dcrat | 673d075938eeef4f6a0b24c6939730604f431bd6cbdb1f9c5177ecb1a97c5e4f

Analysis

max time kernel
143s
max time network
153s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
10/08/2022, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
35ee1e77962200770658ab5ce3d06244.exe
Size 1.6MB
Sample220810-vs4xtseha5
SHA256 673d075938eeef4f6a0b24c6939730604f431bd6cbdb1f9c5177ecb1a97c5e4f
MD5 35ee1e77962200770658ab5ce3d06244
SHA1 d70700b9b65239930ca0993a75b68a1529b987a9
SHA512 9b53a0183231bf95f7838814e71b5ed90d99b1d0167ea3b0b0a4b4b12210b467e637333ea8ca2944b02c15b69881d99ce5da0d341fdfabc55bbf6b2061cbbc69
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	596	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1420	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	596	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	844	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	844	schtasks.exe	27

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1900-55-0x00000000003E0000-0x000000000084E000-memory.dmp	dcrat
behavioral1/memory/1900-67-0x00000000003E0000-0x000000000084E000-memory.dmp	dcrat
behavioral1/memory/2580-69-0x0000000001320000-0x000000000178E000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2580	wininit.exe

Loads dropped DLL 2 IoCs

pid	Process
1900	35ee1e77962200770658ab5ce3d06244.exe
1900	35ee1e77962200770658ab5ce3d06244.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
1900	35ee1e77962200770658ab5ce3d06244.exe
1900	35ee1e77962200770658ab5ce3d06244.exe
1900	35ee1e77962200770658ab5ce3d06244.exe
1900	35ee1e77962200770658ab5ce3d06244.exe
2580	wininit.exe
2580	wininit.exe
2580	wininit.exe
2580	wininit.exe
2580	wininit.exe
2580	wininit.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\TableTextService\35ee1e77962200770658ab5ce3d06244.exe	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Program Files\Microsoft Office\69ddcba757bf72	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\0a1fd5f707cd16	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Idle.exe	35ee1e77962200770658ab5ce3d06244.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Idle.exe	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\56085415360792	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\sppsvc.exe	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\System.exe	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Program Files\Windows Portable Devices\lsass.exe	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\wininit.exe	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Program Files\Uninstall Information\smss.exe	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Program Files\Uninstall Information\69ddcba757bf72	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Program Files\Windows Portable Devices\6203df4a6bafc7	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Program Files\Microsoft Office\smss.exe	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\27d1bcfc3c54e0	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Program Files (x86)\Common Files\Adobe\6ccacd8608530f	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\958c16d26632e8	35ee1e77962200770658ab5ce3d06244.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\assembly\75a57c1bdf437c	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Windows\de-DE\886983d96e3d3e	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Windows\Fonts\27d1bcfc3c54e0	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Windows\PLA\System\smss.exe	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Windows\PLA\System\69ddcba757bf72	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Windows\assembly\WMIADAP.exe	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Windows\Cursors\dwm.exe	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Windows\Cursors\6cb0b6c459d5d3	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ieinstal.resources_31bf3856ad364e35_8.0.7600.16385_en-us_708d2790e340090a\taskhost.exe	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Windows\de-DE\csrss.exe	35ee1e77962200770658ab5ce3d06244.exe
File created	C:\Windows\Fonts\System.exe	35ee1e77962200770658ab5ce3d06244.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1420	schtasks.exe
2208	schtasks.exe
2472	schtasks.exe
588	schtasks.exe
1248	schtasks.exe
1552	schtasks.exe
1384	schtasks.exe
1924	schtasks.exe
1600	schtasks.exe
1164	schtasks.exe
1872	schtasks.exe
2412	schtasks.exe
1260	schtasks.exe
1996	schtasks.exe
2160	schtasks.exe
1824	schtasks.exe
560	schtasks.exe
1148	schtasks.exe
2036	schtasks.exe
1176	schtasks.exe
1496	schtasks.exe
2088	schtasks.exe
2512	schtasks.exe
1760	schtasks.exe
1368	schtasks.exe
1520	schtasks.exe
2068	schtasks.exe
2180	schtasks.exe
2388	schtasks.exe
2552	schtasks.exe
1276	schtasks.exe
1012	schtasks.exe
1556	schtasks.exe
596	schtasks.exe
832	schtasks.exe
1884	schtasks.exe
1864	schtasks.exe
1628	schtasks.exe
1312	schtasks.exe
1720	schtasks.exe
872	schtasks.exe
1276	schtasks.exe
1068	schtasks.exe
1004	schtasks.exe
320	schtasks.exe
2432	schtasks.exe
2532	schtasks.exe
1248	schtasks.exe
568	schtasks.exe
1056	schtasks.exe
1996	schtasks.exe
2112	schtasks.exe
2132	schtasks.exe
596	schtasks.exe
1948	schtasks.exe
2452	schtasks.exe
2492	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1900	35ee1e77962200770658ab5ce3d06244.exe
1900	35ee1e77962200770658ab5ce3d06244.exe
1900	35ee1e77962200770658ab5ce3d06244.exe
2580	wininit.exe
2580	wininit.exe
2580	wininit.exe
2580	wininit.exe
2580	wininit.exe
2580	wininit.exe
2580	wininit.exe
2580	wininit.exe
2580	wininit.exe
2580	wininit.exe
2580	wininit.exe
2580	wininit.exe
2580	wininit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	35ee1e77962200770658ab5ce3d06244.exe
Token: SeDebugPrivilege	2580	wininit.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1900	35ee1e77962200770658ab5ce3d06244.exe
2580	wininit.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2580	1900	35ee1e77962200770658ab5ce3d06244.exe	85
PID 1900 wrote to memory of 2580	1900	35ee1e77962200770658ab5ce3d06244.exe	85
PID 1900 wrote to memory of 2580	1900	35ee1e77962200770658ab5ce3d06244.exe	85
PID 1900 wrote to memory of 2580	1900	35ee1e77962200770658ab5ce3d06244.exe	85

C:\Users\Admin\AppData\Local\Temp\35ee1e77962200770658ab5ce3d06244.exe
"C:\Users\Admin\AppData\Local\Temp\35ee1e77962200770658ab5ce3d06244.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\wininit.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\wininit.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\Adobe\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Adobe\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Windows\Fonts\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Fonts\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Windows\Fonts\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "35ee1e77962200770658ab5ce3d062443" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\35ee1e77962200770658ab5ce3d06244.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "35ee1e77962200770658ab5ce3d06244" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\35ee1e77962200770658ab5ce3d06244.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "35ee1e77962200770658ab5ce3d062443" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\35ee1e77962200770658ab5ce3d06244.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Microsoft Help\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft Help\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Microsoft Help\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\PLA\System\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\PLA\System\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\PLA\System\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 12 /tr "'C:\Windows\assembly\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Windows\assembly\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 11 /tr "'C:\Windows\assembly\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\uninstall\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\uninstall\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "35ee1e77962200770658ab5ce3d062443" /sc MINUTE /mo 11 /tr "'C:\Recovery\487b7f82-06f6-11ed-97c6-f3176827e7ec\35ee1e77962200770658ab5ce3d06244.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "35ee1e77962200770658ab5ce3d06244" /sc ONLOGON /tr "'C:\Recovery\487b7f82-06f6-11ed-97c6-f3176827e7ec\35ee1e77962200770658ab5ce3d06244.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "35ee1e77962200770658ab5ce3d062443" /sc MINUTE /mo 6 /tr "'C:\Recovery\487b7f82-06f6-11ed-97c6-f3176827e7ec\35ee1e77962200770658ab5ce3d06244.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\Cursors\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Cursors\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\Cursors\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\de-DE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wininit.exe

Path C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\wininit.exe
Size 1.6MB
SHA256 673d075938eeef4f6a0b24c6939730604f431bd6cbdb1f9c5177ecb1a97c5e4f
MD5 35ee1e77962200770658ab5ce3d06244
SHA1 d70700b9b65239930ca0993a75b68a1529b987a9
SHA512 9b53a0183231bf95f7838814e71b5ed90d99b1d0167ea3b0b0a4b4b12210b467e637333ea8ca2944b02c15b69881d99ce5da0d341fdfabc55bbf6b2061cbbc69
SSDEEP 49152:X9W4iylDW8dFR9Af2VYtQN/VVWQf08GMu:tWlylD3PA+O+BVHf8
MD5 SHA1 SHA512 SSDEEP

Submit Download

wininit.exe

Path \??\c:\program files (x86)\reference assemblies\microsoft\framework\v3.5\it\wininit.exe
Size 1.6MB
SHA256 673d075938eeef4f6a0b24c6939730604f431bd6cbdb1f9c5177ecb1a97c5e4f
MD5 35ee1e77962200770658ab5ce3d06244
SHA1 d70700b9b65239930ca0993a75b68a1529b987a9
SHA512 9b53a0183231bf95f7838814e71b5ed90d99b1d0167ea3b0b0a4b4b12210b467e637333ea8ca2944b02c15b69881d99ce5da0d341fdfabc55bbf6b2061cbbc69
SSDEEP 49152:X9W4iylDW8dFR9Af2VYtQN/VVWQf08GMu:tWlylD3PA+O+BVHf8
MD5 SHA1 SHA512 SSDEEP

Submit Download

wininit.exe

Path \Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\wininit.exe
Size 1.6MB
SHA256 673d075938eeef4f6a0b24c6939730604f431bd6cbdb1f9c5177ecb1a97c5e4f
MD5 35ee1e77962200770658ab5ce3d06244
SHA1 d70700b9b65239930ca0993a75b68a1529b987a9
SHA512 9b53a0183231bf95f7838814e71b5ed90d99b1d0167ea3b0b0a4b4b12210b467e637333ea8ca2944b02c15b69881d99ce5da0d341fdfabc55bbf6b2061cbbc69
SSDEEP 49152:X9W4iylDW8dFR9Af2VYtQN/VVWQf08GMu:tWlylD3PA+O+BVHf8
MD5 SHA1 SHA512 SSDEEP

Submit Download

wininit.exe

Path \Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\wininit.exe
Size 1.6MB
SHA256 673d075938eeef4f6a0b24c6939730604f431bd6cbdb1f9c5177ecb1a97c5e4f
MD5 35ee1e77962200770658ab5ce3d06244
SHA1 d70700b9b65239930ca0993a75b68a1529b987a9
SHA512 9b53a0183231bf95f7838814e71b5ed90d99b1d0167ea3b0b0a4b4b12210b467e637333ea8ca2944b02c15b69881d99ce5da0d341fdfabc55bbf6b2061cbbc69
SSDEEP 49152:X9W4iylDW8dFR9Af2VYtQN/VVWQf08GMu:tWlylD3PA+O+BVHf8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1900-58-0x0000000000B20000-0x0000000000B32000-memory.dmp

Download

memory/1900-56-0x0000000002520000-0x000000000253C000-memory.dmp

Download

memory/1900-60-0x0000000002590000-0x00000000025A2000-memory.dmp

Download

memory/1900-61-0x00000000025C0000-0x00000000025CE000-memory.dmp

Download

memory/1900-54-0x0000000075CB1000-0x0000000075CB3000-memory.dmp

Download

memory/1900-55-0x00000000003E0000-0x000000000084E000-memory.dmp

Download

memory/1900-57-0x0000000002560000-0x0000000002576000-memory.dmp

Download

memory/1900-59-0x00000000025A0000-0x00000000025B0000-memory.dmp

Download

memory/1900-67-0x00000000003E0000-0x000000000084E000-memory.dmp

Download

memory/2580-69-0x0000000001320000-0x000000000178E000-memory.dmp

Download

memory/2580-70-0x0000000000C00000-0x0000000000C12000-memory.dmp

Download

memory/2580-71-0x0000000000CF0000-0x0000000000D02000-memory.dmp

Download

memory/2580-72-0x0000000001320000-0x000000000178E000-memory.dmp

Download