dcrat | 9105c5879befeefcedb998f4cb67272e92ccab0756da5a1cfdf3f46421417d67

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2022, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
36EF7B694DEEE549F2FBBE76C283B49F.exe
Size 1.5MB
Sample220724-l43pgacecj
SHA256 9105c5879befeefcedb998f4cb67272e92ccab0756da5a1cfdf3f46421417d67
MD5 36ef7b694deee549f2fbbe76c283b49f
SHA1 d23d6295f1a5e63618d177e728540304e9a0d606
SHA512 df912ea175facac4c6325e569242815fdab90a93e4739cabd1bb8bdfd706f54539f0acd40163b0c2ac712d6389fdba2df11cb45e017fedda743e4795d6fba05b
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer rat spyware stealer suricata

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4152	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4716	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4792	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3288	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3676	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	496	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3848	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3556	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3800	4388	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	4388	schtasks.exe	37

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4212-131-0x0000000000120000-0x0000000000554000-memory.dmp	dcrat
behavioral2/memory/4212-139-0x0000000000120000-0x0000000000554000-memory.dmp	dcrat
behavioral2/memory/2300-141-0x00000000008F0000-0x0000000000D24000-memory.dmp	dcrat
behavioral2/memory/2300-142-0x00000000008F0000-0x0000000000D24000-memory.dmp	dcrat
behavioral2/memory/2300-143-0x00000000008F0000-0x0000000000D24000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2300	StartMenuExperienceHost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	36EF7B694DEEE549F2FBBE76C283B49F.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs

pid	Process
4212	36EF7B694DEEE549F2FBBE76C283B49F.exe
4212	36EF7B694DEEE549F2FBBE76C283B49F.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\ModifiableWindowsApps\sppsvc.exe	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Program Files (x86)\Common Files\Adobe\lsass.exe	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Program Files\Windows NT\Accessories\55b276f4edf653	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\6b1f78eef0a091	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Program Files\Windows NT\Accessories\StartMenuExperienceHost.exe	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RuntimeBroker.exe	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\9e8d7a4ca61bd9	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\36EF7B694DEEE549F2FBBE76C283B49F.exe	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Program Files (x86)\Common Files\Adobe\6203df4a6bafc7	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Program Files (x86)\Windows NT\sihost.exe	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Program Files (x86)\Windows NT\66fc9ff0ee96c2	36EF7B694DEEE549F2FBBE76C283B49F.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\System.Data.OracleClient\sppsvc.exe	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\pris\RuntimeBroker.exe	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\pris\9e8d7a4ca61bd9	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Windows\PrintDialog\System.exe	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Windows\PrintDialog\27d1bcfc3c54e0	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Windows\assembly\GAC_64\System.Data.OracleClient\sppsvc.exe	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Windows\assembly\GAC_64\System.Data.OracleClient\0a1fd5f707cd16	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Windows\Downloaded Program Files\StartMenuExperienceHost.exe	36EF7B694DEEE549F2FBBE76C283B49F.exe
File created	C:\Windows\Downloaded Program Files\55b276f4edf653	36EF7B694DEEE549F2FBBE76C283B49F.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4776	schtasks.exe
4840	schtasks.exe
2796	schtasks.exe
3848	schtasks.exe
2360	schtasks.exe
2848	schtasks.exe
5012	schtasks.exe
2348	schtasks.exe
3944	schtasks.exe
4228	schtasks.exe
5000	schtasks.exe
2936	schtasks.exe
1084	schtasks.exe
2420	schtasks.exe
2596	schtasks.exe
4820	schtasks.exe
4768	schtasks.exe
1540	schtasks.exe
3444	schtasks.exe
1180	schtasks.exe
4716	schtasks.exe
4332	schtasks.exe
1964	schtasks.exe
4376	schtasks.exe
3676	schtasks.exe
2528	schtasks.exe
3228	schtasks.exe
2276	schtasks.exe
3556	schtasks.exe
228	schtasks.exe
496	schtasks.exe
4380	schtasks.exe
4152	schtasks.exe
4364	schtasks.exe
4724	schtasks.exe
2292	schtasks.exe
868	schtasks.exe
2260	schtasks.exe
3288	schtasks.exe
1368	schtasks.exe
3508	schtasks.exe
924	schtasks.exe
4796	schtasks.exe
3536	schtasks.exe
3560	schtasks.exe
4996	schtasks.exe
4792	schtasks.exe
1696	schtasks.exe
2116	schtasks.exe
4432	schtasks.exe
376	schtasks.exe
3800	schtasks.exe
872	schtasks.exe
1312	schtasks.exe
3700	schtasks.exe
3624	schtasks.exe
384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4212	36EF7B694DEEE549F2FBBE76C283B49F.exe
4212	36EF7B694DEEE549F2FBBE76C283B49F.exe
4212	36EF7B694DEEE549F2FBBE76C283B49F.exe
4212	36EF7B694DEEE549F2FBBE76C283B49F.exe
4212	36EF7B694DEEE549F2FBBE76C283B49F.exe
4212	36EF7B694DEEE549F2FBBE76C283B49F.exe
4212	36EF7B694DEEE549F2FBBE76C283B49F.exe
4212	36EF7B694DEEE549F2FBBE76C283B49F.exe
4212	36EF7B694DEEE549F2FBBE76C283B49F.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2300	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4212	36EF7B694DEEE549F2FBBE76C283B49F.exe
Token: SeDebugPrivilege	2300	StartMenuExperienceHost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4212	36EF7B694DEEE549F2FBBE76C283B49F.exe
2300	StartMenuExperienceHost.exe
2300	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 2300	4212	36EF7B694DEEE549F2FBBE76C283B49F.exe	139
PID 4212 wrote to memory of 2300	4212	36EF7B694DEEE549F2FBBE76C283B49F.exe	139
PID 4212 wrote to memory of 2300	4212	36EF7B694DEEE549F2FBBE76C283B49F.exe	139

C:\Users\Admin\AppData\Local\Temp\36EF7B694DEEE549F2FBBE76C283B49F.exe
"C:\Users\Admin\AppData\Local\Temp\36EF7B694DEEE549F2FBBE76C283B49F.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\Downloaded Program Files\StartMenuExperienceHost.exe
  "C:\Windows\Downloaded Program Files\StartMenuExperienceHost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Windows\assembly\GAC_64\System.Data.OracleClient\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\assembly\GAC_64\System.Data.OracleClient\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Windows\assembly\GAC_64\System.Data.OracleClient\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\Adobe\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Adobe\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Cookies\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Cookies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Cookies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\odt\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\Accessories\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\Accessories\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Users\Public\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Public\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Users\Public\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Users\Default\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Default\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Users\Default\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Desktop\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Desktop\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\odt\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Windows\Downloaded Program Files\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Windows\Downloaded Program Files\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "36EF7B694DEEE549F2FBBE76C283B49F3" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\36EF7B694DEEE549F2FBBE76C283B49F.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "36EF7B694DEEE549F2FBBE76C283B49F" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\36EF7B694DEEE549F2FBBE76C283B49F.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "36EF7B694DEEE549F2FBBE76C283B49F3" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\36EF7B694DEEE549F2FBBE76C283B49F.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\PrintDialog\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\PrintDialog\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\PrintDialog\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\pris\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\pris\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\pris\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\odt\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartMenuExperienceHost.exe

Path C:\Windows\Downloaded Program Files\StartMenuExperienceHost.exe
Size 1.5MB
SHA256 9105c5879befeefcedb998f4cb67272e92ccab0756da5a1cfdf3f46421417d67
MD5 36ef7b694deee549f2fbbe76c283b49f
SHA1 d23d6295f1a5e63618d177e728540304e9a0d606
SHA512 df912ea175facac4c6325e569242815fdab90a93e4739cabd1bb8bdfd706f54539f0acd40163b0c2ac712d6389fdba2df11cb45e017fedda743e4795d6fba05b
SSDEEP 24576:cH2ThKnxNMPD1umV2HoYb1TDjgwQFkJUU5OMAuzZKH6R0+XZRTXXNvSHBgK2:cWUUPWlb1PjgwVa2MH6R0q7jX46
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartMenuExperienceHost.exe

Path C:\Windows\Downloaded Program Files\StartMenuExperienceHost.exe
Size 1.5MB
SHA256 9105c5879befeefcedb998f4cb67272e92ccab0756da5a1cfdf3f46421417d67
MD5 36ef7b694deee549f2fbbe76c283b49f
SHA1 d23d6295f1a5e63618d177e728540304e9a0d606
SHA512 df912ea175facac4c6325e569242815fdab90a93e4739cabd1bb8bdfd706f54539f0acd40163b0c2ac712d6389fdba2df11cb45e017fedda743e4795d6fba05b
SSDEEP 24576:cH2ThKnxNMPD1umV2HoYb1TDjgwQFkJUU5OMAuzZKH6R0+XZRTXXNvSHBgK2:cWUUPWlb1PjgwVa2MH6R0q7jX46
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2300-142-0x00000000008F0000-0x0000000000D24000-memory.dmp

Download

memory/2300-140-0x00000000008F0000-0x0000000000D24000-memory.dmp

Download

memory/2300-145-0x0000000006AA0000-0x0000000006AAA000-memory.dmp

Download

memory/2300-144-0x00000000082C0000-0x0000000008352000-memory.dmp

Download

memory/2300-143-0x00000000008F0000-0x0000000000D24000-memory.dmp

Download

memory/2300-141-0x00000000008F0000-0x0000000000D24000-memory.dmp

Download

memory/4212-139-0x0000000000120000-0x0000000000554000-memory.dmp

Download

memory/4212-133-0x0000000006490000-0x00000000064E0000-memory.dmp

Download

memory/4212-131-0x0000000000120000-0x0000000000554000-memory.dmp

Download

memory/4212-130-0x0000000000120000-0x0000000000554000-memory.dmp

Download

memory/4212-132-0x0000000006700000-0x0000000006CA4000-memory.dmp

Download

memory/4212-135-0x00000000065D0000-0x0000000006636000-memory.dmp

Download

memory/4212-134-0x00000000071E0000-0x000000000770C000-memory.dmp

Download