dcrat | 08c91ef850ca2ab93a3cf5bb5b9d8854ce63d15ea7eff9234f961f59bc51064e

Analysis

max time kernel
181s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
23d4d6a09b99d94373c3e4c49020febf.exe
Size 2.5MB
Sample221014-all38abgc8
SHA256 08c91ef850ca2ab93a3cf5bb5b9d8854ce63d15ea7eff9234f961f59bc51064e
MD5 23d4d6a09b99d94373c3e4c49020febf
SHA1 24bc20f7c331405eafe23fd199f681c7a20a7f66
SHA512 eb6e7a3f10b1950cca29831d514479084e0a2b4a5343a0e41527adae100b81bbd5ecd88e567f2d06892657ea457e8e34dc5be0880acd6a56c368ef3b43ccd62d
SSDEEP 49152:0no4gjXMihQWbtlaXD72pi8F+J9HlAffWl5IXdWsop9CYYjp+8X:iCMiu5X2pi8F+JxOfOl5IGpHYb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4828	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3092	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	364	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3356	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	204	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3720	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3360	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	440	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	440	schtasks.exe	79

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2424-132-0x0000000000610000-0x000000000088E000-memory.dmp	dcrat
behavioral2/files/0x000300000001e9dc-185.dat	dcrat
behavioral2/files/0x000300000001e9dc-184.dat	dcrat
behavioral2/memory/1324-186-0x0000000000C20000-0x0000000000E9E000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
1324	spoolsv.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	23d4d6a09b99d94373c3e4c49020febf.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\AppLocker\RCXE351.tmp	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Windows\SysWOW64\AppLocker\RCXE49A.tmp	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Windows\SysWOW64\AppLocker\Registry.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File created	C:\Windows\SysWOW64\AppLocker\Registry.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File created	C:\Windows\SysWOW64\AppLocker\ee2ad38f3d4382	23d4d6a09b99d94373c3e4c49020febf.exe

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\RCX9582.tmp	23d4d6a09b99d94373c3e4c49020febf.exe
File created	C:\Program Files\Internet Explorer\it-IT\spoolsv.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\RCXE894.tmp	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Program Files\Internet Explorer\RCXF358.tmp	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Program Files\Internet Explorer\csrss.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\RCXB09.tmp	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\dllhost.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Program Files\Internet Explorer\it-IT\spoolsv.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\f3b6ecef712a24	23d4d6a09b99d94373c3e4c49020febf.exe
File created	C:\Program Files\Internet Explorer\csrss.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\5940a34987c991	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Program Files\Internet Explorer\RCXF2BB.tmp	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\RCXF618.tmp	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Program Files\Internet Explorer\it-IT\RCXFEC.tmp	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\sihost.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\spoolsv.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File created	C:\Program Files\Internet Explorer\886983d96e3d3e	23d4d6a09b99d94373c3e4c49020febf.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\dllhost.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File created	C:\Program Files\Internet Explorer\it-IT\f3b6ecef712a24	23d4d6a09b99d94373c3e4c49020febf.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\66fc9ff0ee96c2	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\RCXE75B.tmp	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\RCX94F4.tmp	23d4d6a09b99d94373c3e4c49020febf.exe
File created	C:\Program Files\ModifiableWindowsApps\RuntimeBroker.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\sihost.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\spoolsv.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Program Files\Internet Explorer\it-IT\RCX44F7.tmp	23d4d6a09b99d94373c3e4c49020febf.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\it-IT\SppExtComObj.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File created	C:\Windows\it-IT\e1ef82546f0b02	23d4d6a09b99d94373c3e4c49020febf.exe
File created	C:\Windows\Prefetch\SearchApp.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Windows\it-IT\RCXEFEB.tmp	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Windows\it-IT\SppExtComObj.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Windows\Prefetch\SearchApp.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File created	C:\Windows\WaaS\sihost.exe	23d4d6a09b99d94373c3e4c49020febf.exe
File created	C:\Windows\Prefetch\38384e6a620884	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Windows\it-IT\RCXEF5D.tmp	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Windows\Prefetch\RCX9823.tmp	23d4d6a09b99d94373c3e4c49020febf.exe
File opened for modification	C:\Windows\Prefetch\RCX98B1.tmp	23d4d6a09b99d94373c3e4c49020febf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4004	schtasks.exe
4984	schtasks.exe
364	schtasks.exe
4340	schtasks.exe
3092	schtasks.exe
1500	schtasks.exe
3720	schtasks.exe
3360	schtasks.exe
1432	schtasks.exe
2352	schtasks.exe
1776	schtasks.exe
3048	schtasks.exe
2992	schtasks.exe
1644	schtasks.exe
2948	schtasks.exe
384	schtasks.exe
4040	schtasks.exe
1400	schtasks.exe
2808	schtasks.exe
1472	schtasks.exe
5064	schtasks.exe
4412	schtasks.exe
2636	schtasks.exe
3472	schtasks.exe
3364	schtasks.exe
4952	schtasks.exe
4888	schtasks.exe
1976	schtasks.exe
5056	schtasks.exe
1752	schtasks.exe
1632	schtasks.exe
3704	schtasks.exe
3808	schtasks.exe
3620	schtasks.exe
1276	schtasks.exe
204	schtasks.exe
4828	schtasks.exe
3356	schtasks.exe
1512	schtasks.exe
3016	schtasks.exe
1904	schtasks.exe
3532	schtasks.exe
3260	schtasks.exe
2216	schtasks.exe
1648	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	23d4d6a09b99d94373c3e4c49020febf.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2424	23d4d6a09b99d94373c3e4c49020febf.exe
2496	powershell.exe
2496	powershell.exe
3280	powershell.exe
3280	powershell.exe
2448	powershell.exe
2448	powershell.exe
4752	powershell.exe
4752	powershell.exe
2384	powershell.exe
2384	powershell.exe
544	powershell.exe
544	powershell.exe
208	powershell.exe
208	powershell.exe
4676	powershell.exe
4676	powershell.exe
1196	powershell.exe
1196	powershell.exe
1820	powershell.exe
1820	powershell.exe
4368	powershell.exe
4368	powershell.exe
4348	powershell.exe
4348	powershell.exe
2496	powershell.exe
2496	powershell.exe
3280	powershell.exe
3280	powershell.exe
2448	powershell.exe
2448	powershell.exe
4752	powershell.exe
4752	powershell.exe
2384	powershell.exe
208	powershell.exe
1820	powershell.exe
544	powershell.exe
4368	powershell.exe
1196	powershell.exe
4348	powershell.exe
4676	powershell.exe
1324	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	23d4d6a09b99d94373c3e4c49020febf.exe
Token: SeDebugPrivilege	3280	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	208	powershell.exe
Token: SeDebugPrivilege	544	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	4368	powershell.exe
Token: SeDebugPrivilege	1324	spoolsv.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2448	2424	23d4d6a09b99d94373c3e4c49020febf.exe	129
PID 2424 wrote to memory of 2448	2424	23d4d6a09b99d94373c3e4c49020febf.exe	129
PID 2424 wrote to memory of 4752	2424	23d4d6a09b99d94373c3e4c49020febf.exe	131
PID 2424 wrote to memory of 4752	2424	23d4d6a09b99d94373c3e4c49020febf.exe	131
PID 2424 wrote to memory of 2496	2424	23d4d6a09b99d94373c3e4c49020febf.exe	133
PID 2424 wrote to memory of 2496	2424	23d4d6a09b99d94373c3e4c49020febf.exe	133
PID 2424 wrote to memory of 2384	2424	23d4d6a09b99d94373c3e4c49020febf.exe	135
PID 2424 wrote to memory of 2384	2424	23d4d6a09b99d94373c3e4c49020febf.exe	135
PID 2424 wrote to memory of 3280	2424	23d4d6a09b99d94373c3e4c49020febf.exe	136
PID 2424 wrote to memory of 3280	2424	23d4d6a09b99d94373c3e4c49020febf.exe	136
PID 2424 wrote to memory of 4368	2424	23d4d6a09b99d94373c3e4c49020febf.exe	138
PID 2424 wrote to memory of 4368	2424	23d4d6a09b99d94373c3e4c49020febf.exe	138
PID 2424 wrote to memory of 544	2424	23d4d6a09b99d94373c3e4c49020febf.exe	139
PID 2424 wrote to memory of 544	2424	23d4d6a09b99d94373c3e4c49020febf.exe	139
PID 2424 wrote to memory of 1820	2424	23d4d6a09b99d94373c3e4c49020febf.exe	141
PID 2424 wrote to memory of 1820	2424	23d4d6a09b99d94373c3e4c49020febf.exe	141
PID 2424 wrote to memory of 4676	2424	23d4d6a09b99d94373c3e4c49020febf.exe	143
PID 2424 wrote to memory of 4676	2424	23d4d6a09b99d94373c3e4c49020febf.exe	143
PID 2424 wrote to memory of 1196	2424	23d4d6a09b99d94373c3e4c49020febf.exe	144
PID 2424 wrote to memory of 1196	2424	23d4d6a09b99d94373c3e4c49020febf.exe	144
PID 2424 wrote to memory of 208	2424	23d4d6a09b99d94373c3e4c49020febf.exe	152
PID 2424 wrote to memory of 208	2424	23d4d6a09b99d94373c3e4c49020febf.exe	152
PID 2424 wrote to memory of 4348	2424	23d4d6a09b99d94373c3e4c49020febf.exe	150
PID 2424 wrote to memory of 4348	2424	23d4d6a09b99d94373c3e4c49020febf.exe	150
PID 2424 wrote to memory of 240	2424	23d4d6a09b99d94373c3e4c49020febf.exe	154
PID 2424 wrote to memory of 240	2424	23d4d6a09b99d94373c3e4c49020febf.exe	154
PID 240 wrote to memory of 1548	240	cmd.exe	156
PID 240 wrote to memory of 1548	240	cmd.exe	156
PID 240 wrote to memory of 1324	240	cmd.exe	159
PID 240 wrote to memory of 1324	240	cmd.exe	159

C:\Users\Admin\AppData\Local\Temp\23d4d6a09b99d94373c3e4c49020febf.exe
"C:\Users\Admin\AppData\Local\Temp\23d4d6a09b99d94373c3e4c49020febf.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DBHTzbCDmW.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1548
- - C:\Program Files\Internet Explorer\it-IT\spoolsv.exe
    "C:\Program Files\Internet Explorer\it-IT\spoolsv.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Windows\SysWOW64\AppLocker\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\SysWOW64\AppLocker\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Windows\SysWOW64\AppLocker\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\.oracle_jre_usage\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\.oracle_jre_usage\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\.oracle_jre_usage\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Windows\it-IT\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\it-IT\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Windows\it-IT\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\it-IT\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\odt\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Downloads\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Downloads\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Downloads\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\Prefetch\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Windows\Prefetch\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Windows\Prefetch\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spoolsv.exe

Path C:\Program Files\Internet Explorer\it-IT\spoolsv.exe
Size 2.5MB
SHA256 0e29d185c5bf0df018916d74f6509a1c5f1bc5895f35e96622a60fa7b1ee56e3
MD5 9a3317275b9381127460cf0feaba84a4
SHA1 7c07be6a0afbc6c32962d2f3d911169fbe8374a3
SHA512 7658a591a8a515bb90888cefbe7be7f6dc73ed8f4b9f0a4edea0e39fd65e0021f2c9faa496a0136c627555c14f8179c1df04644c9f23a4ecb138e14cfbbc1609
SSDEEP 49152:cno4gjXMihQWbtlaXD72pi8F+J9HlAffWl5IXdWsop9CYYjp+8X:KCMiu5X2pi8F+JxOfOl5IGpHYb
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Program Files\Internet Explorer\it-IT\spoolsv.exe
Size 2.5MB
SHA256 0e29d185c5bf0df018916d74f6509a1c5f1bc5895f35e96622a60fa7b1ee56e3
MD5 9a3317275b9381127460cf0feaba84a4
SHA1 7c07be6a0afbc6c32962d2f3d911169fbe8374a3
SHA512 7658a591a8a515bb90888cefbe7be7f6dc73ed8f4b9f0a4edea0e39fd65e0021f2c9faa496a0136c627555c14f8179c1df04644c9f23a4ecb138e14cfbbc1609
SSDEEP 49152:cno4gjXMihQWbtlaXD72pi8F+J9HlAffWl5IXdWsop9CYYjp+8X:KCMiu5X2pi8F+JxOfOl5IGpHYb
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download