dcrat | 3900163fd89de58034a893e72448e0f823e2e3c676f93cf62ac65dcbf33bc5fa

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
roat.exe
Size 2.0MB
Sample221010-h54rdabaa8
SHA256 3900163fd89de58034a893e72448e0f823e2e3c676f93cf62ac65dcbf33bc5fa
MD5 404c02b623519354464d28dc0ca603d3
SHA1 0d004a547ad24f558c8845733a3c975b60e5806d
SHA512 76d4119138f8f0efebeaba2e5570b6b83efc461272d8c8244ff93d5e41eb0259bb198a2b8e3e2c1a684d39132c579a7dbd60ed75b6214ef10558940a58d193a7
SSDEEP 49152:ubA3joHXCcnjW2493nxEsyCSo1U+Jpz5HU2TwVGq:ubTbW/0dCSG/bzJU2IT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3740	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3556	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3400	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4368	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3448	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4328	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3972	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	580	4404	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	4404	schtasks.exe	87

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0006000000022f58-137.dat	dcrat
behavioral2/files/0x0006000000022f58-138.dat	dcrat
behavioral2/memory/1976-139-0x0000000000120000-0x00000000002E6000-memory.dmp	dcrat
behavioral2/files/0x0006000000022f81-201.dat	dcrat
behavioral2/files/0x0006000000022f81-202.dat	dcrat

Executes dropped EXE 2 IoCs

pid	Process
1976	agentPerfsvc.exe
1912	sppsvc.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	roat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	agentPerfsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	sppsvc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	ipinfo.io
32	ipinfo.io

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Photo Viewer\en-US\0a1fd5f707cd16	agentPerfsvc.exe
File created	C:\Program Files\Uninstall Information\WmiPrvSE.exe	agentPerfsvc.exe
File opened for modification	C:\Program Files\Uninstall Information\WmiPrvSE.exe	agentPerfsvc.exe
File created	C:\Program Files (x86)\Microsoft\upfc.exe	agentPerfsvc.exe
File created	C:\Program Files (x86)\Microsoft\ea1d8f6d871115	agentPerfsvc.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\upfc.exe	agentPerfsvc.exe
File created	C:\Program Files\Internet Explorer\images\spoolsv.exe	agentPerfsvc.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\sppsvc.exe	agentPerfsvc.exe
File created	C:\Program Files\Uninstall Information\24dbde2999530e	agentPerfsvc.exe
File created	C:\Program Files\Internet Explorer\images\f3b6ecef712a24	agentPerfsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dwm.exe	agentPerfsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\6cb0b6c459d5d3	agentPerfsvc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\OCR\en-us\sppsvc.exe	agentPerfsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4428	schtasks.exe
3584	schtasks.exe
1588	schtasks.exe
3740	schtasks.exe
2256	schtasks.exe
4328	schtasks.exe
2440	schtasks.exe
4624	schtasks.exe
2412	schtasks.exe
4368	schtasks.exe
784	schtasks.exe
668	schtasks.exe
4820	schtasks.exe
3400	schtasks.exe
3656	schtasks.exe
2388	schtasks.exe
684	schtasks.exe
3448	schtasks.exe
3912	schtasks.exe
580	schtasks.exe
3452	schtasks.exe
3556	schtasks.exe
380	schtasks.exe
2164	schtasks.exe
5000	schtasks.exe
2836	schtasks.exe
4320	schtasks.exe
968	schtasks.exe
1036	schtasks.exe
4804	schtasks.exe
2668	schtasks.exe
4524	schtasks.exe
3972	schtasks.exe
1704	schtasks.exe
4780	schtasks.exe
5096	schtasks.exe
3268	schtasks.exe
1664	schtasks.exe
2968	schtasks.exe
444	schtasks.exe
5112	schtasks.exe
2648	schtasks.exe
4684	schtasks.exe
3596	schtasks.exe
740	schtasks.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	roat.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	agentPerfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	sppsvc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
2124	powershell.exe
2124	powershell.exe
3432	powershell.exe
3432	powershell.exe
3724	powershell.exe
1908	powershell.exe
1908	powershell.exe
3724	powershell.exe
2344	powershell.exe
2344	powershell.exe
2696	powershell.exe
2696	powershell.exe
1976	agentPerfsvc.exe
1976	agentPerfsvc.exe
3800	powershell.exe
3800	powershell.exe
1976	agentPerfsvc.exe
3048	powershell.exe
3048	powershell.exe
2696	powershell.exe
3088	powershell.exe
3088	powershell.exe
1520	powershell.exe
1520	powershell.exe
3680	powershell.exe
3680	powershell.exe
4840	powershell.exe
4840	powershell.exe
4980	powershell.exe
4980	powershell.exe
3088	powershell.exe
3432	powershell.exe
3432	powershell.exe
3800	powershell.exe
2124	powershell.exe
2124	powershell.exe
1908	powershell.exe
1908	powershell.exe
3724	powershell.exe
3724	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1912	sppsvc.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	agentPerfsvc.exe
Token: SeDebugPrivilege	3800	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeDebugPrivilege	3724	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	3680	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	1912	sppsvc.exe
Token: SeBackupPrivilege	4588	vssvc.exe
Token: SeRestorePrivilege	4588	vssvc.exe
Token: SeAuditPrivilege	4588	vssvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1912	sppsvc.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 4908	2400	roat.exe	80
PID 2400 wrote to memory of 4908	2400	roat.exe	80
PID 2400 wrote to memory of 4908	2400	roat.exe	80
PID 4908 wrote to memory of 1436	4908	WScript.exe	83
PID 4908 wrote to memory of 1436	4908	WScript.exe	83
PID 4908 wrote to memory of 1436	4908	WScript.exe	83
PID 1436 wrote to memory of 1976	1436	cmd.exe	86
PID 1436 wrote to memory of 1976	1436	cmd.exe	86
PID 1976 wrote to memory of 3724	1976	agentPerfsvc.exe	134
PID 1976 wrote to memory of 3724	1976	agentPerfsvc.exe	134
PID 1976 wrote to memory of 3800	1976	agentPerfsvc.exe	135
PID 1976 wrote to memory of 3800	1976	agentPerfsvc.exe	135
PID 1976 wrote to memory of 2124	1976	agentPerfsvc.exe	136
PID 1976 wrote to memory of 2124	1976	agentPerfsvc.exe	136
PID 1976 wrote to memory of 3432	1976	agentPerfsvc.exe	140
PID 1976 wrote to memory of 3432	1976	agentPerfsvc.exe	140
PID 1976 wrote to memory of 1908	1976	agentPerfsvc.exe	138
PID 1976 wrote to memory of 1908	1976	agentPerfsvc.exe	138
PID 1976 wrote to memory of 2344	1976	agentPerfsvc.exe	141
PID 1976 wrote to memory of 2344	1976	agentPerfsvc.exe	141
PID 1976 wrote to memory of 2696	1976	agentPerfsvc.exe	153
PID 1976 wrote to memory of 2696	1976	agentPerfsvc.exe	153
PID 1976 wrote to memory of 3680	1976	agentPerfsvc.exe	143
PID 1976 wrote to memory of 3680	1976	agentPerfsvc.exe	143
PID 1976 wrote to memory of 3048	1976	agentPerfsvc.exe	144
PID 1976 wrote to memory of 3048	1976	agentPerfsvc.exe	144
PID 1976 wrote to memory of 1520	1976	agentPerfsvc.exe	145
PID 1976 wrote to memory of 1520	1976	agentPerfsvc.exe	145
PID 1976 wrote to memory of 3088	1976	agentPerfsvc.exe	147
PID 1976 wrote to memory of 3088	1976	agentPerfsvc.exe	147
PID 1976 wrote to memory of 4980	1976	agentPerfsvc.exe	149
PID 1976 wrote to memory of 4980	1976	agentPerfsvc.exe	149
PID 1976 wrote to memory of 4840	1976	agentPerfsvc.exe	158
PID 1976 wrote to memory of 4840	1976	agentPerfsvc.exe	158
PID 1976 wrote to memory of 3944	1976	agentPerfsvc.exe	160
PID 1976 wrote to memory of 3944	1976	agentPerfsvc.exe	160
PID 3944 wrote to memory of 4496	3944	cmd.exe	164
PID 3944 wrote to memory of 4496	3944	cmd.exe	164
PID 3944 wrote to memory of 1912	3944	cmd.exe	166
PID 3944 wrote to memory of 1912	3944	cmd.exe	166
PID 1912 wrote to memory of 1772	1912	sppsvc.exe	167
PID 1912 wrote to memory of 1772	1912	sppsvc.exe	167
PID 1912 wrote to memory of 2180	1912	sppsvc.exe	168
PID 1912 wrote to memory of 2180	1912	sppsvc.exe	168

C:\Users\Admin\AppData\Local\Temp\roat.exe
"C:\Users\Admin\AppData\Local\Temp\roat.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\MsHostnet\9WShuhmwpNSmjvs2MB.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\MsHostnet\uypdQNaQoNpDVKti.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\MsHostnet\agentPerfsvc.exe
      "C:\MsHostnet\agentPerfsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1976
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3800
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MsHostnet/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3088
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4840
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JRZrDxGZ6G.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3944
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4496
      - C:\Program Files\Windows Photo Viewer\en-US\sppsvc.exe
        
        "C:\Program Files\Windows Photo Viewer\en-US\sppsvc.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e6e1961c-e425-452e-a92f-5b23f63a67f0.vbs"
        7⤵
        
        PID:1772
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6370398c-cb29-402f-961a-57012fe6a537.vbs"
        7⤵
        
        PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Application Data\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default\Application Data\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Application Data\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\MsHostnet\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\MsHostnet\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\MsHostnet\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\MsHostnet\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MsHostnet\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\MsHostnet\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Start Menu\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Start Menu\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\MsHostnet\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MsHostnet\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\MsHostnet\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Music\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Music\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Music\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\images\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\images\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\en-US\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Music\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Default\Music\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Music\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\MsHostnet\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MsHostnet\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\MsHostnet\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3452

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9WShuhmwpNSmjvs2MB.vbe

Path C:\MsHostnet\9WShuhmwpNSmjvs2MB.vbe
Size 202B
SHA256 ce32fb78e9d9aa4e92da14efadfec4334e006fd8f246d1905c2e4c295fb8d4a4
MD5 65d829528f23badfdcb6fd95fc0e9d65
SHA1 ef1ed60630793659ccbfdaebe8160c9b1820adca
SHA512 8463e2f1c1a3fddc7c91fa79e101f717a904b85197026c95dd05b8c928b0c87127dba798b34336f6330670b86b25a9c0edfcfff605a7c8425e4cac86e06516c0
MD5 SHA1 SHA512

Submit Download

agentPerfsvc.exe

Path C:\MsHostnet\agentPerfsvc.exe
Size 1.7MB
SHA256 1bbf5681542732302609899d6b1677e6ac0e3e90d14a8fa4f1cfca3df9843820
MD5 d8e7f825269f7326aee977a01dd868e8
SHA1 1710206d3069eea76dfd0fad8068a57e9eabbb62
SHA512 a2a1894b27138095c45a356e6f56a8ad91b1985cec123432892dc0b8ca9231bab2fd757c43f36a69bb75dc52678690ea8c4d39a9d92b1234c144d577c0579c48
SSDEEP 49152:0HXCcnjW2493nxEsyCSo1U+Jpz5HU2TwVG:obW/0dCSG/bzJU2I
MD5 SHA1 SHA512 SSDEEP

Submit Download

agentPerfsvc.exe

Path C:\MsHostnet\agentPerfsvc.exe
Size 1.7MB
SHA256 1bbf5681542732302609899d6b1677e6ac0e3e90d14a8fa4f1cfca3df9843820
MD5 d8e7f825269f7326aee977a01dd868e8
SHA1 1710206d3069eea76dfd0fad8068a57e9eabbb62
SHA512 a2a1894b27138095c45a356e6f56a8ad91b1985cec123432892dc0b8ca9231bab2fd757c43f36a69bb75dc52678690ea8c4d39a9d92b1234c144d577c0579c48
SSDEEP 49152:0HXCcnjW2493nxEsyCSo1U+Jpz5HU2TwVG:obW/0dCSG/bzJU2I
MD5 SHA1 SHA512 SSDEEP

Submit Download

uypdQNaQoNpDVKti.bat

Path C:\MsHostnet\uypdQNaQoNpDVKti.bat
Size 31B
SHA256 572fe9542426529fd32b07df0a59212ef0cc5d6291aee96c6b603e9393099ca2
MD5 5769885f7d5a6b309f5e5ac0f4baa4f3
SHA1 d2234f565dc3e7b5560b402e58bcf0a47e4b91f0
SHA512 1525a94e7f4f90810e14dce43049d1ea4e31bd52f0af77faa415d059728931feb731f2668cd12608a9416fcb7483aadf9d3bd1d3b4269df3161e416f6d0d09b4
MD5 SHA1 SHA512

Submit Download

sppsvc.exe

Path C:\Program Files\Windows Photo Viewer\en-US\sppsvc.exe
Size 1.7MB
SHA256 1bbf5681542732302609899d6b1677e6ac0e3e90d14a8fa4f1cfca3df9843820
MD5 d8e7f825269f7326aee977a01dd868e8
SHA1 1710206d3069eea76dfd0fad8068a57e9eabbb62
SHA512 a2a1894b27138095c45a356e6f56a8ad91b1985cec123432892dc0b8ca9231bab2fd757c43f36a69bb75dc52678690ea8c4d39a9d92b1234c144d577c0579c48
SSDEEP 49152:0HXCcnjW2493nxEsyCSo1U+Jpz5HU2TwVG:obW/0dCSG/bzJU2I
MD5 SHA1 SHA512 SSDEEP

Submit Download

sppsvc.exe

Path C:\Program Files\Windows Photo Viewer\en-US\sppsvc.exe
Size 1.7MB
SHA256 1bbf5681542732302609899d6b1677e6ac0e3e90d14a8fa4f1cfca3df9843820
MD5 d8e7f825269f7326aee977a01dd868e8
SHA1 1710206d3069eea76dfd0fad8068a57e9eabbb62
SHA512 a2a1894b27138095c45a356e6f56a8ad91b1985cec123432892dc0b8ca9231bab2fd757c43f36a69bb75dc52678690ea8c4d39a9d92b1234c144d577c0579c48
SSDEEP 49152:0HXCcnjW2493nxEsyCSo1U+Jpz5HU2TwVG:obW/0dCSG/bzJU2I
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download