dcrat | 102db1a9cbfbc1ed833e64d911d48c596627614b8da4d7447549efcbfb7ebfcd

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c0c8c3302334dcac8a43fba9a7fc906.exe
Size 2.5MB
Sample221014-pff3caddf3
SHA256 102db1a9cbfbc1ed833e64d911d48c596627614b8da4d7447549efcbfb7ebfcd
MD5 2c0c8c3302334dcac8a43fba9a7fc906
SHA1 6416f06ffe09b22370844216874b5f4d03d51518
SHA512 8d5830d7b682ff2e7b81b8dcd7232c8dd1684dc47be61762f005055f1d4c4fa89b3ed01889d595a5c5ffa5d8c8fa1a62af29c04d648c86213445172355430916
SSDEEP 49152:sno4gjXMihQWbtlaXD72pi8F+J9HlAffWl5IXdWsop9CYYjp+8X:6CMiu5X2pi8F+JxOfOl5IGpHYb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	712	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4792	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1280	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3424	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	808	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	2332	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2332	schtasks.exe	28

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/720-132-0x0000000000210000-0x000000000048E000-memory.dmp	dcrat
behavioral2/files/0x000500000001629c-156.dat	dcrat
behavioral2/files/0x000500000001629c-157.dat	dcrat
behavioral2/memory/4840-158-0x0000000000560000-0x00000000007DE000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
4840	StartMenuExperienceHost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	2c0c8c3302334dcac8a43fba9a7fc906.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows NT\Accessories\en-US\sppsvc.exe	2c0c8c3302334dcac8a43fba9a7fc906.exe
File created	C:\Program Files (x86)\Microsoft\fontdrvhost.exe	2c0c8c3302334dcac8a43fba9a7fc906.exe
File created	C:\Program Files (x86)\Microsoft\5b884080fd4f94	2c0c8c3302334dcac8a43fba9a7fc906.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\System.exe	2c0c8c3302334dcac8a43fba9a7fc906.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\27d1bcfc3c54e0	2c0c8c3302334dcac8a43fba9a7fc906.exe
File created	C:\Program Files\Windows Defender\fr-FR\9e8d7a4ca61bd9	2c0c8c3302334dcac8a43fba9a7fc906.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\RuntimeBroker.exe	2c0c8c3302334dcac8a43fba9a7fc906.exe
File created	C:\Program Files\Windows NT\Accessories\en-US\sppsvc.exe	2c0c8c3302334dcac8a43fba9a7fc906.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\55b276f4edf653	2c0c8c3302334dcac8a43fba9a7fc906.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\en-US\RCXD6EE.tmp	2c0c8c3302334dcac8a43fba9a7fc906.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCXDD3C.tmp	2c0c8c3302334dcac8a43fba9a7fc906.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RCXEA35.tmp	2c0c8c3302334dcac8a43fba9a7fc906.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\RCXF054.tmp	2c0c8c3302334dcac8a43fba9a7fc906.exe
File created	C:\Program Files\Windows NT\Accessories\en-US\0a1fd5f707cd16	2c0c8c3302334dcac8a43fba9a7fc906.exe
File opened for modification	C:\Program Files (x86)\Microsoft\RCXDAAA.tmp	2c0c8c3302334dcac8a43fba9a7fc906.exe
File opened for modification	C:\Program Files (x86)\Microsoft\fontdrvhost.exe	2c0c8c3302334dcac8a43fba9a7fc906.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe	2c0c8c3302334dcac8a43fba9a7fc906.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\System.exe	2c0c8c3302334dcac8a43fba9a7fc906.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe	2c0c8c3302334dcac8a43fba9a7fc906.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\en-US\RCXD76C.tmp	2c0c8c3302334dcac8a43fba9a7fc906.exe
File opened for modification	C:\Program Files (x86)\Microsoft\RCXDA1D.tmp	2c0c8c3302334dcac8a43fba9a7fc906.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCXDDBA.tmp	2c0c8c3302334dcac8a43fba9a7fc906.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RCXE998.tmp	2c0c8c3302334dcac8a43fba9a7fc906.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\RCXEFC6.tmp	2c0c8c3302334dcac8a43fba9a7fc906.exe
File created	C:\Program Files\Windows Defender\fr-FR\RuntimeBroker.exe	2c0c8c3302334dcac8a43fba9a7fc906.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\tracing\dllhost.exe	2c0c8c3302334dcac8a43fba9a7fc906.exe
File created	C:\Windows\tracing\5940a34987c991	2c0c8c3302334dcac8a43fba9a7fc906.exe
File opened for modification	C:\Windows\tracing\RCXE03B.tmp	2c0c8c3302334dcac8a43fba9a7fc906.exe
File opened for modification	C:\Windows\tracing\RCXE0B9.tmp	2c0c8c3302334dcac8a43fba9a7fc906.exe
File opened for modification	C:\Windows\tracing\dllhost.exe	2c0c8c3302334dcac8a43fba9a7fc906.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4760	schtasks.exe
4704	schtasks.exe
4304	schtasks.exe
4648	schtasks.exe
4796	schtasks.exe
1280	schtasks.exe
4236	schtasks.exe
4412	schtasks.exe
3424	schtasks.exe
4308	schtasks.exe
4464	schtasks.exe
2068	schtasks.exe
1252	schtasks.exe
2616	schtasks.exe
4780	schtasks.exe
4668	schtasks.exe
3460	schtasks.exe
4048	schtasks.exe
808	schtasks.exe
712	schtasks.exe
4636	schtasks.exe
1400	schtasks.exe
2792	schtasks.exe
3500	schtasks.exe
4792	schtasks.exe
784	schtasks.exe
2316	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2c0c8c3302334dcac8a43fba9a7fc906.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
720	2c0c8c3302334dcac8a43fba9a7fc906.exe
720	2c0c8c3302334dcac8a43fba9a7fc906.exe
720	2c0c8c3302334dcac8a43fba9a7fc906.exe
720	2c0c8c3302334dcac8a43fba9a7fc906.exe
720	2c0c8c3302334dcac8a43fba9a7fc906.exe
4460	powershell.exe
4460	powershell.exe
1084	powershell.exe
1084	powershell.exe
1496	powershell.exe
1496	powershell.exe
956	powershell.exe
4572	powershell.exe
956	powershell.exe
4572	powershell.exe
2152	powershell.exe
2152	powershell.exe
3464	powershell.exe
3464	powershell.exe
2460	powershell.exe
2460	powershell.exe
3792	powershell.exe
3792	powershell.exe
3280	powershell.exe
3280	powershell.exe
2320	powershell.exe
2320	powershell.exe
4160	powershell.exe
4160	powershell.exe
956	powershell.exe
4460	powershell.exe
1084	powershell.exe
1496	powershell.exe
4572	powershell.exe
3464	powershell.exe
2152	powershell.exe
2460	powershell.exe
3280	powershell.exe
2320	powershell.exe
3792	powershell.exe
4160	powershell.exe
4840	StartMenuExperienceHost.exe
4840	StartMenuExperienceHost.exe
4840	StartMenuExperienceHost.exe
4840	StartMenuExperienceHost.exe
4840	StartMenuExperienceHost.exe
4840	StartMenuExperienceHost.exe
4840	StartMenuExperienceHost.exe
4840	StartMenuExperienceHost.exe
4840	StartMenuExperienceHost.exe
4840	StartMenuExperienceHost.exe
4840	StartMenuExperienceHost.exe
4840	StartMenuExperienceHost.exe
4840	StartMenuExperienceHost.exe
4840	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	720	2c0c8c3302334dcac8a43fba9a7fc906.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	3280	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	4160	powershell.exe
Token: SeDebugPrivilege	4840	StartMenuExperienceHost.exe
Token: SeBackupPrivilege	2208	vssvc.exe
Token: SeRestorePrivilege	2208	vssvc.exe
Token: SeAuditPrivilege	2208	vssvc.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 4572	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	110
PID 720 wrote to memory of 4572	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	110
PID 720 wrote to memory of 4460	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	112
PID 720 wrote to memory of 4460	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	112
PID 720 wrote to memory of 956	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	118
PID 720 wrote to memory of 956	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	118
PID 720 wrote to memory of 3464	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	113
PID 720 wrote to memory of 3464	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	113
PID 720 wrote to memory of 2152	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	115
PID 720 wrote to memory of 2152	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	115
PID 720 wrote to memory of 1084	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	119
PID 720 wrote to memory of 1084	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	119
PID 720 wrote to memory of 1496	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	120
PID 720 wrote to memory of 1496	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	120
PID 720 wrote to memory of 3792	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	122
PID 720 wrote to memory of 3792	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	122
PID 720 wrote to memory of 2460	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	124
PID 720 wrote to memory of 2460	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	124
PID 720 wrote to memory of 3280	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	130
PID 720 wrote to memory of 3280	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	130
PID 720 wrote to memory of 4160	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	127
PID 720 wrote to memory of 4160	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	127
PID 720 wrote to memory of 2320	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	131
PID 720 wrote to memory of 2320	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	131
PID 720 wrote to memory of 4840	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	134
PID 720 wrote to memory of 4840	720	2c0c8c3302334dcac8a43fba9a7fc906.exe	134

C:\Users\Admin\AppData\Local\Temp\2c0c8c3302334dcac8a43fba9a7fc906.exe
"C:\Users\Admin\AppData\Local\Temp\2c0c8c3302334dcac8a43fba9a7fc906.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe
  "C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\Accessories\en-US\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\Accessories\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\tracing\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\tracing\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\tracing\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Templates\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default\Templates\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Templates\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Downloads\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Downloads\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Downloads\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\odt\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\fr-FR\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\fr-FR\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\fr-FR\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2616

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartMenuExperienceHost.exe

Path C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe
Size 2.5MB
SHA256 8850365ef3d29d42bbb68206a8dc1b4d403e7c3f6f8495b6d8f7c78fe33b5cae
MD5 783b3e216e98f3b469e887b0c80bf1fc
SHA1 476deef0467f44f49f3cc49cca9a62c9c298a1cf
SHA512 eecd5241a29b7e170bc2cb1ac60044566d6007298526e5143e1599181a4e13d569a5a3cb7ab461434d70bbcb4161e4e02d410854522c416c19a26b84dc3730d9
SSDEEP 49152:0no4gjXMihQWbtlaXD72pi8F+J9HlAffWl5IXdWsop9CYYjp+8X:iCMiu5X2pi8F+JxOfOl5IGpHYb
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartMenuExperienceHost.exe

Path C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe
Size 2.5MB
SHA256 8850365ef3d29d42bbb68206a8dc1b4d403e7c3f6f8495b6d8f7c78fe33b5cae
MD5 783b3e216e98f3b469e887b0c80bf1fc
SHA1 476deef0467f44f49f3cc49cca9a62c9c298a1cf
SHA512 eecd5241a29b7e170bc2cb1ac60044566d6007298526e5143e1599181a4e13d569a5a3cb7ab461434d70bbcb4161e4e02d410854522c416c19a26b84dc3730d9
SSDEEP 49152:0no4gjXMihQWbtlaXD72pi8F+J9HlAffWl5IXdWsop9CYYjp+8X:iCMiu5X2pi8F+JxOfOl5IGpHYb
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download