dcrat | 05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
05-08-2022 22:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54172888b473f2515b13fe1e2032a112.exe
Size

1.2MB
MD5

54172888b473f2515b13fe1e2032a112
SHA1

fc4ff4d53a1ea6cfee9265840bfc1dda0ee8c1e6
SHA256

05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca
SHA512

d09ce140712a46f3f94eaaf0c567ca30ce6de8b81ed8b45961cf6f4211225b43e6944dba769c212e11f836cf579932883a28d798353af9d6bd71c40e8a8f90a5

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	272	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	636	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	268	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	268	schtasks.exe

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
\comproviderRuntimecommon\chainsavesref.exe	dcrat
\comproviderRuntimecommon\chainsavesref.exe	dcrat
C:\comproviderRuntimecommon\chainsavesref.exe	dcrat
C:\comproviderRuntimecommon\chainsavesref.exe	dcrat
behavioral1/memory/1588-65-0x0000000000D00000-0x0000000000DD6000-memory.dmp	dcrat
C:\comproviderRuntimecommon\chainsavesref.exe	dcrat
C:\Recovery\706f83e2-06e4-11ed-8d2f-e67a70bb5ae9\taskhost.exe	dcrat
C:\Recovery\706f83e2-06e4-11ed-8d2f-e67a70bb5ae9\taskhost.exe	dcrat
behavioral1/memory/2744-74-0x0000000000250000-0x0000000000326000-memory.dmp	dcrat

Executes dropped EXE 3 IoCs

Processes:

chainsavesref.exechainsavesref.exetaskhost.exe

pid process

1588 chainsavesref.exe
2144 chainsavesref.exe
2744 taskhost.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

1564 cmd.exe
1564 cmd.exe

pid	process
1588	chainsavesref.exe
2144	chainsavesref.exe
2744	taskhost.exe

pid	process
1564	cmd.exe
1564	cmd.exe

Drops file in Program Files directory 11 IoCs

Processes:

chainsavesref.exechainsavesref.exe

description	ioc	process
File created	C:\Program Files\Java\csrss.exe	chainsavesref.exe
File created	C:\Program Files\7-Zip\Lang\75a57c1bdf437c	chainsavesref.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\schtasks.exe	chainsavesref.exe
File created	C:\Program Files (x86)\Windows Portable Devices\0d92ca00b4a11c	chainsavesref.exe
File created	C:\Program Files\Windows NT\Accessories\fr-FR\explorer.exe	chainsavesref.exe
File created	C:\Program Files\Windows NT\Accessories\fr-FR\7a0fd90576e088	chainsavesref.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\schtasks.exe	chainsavesref.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\3a6fe29a7ceee6	chainsavesref.exe
File created	C:\Program Files\Java\886983d96e3d3e	chainsavesref.exe
File created	C:\Program Files\7-Zip\Lang\WMIADAP.exe	chainsavesref.exe
File created	C:\Program Files (x86)\Windows Portable Devices\chainsavesref.exe	chainsavesref.exe

Drops file in Windows directory 2 IoCs

Processes:

chainsavesref.exe

description	ioc	process
File created	C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe	chainsavesref.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\886983d96e3d3e	chainsavesref.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
2344	schtasks.exe
2548	schtasks.exe
2572	schtasks.exe
1944	schtasks.exe
1556	schtasks.exe
868	schtasks.exe
2116	schtasks.exe
2272	schtasks.exe
2452	schtasks.exe
1696	schtasks.exe
1356	schtasks.exe
2252	schtasks.exe
432	schtasks.exe
2592	schtasks.exe
1104	schtasks.exe
1676	schtasks.exe
1184	schtasks.exe
2228	schtasks.exe
2524	schtasks.exe
1760	schtasks.exe
1724	schtasks.exe
556	schtasks.exe
2008	schtasks.exe
2052	schtasks.exe
2096	schtasks.exe
1244	schtasks.exe
976	schtasks.exe
840	schtasks.exe
2640	schtasks.exe
2292	schtasks.exe
2320	schtasks.exe
1184	schtasks.exe
984	schtasks.exe
2072	schtasks.exe
2364	schtasks.exe
2380	schtasks.exe
1196	schtasks.exe
1688	schtasks.exe
1536	schtasks.exe
1644	schtasks.exe
1780	schtasks.exe
2500	schtasks.exe
2616	schtasks.exe
2656	schtasks.exe
272	schtasks.exe
1692	schtasks.exe
1440	schtasks.exe
456	schtasks.exe
2436	schtasks.exe
636	schtasks.exe
1328	schtasks.exe
2212	schtasks.exe
2416	schtasks.exe
1636	schtasks.exe
1172	schtasks.exe
1752	schtasks.exe
2480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

chainsavesref.exechainsavesref.exetaskhost.exe

pid process

1588 chainsavesref.exe
2144 chainsavesref.exe
2744 taskhost.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

chainsavesref.exechainsavesref.exetaskhost.exe

description pid process

Token: SeDebugPrivilege 1588 chainsavesref.exe
Token: SeDebugPrivilege 2144 chainsavesref.exe
Token: SeDebugPrivilege 2744 taskhost.exe

pid	process
1588	chainsavesref.exe
2144	chainsavesref.exe
2744	taskhost.exe

description	pid	process
Token: SeDebugPrivilege	1588	chainsavesref.exe
Token: SeDebugPrivilege	2144	chainsavesref.exe
Token: SeDebugPrivilege	2744	taskhost.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

54172888b473f2515b13fe1e2032a112.exeWScript.execmd.exechainsavesref.exechainsavesref.execmd.exe

description	pid	process	target process
PID 1912 wrote to memory of 1356	1912	54172888b473f2515b13fe1e2032a112.exe	WScript.exe
PID 1912 wrote to memory of 1356	1912	54172888b473f2515b13fe1e2032a112.exe	WScript.exe
PID 1912 wrote to memory of 1356	1912	54172888b473f2515b13fe1e2032a112.exe	WScript.exe
PID 1912 wrote to memory of 1356	1912	54172888b473f2515b13fe1e2032a112.exe	WScript.exe
PID 1356 wrote to memory of 1564	1356	WScript.exe	cmd.exe
PID 1356 wrote to memory of 1564	1356	WScript.exe	cmd.exe
PID 1356 wrote to memory of 1564	1356	WScript.exe	cmd.exe
PID 1356 wrote to memory of 1564	1356	WScript.exe	cmd.exe
PID 1564 wrote to memory of 1588	1564	cmd.exe	chainsavesref.exe
PID 1564 wrote to memory of 1588	1564	cmd.exe	chainsavesref.exe
PID 1564 wrote to memory of 1588	1564	cmd.exe	chainsavesref.exe
PID 1564 wrote to memory of 1588	1564	cmd.exe	chainsavesref.exe
PID 1588 wrote to memory of 2144	1588	chainsavesref.exe	chainsavesref.exe
PID 1588 wrote to memory of 2144	1588	chainsavesref.exe	chainsavesref.exe
PID 1588 wrote to memory of 2144	1588	chainsavesref.exe	chainsavesref.exe
PID 2144 wrote to memory of 2688	2144	chainsavesref.exe	cmd.exe
PID 2144 wrote to memory of 2688	2144	chainsavesref.exe	cmd.exe
PID 2144 wrote to memory of 2688	2144	chainsavesref.exe	cmd.exe
PID 2688 wrote to memory of 2724	2688	cmd.exe	w32tm.exe
PID 2688 wrote to memory of 2724	2688	cmd.exe	w32tm.exe
PID 2688 wrote to memory of 2724	2688	cmd.exe	w32tm.exe
PID 2688 wrote to memory of 2744	2688	cmd.exe	taskhost.exe
PID 2688 wrote to memory of 2744	2688	cmd.exe	taskhost.exe
PID 2688 wrote to memory of 2744	2688	cmd.exe	taskhost.exe

C:\Users\Admin\AppData\Local\Temp\54172888b473f2515b13fe1e2032a112.exe
"C:\Users\Admin\AppData\Local\Temp\54172888b473f2515b13fe1e2032a112.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\comproviderRuntimecommon\et1pu6VAlkUOY7GuC90A.vbe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\comproviderRuntimecommon\DLLiR59GMmL352HHbgfc.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1564

C:\comproviderRuntimecommon\chainsavesref.exe
"C:\comproviderRuntimecommon\chainsavesref.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588

C:\comproviderRuntimecommon\chainsavesref.exe
"C:\comproviderRuntimecommon\chainsavesref.exe"
5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xA67GBRsJ0.bat"
6⤵
- Suspicious use of WriteProcessMemory
PID:2688

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
7⤵
PID:2724

C:\Recovery\706f83e2-06e4-11ed-8d2f-e67a70bb5ae9\taskhost.exe
"C:\Recovery\706f83e2-06e4-11ed-8d2f-e67a70bb5ae9\taskhost.exe"
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\comproviderRuntimecommon\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\comproviderRuntimecommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\comproviderRuntimecommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\comproviderRuntimecommon\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\comproviderRuntimecommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\comproviderRuntimecommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\comproviderRuntimecommon\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\comproviderRuntimecommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\comproviderRuntimecommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainsavesrefc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\chainsavesref.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainsavesref" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\chainsavesref.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainsavesrefc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\chainsavesref.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\comproviderRuntimecommon\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\comproviderRuntimecommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\comproviderRuntimecommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Templates\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\comproviderRuntimecommon\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\comproviderRuntimecommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\comproviderRuntimecommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\Accessories\fr-FR\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\fr-FR\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\Accessories\fr-FR\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\comproviderRuntimecommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\comproviderRuntimecommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\comproviderRuntimecommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\schtasks.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 6 /tr "'C:\comproviderRuntimecommon\schtasks.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\comproviderRuntimecommon\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 13 /tr "'C:\comproviderRuntimecommon\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Java\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Recovery\706f83e2-06e4-11ed-8d2f-e67a70bb5ae9\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\706f83e2-06e4-11ed-8d2f-e67a70bb5ae9\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Recovery\706f83e2-06e4-11ed-8d2f-e67a70bb5ae9\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\schtasks.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\Lang\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 12 /tr "'C:\Program Files\7-Zip\Lang\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Favorites\Windows Live\schtasks.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\Windows Live\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Favorites\Windows Live\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\706f83e2-06e4-11ed-8d2f-e67a70bb5ae9\taskhost.exe
Filesize
828KB

MD5
4eaf964b744bd6801b5122ae1afbbde4

SHA1
6e459fb6f3c6b7094d8d5af10bc30c87aee03981

SHA256
b570e2028088759d02ea13f7646bf7aca78865d55f7fd8e2efaeec45c670e9ff

SHA512
dc3e15ab58996c71e8999dd5521961f2bd08529f685465bca5b11319ef0b4dc009f2528097adce0dca44fc675ba04156f9846f986f07a3e8ced366d5abbd2d4a

Download Submit
C:\Recovery\706f83e2-06e4-11ed-8d2f-e67a70bb5ae9\taskhost.exe
Filesize
828KB

MD5
4eaf964b744bd6801b5122ae1afbbde4

SHA1
6e459fb6f3c6b7094d8d5af10bc30c87aee03981

SHA256
b570e2028088759d02ea13f7646bf7aca78865d55f7fd8e2efaeec45c670e9ff

SHA512
dc3e15ab58996c71e8999dd5521961f2bd08529f685465bca5b11319ef0b4dc009f2528097adce0dca44fc675ba04156f9846f986f07a3e8ced366d5abbd2d4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\xA67GBRsJ0.bat
Filesize
226B

MD5
c18cfa977a905eeb5aecb76df4ca1732

SHA1
9353f78c2a9bb5e5c2d7889f04f179e6c71d5ae1

SHA256
403a35f3b89141efbe290d4b3d877cc2ae834538292b9479a4200174f4ea5f71

SHA512
1e5ac731cf2eb20f15c9d7b9b49cc4fa68bdeca0803ec5d909d9a64be176f5e07726f439432574eff6184901ab2077f3248c933230c74479453bce336f8caf98

Download Submit
C:\comproviderRuntimecommon\DLLiR59GMmL352HHbgfc.bat
Filesize
47B

MD5
665bda14c5e0f28a4fcaab8726dc6ebe

SHA1
16deb93757751e2d66e05c2c22505db113fa96ba

SHA256
09c3e02a4caad39e7c91f0ba1cc93c8c727d23b306da9129cca1d0955880c33e

SHA512
51e85507a8c515fb3fe854a5d969c83d4c6add05284a11232b773eebd19ba2b148b01ce116d65d6bf7cdfc13064abff8f0e69825630446e00b7846eb16ed8cb5

Download Submit
C:\comproviderRuntimecommon\chainsavesref.exe
Filesize
828KB

MD5
4eaf964b744bd6801b5122ae1afbbde4

SHA1
6e459fb6f3c6b7094d8d5af10bc30c87aee03981

SHA256
b570e2028088759d02ea13f7646bf7aca78865d55f7fd8e2efaeec45c670e9ff

SHA512
dc3e15ab58996c71e8999dd5521961f2bd08529f685465bca5b11319ef0b4dc009f2528097adce0dca44fc675ba04156f9846f986f07a3e8ced366d5abbd2d4a

Download Submit
C:\comproviderRuntimecommon\chainsavesref.exe
Filesize
828KB

MD5
4eaf964b744bd6801b5122ae1afbbde4

SHA1
6e459fb6f3c6b7094d8d5af10bc30c87aee03981

SHA256
b570e2028088759d02ea13f7646bf7aca78865d55f7fd8e2efaeec45c670e9ff

SHA512
dc3e15ab58996c71e8999dd5521961f2bd08529f685465bca5b11319ef0b4dc009f2528097adce0dca44fc675ba04156f9846f986f07a3e8ced366d5abbd2d4a

Download Submit
C:\comproviderRuntimecommon\chainsavesref.exe
Filesize
828KB

MD5
4eaf964b744bd6801b5122ae1afbbde4

SHA1
6e459fb6f3c6b7094d8d5af10bc30c87aee03981

SHA256
b570e2028088759d02ea13f7646bf7aca78865d55f7fd8e2efaeec45c670e9ff

SHA512
dc3e15ab58996c71e8999dd5521961f2bd08529f685465bca5b11319ef0b4dc009f2528097adce0dca44fc675ba04156f9846f986f07a3e8ced366d5abbd2d4a

Download Submit
C:\comproviderRuntimecommon\et1pu6VAlkUOY7GuC90A.vbe
Filesize
221B

MD5
57f4cbf8c281acde2c48327dfb2b3c45

SHA1
f752ff26e32bed28f91712e5322d438adae0d6f4

SHA256
0864baa556adddc451e8ad0acbdfbaf692a7371a5cbb8ef2b2b83aa05c56fb39

SHA512
cf9ef8920df9e3bd5cb9f907616c48bf0267df974987774495f84d49999e54a626f96b8221dda23abbed5e753c1f53725ffe896a43b0cba41ee0eacdc1f6bddb

Download Submit
\comproviderRuntimecommon\chainsavesref.exe
Filesize
828KB

MD5
4eaf964b744bd6801b5122ae1afbbde4

SHA1
6e459fb6f3c6b7094d8d5af10bc30c87aee03981

SHA256
b570e2028088759d02ea13f7646bf7aca78865d55f7fd8e2efaeec45c670e9ff

SHA512
dc3e15ab58996c71e8999dd5521961f2bd08529f685465bca5b11319ef0b4dc009f2528097adce0dca44fc675ba04156f9846f986f07a3e8ced366d5abbd2d4a

Download Submit
\comproviderRuntimecommon\chainsavesref.exe
Filesize
828KB

MD5
4eaf964b744bd6801b5122ae1afbbde4

SHA1
6e459fb6f3c6b7094d8d5af10bc30c87aee03981

SHA256
b570e2028088759d02ea13f7646bf7aca78865d55f7fd8e2efaeec45c670e9ff

SHA512
dc3e15ab58996c71e8999dd5521961f2bd08529f685465bca5b11319ef0b4dc009f2528097adce0dca44fc675ba04156f9846f986f07a3e8ced366d5abbd2d4a

Download Submit
memory/1356-55-0x0000000000000000-mapping.dmp

Download
memory/1564-59-0x0000000000000000-mapping.dmp

Download
memory/1588-65-0x0000000000D00000-0x0000000000DD6000-memory.dmp

Filesize
856KB

Download
memory/1588-63-0x0000000000000000-mapping.dmp

Download
memory/1912-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/2144-66-0x0000000000000000-mapping.dmp

Download
memory/2688-68-0x0000000000000000-mapping.dmp

Download
memory/2724-70-0x0000000000000000-mapping.dmp

Download
memory/2744-72-0x0000000000000000-mapping.dmp

Download
memory/2744-74-0x0000000000250000-0x0000000000326000-memory.dmp

Filesize
856KB

Download