe
3844	powershell.exe
3844	powershell.exe
1744	powershell.exe
1744	powershell.exe
1896	powershell.exe
3008	powershell.exe
3008	powershell.exe
1896	powershell.exe
2328	powershell.exe
2328	powershell.exe
4596	powershell.exe
4596	powershell.exe
1448	powershell.exe
2456	powershell.exe
2456	powershell.exe
2328	powershell.exe
1584	powershell.exe
3844	powershell.exe
900	powershell.exe
1744	powershell.exe
3008	powershell.exe
1896	powershell.exe
2456	powershell.exe
4596	powershell.exe
3292	RuntimeBroker.exe
4196	RuntimeBroker.exe
4576	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	900	powershell.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	4596	powershell.exe
Token: SeDebugPrivilege	3292	RuntimeBroker.exe
Token: SeDebugPrivilege	4196	RuntimeBroker.exe
Token: SeDebugPrivilege	2448	RuntimeBroker.exe
Token: SeDebugPrivilege	4576	RuntimeBroker.exe
Token: SeDebugPrivilege	3728	RuntimeBroker.exe
Token: SeDebugPrivilege	1184	RuntimeBroker.exe
Token: SeDebugPrivilege	1096	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 62 IoCs

Processes:

54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.execmd.exeRuntimeBroker.execmd.exeWScript.exeRuntimeBroker.execmd.exeWScript.exeRuntimeBroker.execmd.exeWScript.exe

description	pid	process	target process
PID 2920 wrote to memory of 2328	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 2328	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 3844	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 3844	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 1448	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 1448	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 1744	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 1744	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 1584	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 1584	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 4596	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 4596	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 1896	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 1896	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 3008	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 3008	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 2456	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 2456	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 900	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 900	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	powershell.exe
PID 2920 wrote to memory of 2060	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	cmd.exe
PID 2920 wrote to memory of 2060	2920	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe	cmd.exe
PID 2060 wrote to memory of 4312	2060	cmd.exe	w32tm.exe
PID 2060 wrote to memory of 4312	2060	cmd.exe	w32tm.exe
PID 2060 wrote to memory of 3292	2060	cmd.exe	RuntimeBroker.exe
PID 2060 wrote to memory of 3292	2060	cmd.exe	RuntimeBroker.exe
PID 3292 wrote to memory of 5116	3292	RuntimeBroker.exe	WScript.exe
PID 3292 wrote to memory of 5116	3292	RuntimeBroker.exe	WScript.exe
PID 3292 wrote to memory of 1404	3292	RuntimeBroker.exe	WScript.exe
PID 3292 wrote to memory of 1404	3292	RuntimeBroker.exe	WScript.exe
PID 3292 wrote to memory of 4388	3292	RuntimeBroker.exe	cmd.exe
PID 3292 wrote to memory of 4388	3292	RuntimeBroker.exe	cmd.exe
PID 4388 wrote to memory of 3844	4388	cmd.exe	w32tm.exe
PID 4388 wrote to memory of 3844	4388	cmd.exe	w32tm.exe
PID 5116 wrote to memory of 4196	5116	WScript.exe	RuntimeBroker.exe
PID 5116 wrote to memory of 4196	5116	WScript.exe	RuntimeBroker.exe
PID 4196 wrote to memory of 1208	4196	RuntimeBroker.exe	WScript.exe
PID 4196 wrote to memory of 1208	4196	RuntimeBroker.exe	WScript.exe
PID 4196 wrote to memory of 4904	4196	RuntimeBroker.exe	WScript.exe
PID 4196 wrote to memory of 4904	4196	RuntimeBroker.exe	WScript.exe
PID 4388 wrote to memory of 2448	4388	cmd.exe	RuntimeBroker.exe
PID 4388 wrote to memory of 2448	4388	cmd.exe	RuntimeBroker.exe
PID 4196 wrote to memory of 4772	4196	RuntimeBroker.exe	cmd.exe
PID 4196 wrote to memory of 4772	4196	RuntimeBroker.exe	cmd.exe
PID 4772 wrote to memory of 4780	4772	cmd.exe	w32tm.exe
PID 4772 wrote to memory of 4780	4772	cmd.exe	w32tm.exe
PID 4772 wrote to memory of 4576	4772	cmd.exe	RuntimeBroker.exe
PID 4772 wrote to memory of 4576	4772	cmd.exe	RuntimeBroker.exe
PID 1208 wrote to memory of 3728	1208	WScript.exe	RuntimeBroker.exe
PID 1208 wrote to memory of 3728	1208	WScript.exe	RuntimeBroker.exe
PID 4576 wrote to memory of 4484	4576	RuntimeBroker.exe	WScript.exe
PID 4576 wrote to memory of 4484	4576	RuntimeBroker.exe	WScript.exe
PID 4576 wrote to memory of 1848	4576	RuntimeBroker.exe	WScript.exe
PID 4576 wrote to memory of 1848	4576	RuntimeBroker.exe	WScript.exe
PID 4576 wrote to memory of 4876	4576	RuntimeBroker.exe	cmd.exe
PID 4576 wrote to memory of 4876	4576	RuntimeBroker.exe	cmd.exe
PID 4876 wrote to memory of 1988	4876	cmd.exe	w32tm.exe
PID 4876 wrote to memory of 1988	4876	cmd.exe	w32tm.exe
PID 4484 wrote to memory of 1184	4484	WScript.exe	RuntimeBroker.exe
PID 4484 wrote to memory of 1184	4484	WScript.exe	RuntimeBroker.exe
PID 4876 wrote to memory of 1096	4876	cmd.exe	RuntimeBroker.exe
PID 4876 wrote to memory of 1096	4876	cmd.exe	RuntimeBroker.exe

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

Processes:

54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exeRuntimeBroker.exeRuntimeBroker.exeRuntimeBroker.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe
"C:\Users\Admin\AppData\Local\Temp\54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2328

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\es-ES\sppsvc.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\dllhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\sysmon.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1744

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\SearchApp.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\ja-JP\csrss.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Start Menu\dllhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\StartMenuExperienceHost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:900

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\klY9Ix3jqJ.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
3⤵
PID:4312

C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe
"C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe"
3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3292

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\caeb6e3b-6eb5-4fc8-8f3e-69bd8d13209e.vbs"
4⤵
- Suspicious use of WriteProcessMemory
PID:5116

C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe
"C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe"
5⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4196

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\074c5ddd-42a3-49df-87ff-91bd104e9488.vbs"
6⤵
- Suspicious use of WriteProcessMemory
PID:1208

C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe
"C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3728

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0dd66b1f-faa3-4682-93da-c32b2419f493.vbs"
6⤵
PID:4904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\I0OceA6Xfh.bat"
6⤵
- Suspicious use of WriteProcessMemory
PID:4772

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
7⤵
PID:4780

C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe
"C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe"
7⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4576

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\164b5621-6ecc-4cad-8a30-1e25d148bc77.vbs"
8⤵
- Suspicious use of WriteProcessMemory
PID:4484

C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe
"C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe"
9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1184

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee98694d-0185-434b-973b-0ad3edd5d47d.vbs"
8⤵
PID:1848

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uOEGMIRuqZ.bat"
8⤵
- Suspicious use of WriteProcessMemory
PID:4876

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
9⤵
PID:1988

C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe
"C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe"
9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b5c0f29-3bf9-4bb5-b037-31e86775a442.vbs"
4⤵
PID:1404

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mQe7zIwqSA.bat"
4⤵
- Suspicious use of WriteProcessMemory
PID:4388

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
5⤵
PID:3844

C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe
"C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Users\Public\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Public\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Users\Public\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Windows\PLA\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\PLA\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Windows\PLA\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Start Menu\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Start Menu\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Users\Public\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Public\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Users\Public\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Photo Viewer\ja-JP\csrss.exe
Filesize
1.3MB

MD5
48c2137034bee9bdfc2c9df1e71e9e04

SHA1
573e8453bc08e2b4e8e65b8560d81b150a9acdd8

SHA256
54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88

SHA512
5c854bfa2b963039db83cf764ea0ddb513c612896c325acdd944bbb115858153cac15addbf18da208cf8753b60f774e7a61e0540fd82445f29f9d47a31c2b247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
Filesize
1KB

MD5
3690a1c3b695227a38625dcf27bd6dac

SHA1
c2ed91e98b120681182904fa2c7cd504e5c4b2f5

SHA256
2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

SHA512
15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\074c5ddd-42a3-49df-87ff-91bd104e9488.vbs
Filesize
739B

MD5
bd8e0af0a2a9555efbdab86794e21a2b

SHA1
83c8576d9df1cbc87a3c50f86d9bf5b3eaceb900

SHA256
6090434c974147567a4b2f54d4d10daa5d3fe8b9f3b8a6ba703aa9862ea57355

SHA512
c127500c11b95489ff5a67183cdc805ae98bbe04e1940628016a124dcd8200a39a61bafd829d95cacd1bc9995142a8fb27b8727e0182dcfe65ac5f77c0529243

Download Submit
C:\Users\Admin\AppData\Local\Temp\164b5621-6ecc-4cad-8a30-1e25d148bc77.vbs
Filesize
739B

MD5
dac075bda1c5a46d3e95f32a43659bfc

SHA1
12f59900655b1dc593925fad83328699a4222d1e

SHA256
3f636161d4ed74db0d1edd8babd9573786538eee2cbf3b2f40dc35948772962c

SHA512
d8f6730e6c599b5e5fce7944258836e650cd318aac742786c95feb95a3a7992af0ef61a6d264b676c89e5f84419c35837be5322b9dc20bf165cedaee3767a60b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8b5c0f29-3bf9-4bb5-b037-31e86775a442.vbs
Filesize
515B

MD5
2e3b865fb6fc14e260b0a131553c05c3

SHA1
523bd0ad5ff4bd277c49e452b75d09c6e751a9ae

SHA256
6431edbfae1c68a64b2b4270f0549eaaac8cac8855e684ef3392dcf9c27b4403

SHA512
fd71fd0adfa881eec94c3aabcd7de17c73533190a1500aac9ec848227bcdc8127707b3fe73df6636fe716df7409c295b67845c483986a71f5ffe91d470db2e35

Download Submit
C:\Users\Admin\AppData\Local\Temp\I0OceA6Xfh.bat
Filesize
228B

MD5
c1a58d09f8c43317972e47aae7409236

SHA1
edde5944ed2d7bce59846fa446b7238028cf4bbd

SHA256
49b540a2449071c660d7206893cb2065c75f9bc8d6af3a23925cf8e2a1e6d1ad

SHA512
ba86ce429d372ba8adae6cf6f69d853a5511362736925d3edfe5956fd5c1f1959a72a2a0ce9b2eaa09ad74eb147bdfa489a7637bb5707597dd7dc7c1fa82e024

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kuhqypnk.jge.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\caeb6e3b-6eb5-4fc8-8f3e-69bd8d13209e.vbs
Filesize
739B

MD5
15953f6b23cc984a9a1ca67e528e5661

SHA1
ea113c560a2e0fc56683de04981efbae5cc2ea15

SHA256
9631662c3270ef083345cf031a6d6772000d544f7959dad668b24fe6029b5b5e

SHA512
593d9bdf0fbcd515c74113d2833f5df57182ac211feb63fed3dc0071a4b2972f59344dc0c32927b0cde72986ef16393bc90ea9b20d404356893ffbb7a01a157c

Download Submit
C:\Users\Admin\AppData\Local\Temp\klY9Ix3jqJ.bat
Filesize
228B

MD5
65c6fc8267213c1cc49afe0da36359f0

SHA1
f32d0f87be2e9b73796d40d810103cb9abba0d38

SHA256
4cd287fd5de84ce7b94432b18d39654682becacab37e4e771a4d7b9d9e28de43

SHA512
116ff6979ec5780fbc2340ad11e834979fb6897a60359c6df08aee03dbc51a4a336282ae699dec0aba9b10bccd23f25593fea65f24006436fcfce5282d66ab8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\mQe7zIwqSA.bat
Filesize
228B

MD5
faf9d96c99b2777ceec97483b014d336

SHA1
6db0062a1bb56eff15458f81b452d9b3eb1949ed

SHA256
e474ae2c1651e7a671006d7146f033190fa19f0651ebff36e4208190ee9b5483

SHA512
a7e63d7d70032e1efb294ea7ac35623613b25818ece4e47fbef6debe3767d05ffa210215e12e52bcb319e0c8300607f0c8e1646632fd4b0fd7e7cc6369366912

Download Submit
C:\Users\Admin\AppData\Local\Temp\uOEGMIRuqZ.bat
Filesize
228B

MD5
80e455d44235c1870dc86b52811c4372

SHA1
520a6c7ed5b251c32fe00d1a8baea74095f02832

SHA256
3af663032f2e8b6134b60e1ed14211f539adab430dc9e25fdd15f4108d76d20e

SHA512
74f8728755e7d0b66d9f59928a6f6524dcbb88e65b4cf49296deb20b0eb4918ab2c9094665fd8015e813b2c2831ad6155a5b48cf01a5ff2bfea90882f5daad49

Download Submit
memory/900-138-0x000001D4A73E0000-0x000001D4A752E000-memory.dmp

Filesize
1.3MB

Download
memory/1448-131-0x000002B5C68B0000-0x000002B5C69FE000-memory.dmp

Filesize
1.3MB

Download
memory/1584-137-0x000001BB76560000-0x000001BB766AE000-memory.dmp

Filesize
1.3MB

Download
memory/1744-141-0x0000019D685E0000-0x0000019D6872E000-memory.dmp

Filesize
1.3MB

Download
memory/1896-156-0x00000219B3BB0000-0x00000219B3CFE000-memory.dmp

Filesize
1.3MB

Download
memory/2328-144-0x0000018F9FF20000-0x0000018FA006E000-memory.dmp

Filesize
1.3MB

Download
memory/2456-159-0x0000029AF73A0000-0x0000029AF74EE000-memory.dmp

Filesize
1.3MB

Download
memory/2920-5-0x0000000002B50000-0x0000000002B58000-memory.dmp

Filesize
32KB

Download
memory/2920-6-0x000000001B640000-0x000000001B64A000-memory.dmp

Filesize
40KB

Download
memory/2920-9-0x000000001B670000-0x000000001B67E000-memory.dmp

Filesize
56KB

Download
memory/2920-11-0x000000001B6E0000-0x000000001B6EA000-memory.dmp

Filesize
40KB

Download
memory/2920-2-0x00007FFBE39D0000-0x00007FFBE4491000-memory.dmp

Filesize
10.8MB

Download
memory/2920-3-0x0000000002B30000-0x0000000002B4C000-memory.dmp

Filesize
112KB

Download
memory/2920-8-0x000000001B660000-0x000000001B66A000-memory.dmp

Filesize
40KB

Download
memory/2920-0-0x00007FFBE39D3000-0x00007FFBE39D5000-memory.dmp

Filesize
8KB

Download
memory/2920-12-0x000000001B6F0000-0x000000001B6FC000-memory.dmp

Filesize
48KB

Download
memory/2920-1-0x00000000008B0000-0x0000000000A06000-memory.dmp

Filesize
1.3MB

Download
memory/2920-7-0x000000001B650000-0x000000001B65C000-memory.dmp

Filesize
48KB

Download
memory/2920-10-0x000000001B680000-0x000000001B68E000-memory.dmp

Filesize
56KB

Download
memory/2920-4-0x000000001B690000-0x000000001B6E0000-memory.dmp

Filesize
320KB

Download
memory/2920-36-0x00007FFBE39D0000-0x00007FFBE4491000-memory.dmp

Filesize
10.8MB

Download
memory/3008-42-0x000002C73BAF0000-0x000002C73BB12000-memory.dmp

Filesize
136KB

Download
memory/3008-153-0x000002C73BD60000-0x000002C73BEAE000-memory.dmp

Filesize
1.3MB

Download
memory/3844-147-0x00000256FEEC0000-0x00000256FF00E000-memory.dmp

Filesize
1.3MB

Download
memory/4196-195-0x000000001E330000-0x000000001E49A000-memory.dmp

Filesize
1.4MB

Download
memory/4596-150-0x000001936AA40000-0x000001936AB8E000-memory.dmp

Filesize
1.3MB

Download