dcrat | f4c480507a92330a160dc69769a67d57ff95daea0bd9cd94c914184472b8bbf9

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
17/04/2022, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c9f428ba2c75e97507c3f0a24d44f02e.exe
Size 2.5MB
Sample220417-d8rtrsheaq
SHA256 f4c480507a92330a160dc69769a67d57ff95daea0bd9cd94c914184472b8bbf9
MD5 c9f428ba2c75e97507c3f0a24d44f02e
SHA1 f7a426d99e5f260078a07168af396de8dcd709d8
SHA512 b2944181398a54d9fab5ff814b34ce248620e394301532883b2846527fbef52ae2c8bc6922069611d62207aa5e904790d947f1ad76de0de21949cacb21bf6c25
MD5 SHA1 SHA512

Score

10^/10

dcrat evasion infostealer persistence rat spyware stealer suricata trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Mozilla\\updates\\308046B0AF4A39CB\\winlogon.exe\", \"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\fontdrvhost.exe\", \"C:\\Windows\\ShellComponents\\services.exe\", \"C:\\Users\\Admin\\Contacts\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	c9f428ba2c75e97507c3f0a24d44f02e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Mozilla\\updates\\308046B0AF4A39CB\\winlogon.exe\", \"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\fontdrvhost.exe\", \"C:\\Windows\\ShellComponents\\services.exe\", \"C:\\Users\\Admin\\Contacts\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\fontdrvhost.exe\""	c9f428ba2c75e97507c3f0a24d44f02e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Mozilla\\updates\\308046B0AF4A39CB\\winlogon.exe\""	c9f428ba2c75e97507c3f0a24d44f02e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Mozilla\\updates\\308046B0AF4A39CB\\winlogon.exe\", \"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\fontdrvhost.exe\""	c9f428ba2c75e97507c3f0a24d44f02e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Mozilla\\updates\\308046B0AF4A39CB\\winlogon.exe\", \"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\fontdrvhost.exe\", \"C:\\Windows\\ShellComponents\\services.exe\""	c9f428ba2c75e97507c3f0a24d44f02e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Mozilla\\updates\\308046B0AF4A39CB\\winlogon.exe\", \"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\fontdrvhost.exe\", \"C:\\Windows\\ShellComponents\\services.exe\", \"C:\\Users\\Admin\\Contacts\\wininit.exe\""	c9f428ba2c75e97507c3f0a24d44f02e.exe

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4352	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	392	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3856	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4240	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4292	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3720	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	5116	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	5116	schtasks.exe	71

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata

Executes dropped EXE 1 IoCs

pid	Process
4604	winlogon.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	c9f428ba2c75e97507c3f0a24d44f02e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Admin\\Contacts\\wininit.exe\""	c9f428ba2c75e97507c3f0a24d44f02e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	c9f428ba2c75e97507c3f0a24d44f02e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\MSBuild\\Microsoft\\fontdrvhost.exe\""	c9f428ba2c75e97507c3f0a24d44f02e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\ProgramData\\Mozilla\\updates\\308046B0AF4A39CB\\winlogon.exe\""	c9f428ba2c75e97507c3f0a24d44f02e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\fontdrvhost.exe\""	c9f428ba2c75e97507c3f0a24d44f02e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\ShellComponents\\services.exe\""	c9f428ba2c75e97507c3f0a24d44f02e.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c9f428ba2c75e97507c3f0a24d44f02e.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c9f428ba2c75e97507c3f0a24d44f02e.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\fontdrvhost.exe	c9f428ba2c75e97507c3f0a24d44f02e.exe
File created	C:\Program Files\MSBuild\Microsoft\5b884080fd4f94	c9f428ba2c75e97507c3f0a24d44f02e.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\RCX7773.tmp	c9f428ba2c75e97507c3f0a24d44f02e.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\RCX7801.tmp	c9f428ba2c75e97507c3f0a24d44f02e.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\fontdrvhost.exe	c9f428ba2c75e97507c3f0a24d44f02e.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\ShellComponents\c5b4cb5e9653cc	c9f428ba2c75e97507c3f0a24d44f02e.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\fontdrvhost.exe	c9f428ba2c75e97507c3f0a24d44f02e.exe
File opened for modification	C:\Windows\ShellComponents\RCX6E36.tmp	c9f428ba2c75e97507c3f0a24d44f02e.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCX6BA4.tmp	c9f428ba2c75e97507c3f0a24d44f02e.exe
File opened for modification	C:\Windows\ShellComponents\RCX6EC3.tmp	c9f428ba2c75e97507c3f0a24d44f02e.exe
File opened for modification	C:\Windows\ShellComponents\services.exe	c9f428ba2c75e97507c3f0a24d44f02e.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\fontdrvhost.exe	c9f428ba2c75e97507c3f0a24d44f02e.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\5b884080fd4f94	c9f428ba2c75e97507c3f0a24d44f02e.exe
File created	C:\Windows\ShellComponents\services.exe	c9f428ba2c75e97507c3f0a24d44f02e.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCX6B17.tmp	c9f428ba2c75e97507c3f0a24d44f02e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1860	schtasks.exe
2656	schtasks.exe
3260	schtasks.exe
5020	schtasks.exe
2928	schtasks.exe
4764	schtasks.exe
3720	schtasks.exe
884	schtasks.exe
1136	schtasks.exe
2712	schtasks.exe
4660	schtasks.exe
3624	schtasks.exe
2392	schtasks.exe
4960	schtasks.exe
4240	schtasks.exe
4968	schtasks.exe
4352	schtasks.exe
1448	schtasks.exe
1944	schtasks.exe
392	schtasks.exe
3856	schtasks.exe
4292	schtasks.exe
3688	schtasks.exe
2768	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	c9f428ba2c75e97507c3f0a24d44f02e.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	winlogon.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4808	c9f428ba2c75e97507c3f0a24d44f02e.exe
4808	c9f428ba2c75e97507c3f0a24d44f02e.exe
4808	c9f428ba2c75e97507c3f0a24d44f02e.exe
4808	c9f428ba2c75e97507c3f0a24d44f02e.exe
4808	c9f428ba2c75e97507c3f0a24d44f02e.exe
4808	c9f428ba2c75e97507c3f0a24d44f02e.exe
4808	c9f428ba2c75e97507c3f0a24d44f02e.exe
4808	c9f428ba2c75e97507c3f0a24d44f02e.exe
4808	c9f428ba2c75e97507c3f0a24d44f02e.exe
4808	c9f428ba2c75e97507c3f0a24d44f02e.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4604	winlogon.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4808	c9f428ba2c75e97507c3f0a24d44f02e.exe
Token: SeDebugPrivilege	4604	winlogon.exe
Token: SeBackupPrivilege	1100	vssvc.exe
Token: SeRestorePrivilege	1100	vssvc.exe
Token: SeAuditPrivilege	1100	vssvc.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 4108	4808	c9f428ba2c75e97507c3f0a24d44f02e.exe	102
PID 4808 wrote to memory of 4108	4808	c9f428ba2c75e97507c3f0a24d44f02e.exe	102
PID 4108 wrote to memory of 4728	4108	cmd.exe	104
PID 4108 wrote to memory of 4728	4108	cmd.exe	104
PID 4108 wrote to memory of 4604	4108	cmd.exe	105
PID 4108 wrote to memory of 4604	4108	cmd.exe	105
PID 4604 wrote to memory of 4264	4604	winlogon.exe	106
PID 4604 wrote to memory of 4264	4604	winlogon.exe	106
PID 4604 wrote to memory of 3252	4604	winlogon.exe	107
PID 4604 wrote to memory of 3252	4604	winlogon.exe	107

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c9f428ba2c75e97507c3f0a24d44f02e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c9f428ba2c75e97507c3f0a24d44f02e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c9f428ba2c75e97507c3f0a24d44f02e.exe

C:\Users\Admin\AppData\Local\Temp\c9f428ba2c75e97507c3f0a24d44f02e.exe
"C:\Users\Admin\AppData\Local\Temp\c9f428ba2c75e97507c3f0a24d44f02e.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qrXfpsIjp7.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4728
- - C:\ProgramData\Mozilla\updates\308046B0AF4A39CB\winlogon.exe
    "C:\ProgramData\Mozilla\updates\308046B0AF4A39CB\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4604
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0bfcc6f2-7202-4b65-bd45-714263bccd82.vbs"
      4⤵
      PID:4264
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\200f0352-7300-4378-b224-dfb16a482fb5.vbs"
      4⤵
      PID:3252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc MINUTE /mo 6 /tr "'C:\ProgramData\Mozilla\updates\308046B0AF4A39CB\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\ProgramData\Mozilla\updates\308046B0AF4A39CB\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONSTART /tr "'C:\ProgramData\Mozilla\updates\308046B0AF4A39CB\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\ProgramData\Mozilla\updates\308046B0AF4A39CB\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc MINUTE /mo 14 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONSTART /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellComponents\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\ShellComponents\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONSTART /tr "'C:\Windows\ShellComponents\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Windows\ShellComponents\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Contacts\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Admin\Contacts\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONSTART /tr "'C:\Users\Admin\Contacts\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Contacts\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONSTART /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONSTART /tr "'C:\Program Files\MSBuild\Microsoft\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\Microsoft\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2392

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winlogon.exe

Path C:\ProgramData\Mozilla\updates\308046B0AF4A39CB\winlogon.exe
Size 2.5MB
SHA256 88f2717203a870618cc3a73315c1bdd0842227c300211f7fb0ad04cfee79b6de
MD5 35e8a520afeda7e1a7dc880e84fdf78a
SHA1 09756458d8bce240bc27ef28d27e51e155016277
SHA512 a722865cfaa6c5a8d524352987a5c7fb10ec728796a315d9d455a4c1d14e3fa5156561fc7d564cb4b7114a32a012cd6c363bfae6040ac6a0a329759c55e092ba
SSDEEP 49152:80A7yoQSPmOArm0EOYaGKQnhu3Hd8gIyUljZyAGC4TMpu:8t2jSWm0EOjyEnXUT54TI
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\ProgramData\Mozilla\updates\308046B0AF4A39CB\winlogon.exe
Size 2.5MB
SHA256 88f2717203a870618cc3a73315c1bdd0842227c300211f7fb0ad04cfee79b6de
MD5 35e8a520afeda7e1a7dc880e84fdf78a
SHA1 09756458d8bce240bc27ef28d27e51e155016277
SHA512 a722865cfaa6c5a8d524352987a5c7fb10ec728796a315d9d455a4c1d14e3fa5156561fc7d564cb4b7114a32a012cd6c363bfae6040ac6a0a329759c55e092ba
SSDEEP 49152:80A7yoQSPmOArm0EOYaGKQnhu3Hd8gIyUljZyAGC4TMpu:8t2jSWm0EOjyEnXUT54TI
MD5 SHA1 SHA512 SSDEEP

Submit Download

0bfcc6f2-7202-4b65-bd45-714263bccd82.vbs

Path C:\Users\Admin\AppData\Local\Temp\0bfcc6f2-7202-4b65-bd45-714263bccd82.vbs
Size 736B
SHA256 e6b38dd2f11b2995d1bc90eb149ff4adaded1c7813fc947a8a8e0a09588b4968
MD5 722219416cc718319d307907946b648a
SHA1 486b3c839f5cbdbf18d11fb62af875171a4dfc04
SHA512 121a5d1e6faa92d32828b9b1a31245c68bd8a752579bad97f69718e1859658ea806cda1ed28508c54ce65ea3e25a93cbd3f7ff282b9661dcbaac2f7825488634
MD5 SHA1 SHA512

Submit Download

200f0352-7300-4378-b224-dfb16a482fb5.vbs

Path C:\Users\Admin\AppData\Local\Temp\200f0352-7300-4378-b224-dfb16a482fb5.vbs
Size 512B
SHA256 67a36577f4ec12d4a5c29f4c4524243b48b0d88eb5a13ceb390b03d0bc91034d
MD5 697fbb421d792dd54cc97f7777a20e09
SHA1 28c41505a759f5277690adf15cebffcd945f2aa5
SHA512 7e1b0d17e6ff6e7b65ea0f892558040571c9f323241900df079f8fda4e9cf6c1f1a09486aa99c6962f8b825d6f677858ff19bb741041b9fcfabaf4b0d1ade58d
MD5 SHA1 SHA512

Submit Download

qrXfpsIjp7.bat

Path C:\Users\Admin\AppData\Local\Temp\qrXfpsIjp7.bat
Size 224B
SHA256 2423aab64fdf46c3710bf1f0be35e7cfa859ec5898dd0689053829bb320ba191
MD5 45af749f4371df02e58f852945433e85
SHA1 a1667ea79aab0526165704747eb4c9da690645f0
SHA512 92feae7d409ac2d370ba257ec35fd2fcf313867c9e004e8c6954eeac862cf0e65ea6aaf6fcfd9f0b1dc68c19f4bd76509872905435c60f8ec16cac6fb6f41456
MD5 SHA1 SHA512

Submit Download

memory/4604-140-0x0000000000360000-0x00000000005DE000-memory.dmp

Download

memory/4604-141-0x00007FF8C0C90000-0x00007FF8C1751000-memory.dmp

Download

memory/4604-142-0x000000001B230000-0x000000001B232000-memory.dmp

Download

memory/4808-130-0x0000000000E00000-0x000000000107E000-memory.dmp

Download

memory/4808-133-0x000000001C4B0000-0x000000001C500000-memory.dmp

Download

memory/4808-131-0x00007FF8C0C90000-0x00007FF8C1751000-memory.dmp

Download

memory/4808-132-0x0000000003170000-0x0000000003172000-memory.dmp

Download