dcrat | 96ddb4fa1a296cccac8a22faa8773f1343e2ced466b478980d64f1af493c103a

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2022 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exe
Size

2.0MB
MD5

4f64c5ba875a44be67619fa8342bc777
SHA1

c192a53b53940892febe4bdba9adf9c940988d0f
SHA256

96ddb4fa1a296cccac8a22faa8773f1343e2ced466b478980d64f1af493c103a
SHA512

433086c6e4a26d8b7e58f67176ebb4ff9655fff67d07899911e3e5d49100a2e02d1d41907e0f1bdd2f627bc198a88fe907419755941d3cb31957ca155298daa1

Score

10^/10

dcrat evasion infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

bridgesession.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Videos\\System.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Videos\\System.exe\", \"C:\\Users\\Default User\\bridgesession.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Videos\\System.exe\", \"C:\\Users\\Default User\\bridgesession.exe\", \"C:\\Windows\\GameBarPresenceWriter\\OfficeClickToRun.exe\", \"C:\\Windows\\ServiceProfiles\\NetworkService\\smss.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Videos\\System.exe\", \"C:\\Users\\Default User\\bridgesession.exe\", \"C:\\Windows\\GameBarPresenceWriter\\OfficeClickToRun.exe\", \"C:\\Windows\\ServiceProfiles\\NetworkService\\smss.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\fontdrvhost.exe\", \"C:\\odt\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\csrss.exe\", \"C:\\Program Files\\Internet Explorer\\de-DE\\OfficeClickToRun.exe\", \"C:\\Users\\Admin\\Documents\\My Videos\\sihost.exe\", \"C:\\odt\\wininit.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Videos\\System.exe\", \"C:\\Users\\Default User\\bridgesession.exe\", \"C:\\Windows\\GameBarPresenceWriter\\OfficeClickToRun.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Videos\\System.exe\", \"C:\\Users\\Default User\\bridgesession.exe\", \"C:\\Windows\\GameBarPresenceWriter\\OfficeClickToRun.exe\", \"C:\\Windows\\ServiceProfiles\\NetworkService\\smss.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\fontdrvhost.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Videos\\System.exe\", \"C:\\Users\\Default User\\bridgesession.exe\", \"C:\\Windows\\GameBarPresenceWriter\\OfficeClickToRun.exe\", \"C:\\Windows\\ServiceProfiles\\NetworkService\\smss.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\fontdrvhost.exe\", \"C:\\odt\\OfficeClickToRun.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Videos\\System.exe\", \"C:\\Users\\Default User\\bridgesession.exe\", \"C:\\Windows\\GameBarPresenceWriter\\OfficeClickToRun.exe\", \"C:\\Windows\\ServiceProfiles\\NetworkService\\smss.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\fontdrvhost.exe\", \"C:\\odt\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\csrss.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Videos\\System.exe\", \"C:\\Users\\Default User\\bridgesession.exe\", \"C:\\Windows\\GameBarPresenceWriter\\OfficeClickToRun.exe\", \"C:\\Windows\\ServiceProfiles\\NetworkService\\smss.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\fontdrvhost.exe\", \"C:\\odt\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\csrss.exe\", \"C:\\Program Files\\Internet Explorer\\de-DE\\OfficeClickToRun.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Videos\\System.exe\", \"C:\\Users\\Default User\\bridgesession.exe\", \"C:\\Windows\\GameBarPresenceWriter\\OfficeClickToRun.exe\", \"C:\\Windows\\ServiceProfiles\\NetworkService\\smss.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\fontdrvhost.exe\", \"C:\\odt\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\csrss.exe\", \"C:\\Program Files\\Internet Explorer\\de-DE\\OfficeClickToRun.exe\", \"C:\\Users\\Admin\\Documents\\My Videos\\sihost.exe\""	bridgesession.exe

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4208	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4156	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3600	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3612	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4172	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	792	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4268	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	336	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3544	2292	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3696	2292	schtasks.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\componentweb\bridgesession.exe	dcrat
C:\Users\Admin\AppData\Roaming\componentweb\bridgesession.exe	dcrat
behavioral2/memory/4680-139-0x00000000009C0000-0x0000000000B6E000-memory.dmp	dcrat
C:\Windows\ServiceProfiles\NetworkService\smss.exe	dcrat
C:\Windows\ServiceProfiles\NetworkService\smss.exe	dcrat

Disables Task Manager via registry modification
evasion
Executes dropped EXE 2 IoCs

Processes:

bridgesession.exesmss.exe

pid process

4680 bridgesession.exe
1160 smss.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exebridgesession.exesmss.exe96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	bridgesession.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bridgesession.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bridgesession = "\"C:\\Users\\Default User\\bridgesession.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\ServiceProfiles\\NetworkService\\smss.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Windows Sidebar\\Gadgets\\fontdrvhost.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Public\\csrss.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\odt\\wininit.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\odt\\OfficeClickToRun.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Public\\csrss.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Internet Explorer\\de-DE\\OfficeClickToRun.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bridgesession = "\"C:\\Users\\Default User\\bridgesession.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Windows Sidebar\\Gadgets\\fontdrvhost.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Admin\\Documents\\My Videos\\sihost.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\odt\\wininit.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Admin\\Documents\\My Videos\\sihost.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Public\\Videos\\System.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Public\\Videos\\System.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\GameBarPresenceWriter\\OfficeClickToRun.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\GameBarPresenceWriter\\OfficeClickToRun.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\ServiceProfiles\\NetworkService\\smss.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\odt\\OfficeClickToRun.exe\""	bridgesession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Internet Explorer\\de-DE\\OfficeClickToRun.exe\""	bridgesession.exe

Drops file in Program Files directory 4 IoCs

Processes:

bridgesession.exe

description	ioc	process
File created	C:\Program Files\Windows Sidebar\Gadgets\5b884080fd4f94	bridgesession.exe
File created	C:\Program Files\Internet Explorer\de-DE\OfficeClickToRun.exe	bridgesession.exe
File created	C:\Program Files\Internet Explorer\de-DE\e6c9b481da804f	bridgesession.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\fontdrvhost.exe	bridgesession.exe

Drops file in Windows directory 5 IoCs

Processes:

bridgesession.exe

description	ioc	process
File created	C:\Windows\GameBarPresenceWriter\OfficeClickToRun.exe	bridgesession.exe
File created	C:\Windows\GameBarPresenceWriter\e6c9b481da804f	bridgesession.exe
File created	C:\Windows\ServiceProfiles\NetworkService\smss.exe	bridgesession.exe
File created	C:\Windows\ServiceProfiles\NetworkService\69ddcba757bf72	bridgesession.exe
File created	C:\Windows\Boot\Resources\fr-FR\conhost.exe	bridgesession.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
4108	schtasks.exe
3364	schtasks.exe
2616	schtasks.exe
3544	schtasks.exe
4208	schtasks.exe
2160	schtasks.exe
3600	schtasks.exe
444	schtasks.exe
2564	schtasks.exe
4156	schtasks.exe
4496	schtasks.exe
4144	schtasks.exe
4404	schtasks.exe
3484	schtasks.exe
220	schtasks.exe
3612	schtasks.exe
4172	schtasks.exe
2408	schtasks.exe
2648	schtasks.exe
2600	schtasks.exe
4544	schtasks.exe
336	schtasks.exe
3396	schtasks.exe
1928	schtasks.exe
3696	schtasks.exe
792	schtasks.exe
4268	schtasks.exe
4504	schtasks.exe
4848	schtasks.exe
3116	schtasks.exe

Modifies registry class 2 IoCs

Processes:

96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exesmss.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Local Settings	96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exe
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Local Settings	smss.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

384 reg.exe

pid	process
384	reg.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

bridgesession.exesmss.exe

pid	process
4680	bridgesession.exe
4680	bridgesession.exe
4680	bridgesession.exe
4680	bridgesession.exe
1160	smss.exe
1160	smss.exe
1160	smss.exe
1160	smss.exe
1160	smss.exe
1160	smss.exe
1160	smss.exe
1160	smss.exe
1160	smss.exe
1160	smss.exe
1160	smss.exe
1160	smss.exe
1160	smss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

bridgesession.exesmss.exe

description pid process

Token: SeDebugPrivilege 4680 bridgesession.exe
Token: SeDebugPrivilege 1160 smss.exe

description	pid	process
Token: SeDebugPrivilege	4680	bridgesession.exe
Token: SeDebugPrivilege	1160	smss.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exeWScript.execmd.exebridgesession.exesmss.exe

description	pid	process	target process
PID 1408 wrote to memory of 4192	1408	96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exe	WScript.exe
PID 1408 wrote to memory of 4192	1408	96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exe	WScript.exe
PID 1408 wrote to memory of 4192	1408	96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exe	WScript.exe
PID 1408 wrote to memory of 2200	1408	96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exe	WScript.exe
PID 1408 wrote to memory of 2200	1408	96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exe	WScript.exe
PID 1408 wrote to memory of 2200	1408	96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exe	WScript.exe
PID 4192 wrote to memory of 1848	4192	WScript.exe	cmd.exe
PID 4192 wrote to memory of 1848	4192	WScript.exe	cmd.exe
PID 4192 wrote to memory of 1848	4192	WScript.exe	cmd.exe
PID 1848 wrote to memory of 4680	1848	cmd.exe	bridgesession.exe
PID 1848 wrote to memory of 4680	1848	cmd.exe	bridgesession.exe
PID 4680 wrote to memory of 1160	4680	bridgesession.exe	smss.exe
PID 4680 wrote to memory of 1160	4680	bridgesession.exe	smss.exe
PID 1848 wrote to memory of 384	1848	cmd.exe	reg.exe
PID 1848 wrote to memory of 384	1848	cmd.exe	reg.exe
PID 1848 wrote to memory of 384	1848	cmd.exe	reg.exe
PID 1160 wrote to memory of 3788	1160	smss.exe	WScript.exe
PID 1160 wrote to memory of 3788	1160	smss.exe	WScript.exe
PID 1160 wrote to memory of 4416	1160	smss.exe	WScript.exe
PID 1160 wrote to memory of 4416	1160	smss.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exe
"C:\Users\Admin\AppData\Local\Temp\96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\componentweb\KzCiAFWiG.vbe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4192

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\componentweb\lTeat4KS.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1848

C:\Users\Admin\AppData\Roaming\componentweb\bridgesession.exe
"C:\Users\Admin\AppData\Roaming\componentweb\bridgesession.exe"
4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680

C:\Windows\ServiceProfiles\NetworkService\smss.exe
"C:\Windows\ServiceProfiles\NetworkService\smss.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23da7669-43b6-45b0-ad56-b61baa604c4e.vbs"
6⤵
PID:3788

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c70af26f-68cb-4f26-9693-892db141a2e2.vbs"
6⤵
PID:4416

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
4⤵
- Modifies registry key
PID:384

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\componentweb\file.vbs"
2⤵
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Videos\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Videos\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Videos\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bridgesessionb" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\bridgesession.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bridgesession" /sc ONLOGON /tr "'C:\Users\Default User\bridgesession.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bridgesessionb" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\bridgesession.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Windows\GameBarPresenceWriter\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Windows\GameBarPresenceWriter\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\ServiceProfiles\NetworkService\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\ServiceProfiles\NetworkService\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Gadgets\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\odt\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Public\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\de-DE\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\de-DE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\de-DE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Documents\My Videos\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Admin\Documents\My Videos\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Documents\My Videos\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\odt\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3696

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\23da7669-43b6-45b0-ad56-b61baa604c4e.vbs
Filesize
726B

MD5
a96bd9eabe6944c17dcf84ef5129e14a

SHA1
fbbb67514175b158ea118ae3685ef15766ef7427

SHA256
463813d2cf831c339d6162ac91df61ad5308f345c34701a783093a00c93ff806

SHA512
1621b44dae704f7266731de0c92a3665dd54e7e70ccec9b65a6f0b502f22c65fe6fb6fff42ff7a7eedad3796843bb24d7aef1716b5ace27b78bb634a8aeb270f

Download Submit
C:\Users\Admin\AppData\Local\Temp\c70af26f-68cb-4f26-9693-892db141a2e2.vbs
Filesize
502B

MD5
29a7168cc2000159abb5f98e9341812d

SHA1
39739cc7f40431add7118c9bc34f6cebe424bcff

SHA256
985c1d6f95b966dd4a2f93b96cccf8a808e421656c4f5adba9f959beff0b680b

SHA512
787930684c0ac4aeb9bc4fc7bda893712d823da9ac3d20ff368b0131e24e458232236caeadee204e53b4310caacccdb99c8031d819b5fcf61611a5609c13256c

Download Submit
C:\Users\Admin\AppData\Roaming\componentweb\KzCiAFWiG.vbe
Filesize
205B

MD5
97477f4fd52d9b2ffb51319a264de713

SHA1
64eca106fa0f8923dfc304e78fe32dd1cbdd393b

SHA256
dbea180023ec71eaa16ed1faa254b26688625ba4d48eb93343fb8dab5a7bf185

SHA512
c02d978cf103d812e95a6038d8c3bd0b3bfb07aa29f2405ca88052d28ee3d69bb85e522b156e47fb124a5f9ff7a29fe1b86405231a9c87f88b3ca80fc702429e

Download Submit
C:\Users\Admin\AppData\Roaming\componentweb\bridgesession.exe
Filesize
1.7MB

MD5
4f080110c40748cabc62f247b3104cca

SHA1
e28c68aa6e57975a28945ed21bb6bd623379b2a0

SHA256
ec741c36f90173822380788d1ea972c37162c51e24235eec9dc87ce2ae033f9d

SHA512
d1388af36633ecb6a0a0f4e17b9efe68acb965dd448da0810528311f564385c2258e602864cd005161464dbd2fd8e43bf1a018fa941e20bf5c167648eba50143

Download Submit
C:\Users\Admin\AppData\Roaming\componentweb\bridgesession.exe
Filesize
1.7MB

MD5
4f080110c40748cabc62f247b3104cca

SHA1
e28c68aa6e57975a28945ed21bb6bd623379b2a0

SHA256
ec741c36f90173822380788d1ea972c37162c51e24235eec9dc87ce2ae033f9d

SHA512
d1388af36633ecb6a0a0f4e17b9efe68acb965dd448da0810528311f564385c2258e602864cd005161464dbd2fd8e43bf1a018fa941e20bf5c167648eba50143

Download Submit
C:\Users\Admin\AppData\Roaming\componentweb\file.vbs
Filesize
34B

MD5
677cc4360477c72cb0ce00406a949c61

SHA1
b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

SHA256
f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

SHA512
7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

Download Submit
C:\Users\Admin\AppData\Roaming\componentweb\lTeat4KS.bat
Filesize
154B

MD5
e06419a009888884daaca1708dc8f782

SHA1
8d1ceb2ce38fd84fdd998f129de0494303a42609

SHA256
a98e96aaf61ff999b1ea39ae83f1f160a8f0af067247f9e6c0790afcc705585a

SHA512
2b69ac436ddc4eaba2ae53d1713361c2b52c29e991e1a47996a249a66fb56dcab560db79b7722c96f676f6b7a46db85026d2a754f6bad7990e5c4d8ed21ca6f6

Download Submit
C:\Windows\ServiceProfiles\NetworkService\smss.exe
Filesize
1.7MB

MD5
4f080110c40748cabc62f247b3104cca

SHA1
e28c68aa6e57975a28945ed21bb6bd623379b2a0

SHA256
ec741c36f90173822380788d1ea972c37162c51e24235eec9dc87ce2ae033f9d

SHA512
d1388af36633ecb6a0a0f4e17b9efe68acb965dd448da0810528311f564385c2258e602864cd005161464dbd2fd8e43bf1a018fa941e20bf5c167648eba50143

Download Submit
C:\Windows\ServiceProfiles\NetworkService\smss.exe
Filesize
1.7MB

MD5
4f080110c40748cabc62f247b3104cca

SHA1
e28c68aa6e57975a28945ed21bb6bd623379b2a0

SHA256
ec741c36f90173822380788d1ea972c37162c51e24235eec9dc87ce2ae033f9d

SHA512
d1388af36633ecb6a0a0f4e17b9efe68acb965dd448da0810528311f564385c2258e602864cd005161464dbd2fd8e43bf1a018fa941e20bf5c167648eba50143

Download Submit
memory/384-147-0x0000000000000000-mapping.dmp

Download
memory/1160-153-0x00007FFE79C70000-0x00007FFE7A731000-memory.dmp

Filesize
10.8MB

Download
memory/1160-148-0x00007FFE79C70000-0x00007FFE7A731000-memory.dmp

Filesize
10.8MB

Download
memory/1160-143-0x0000000000000000-mapping.dmp

Download
memory/1848-135-0x0000000000000000-mapping.dmp

Download
memory/2200-132-0x0000000000000000-mapping.dmp

Download
memory/3788-149-0x0000000000000000-mapping.dmp

Download
memory/4192-130-0x0000000000000000-mapping.dmp

Download
memory/4416-150-0x0000000000000000-mapping.dmp

Download
memory/4680-136-0x0000000000000000-mapping.dmp

Download
memory/4680-146-0x00007FFE79C70000-0x00007FFE7A731000-memory.dmp

Filesize
10.8MB

Download
memory/4680-142-0x000000001CFA0000-0x000000001D4C8000-memory.dmp

Filesize
5.2MB

Download
memory/4680-141-0x000000001B650000-0x000000001B6A0000-memory.dmp

Filesize
320KB

Download
memory/4680-140-0x00007FFE79C70000-0x00007FFE7A731000-memory.dmp

Filesize
10.8MB

Download
memory/4680-139-0x00000000009C0000-0x0000000000B6E000-memory.dmp

Filesize
1.7MB

Download