dcrat | 7e53cfc5aa663350d7e0aced0d7d46d358b81d0c7c0a7a09c7eeb422f3208a2c

Analysis

max time kernel
54s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16/10/2022, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06f5e7e201f516c298baa0a3f64cec71.exe
Size 1.4MB
Sample221016-bxdfwsgfc4
SHA256 7e53cfc5aa663350d7e0aced0d7d46d358b81d0c7c0a7a09c7eeb422f3208a2c
MD5 06f5e7e201f516c298baa0a3f64cec71
SHA1 260744dbda21a39d2b88be83ffaea64ab988b2a9
SHA512 e33473e1c2bb814db3357329bc0fac53ffc733b549c67f91a8f970ddd94329ba52f0c02bdf5b5182fd8eca143d96516e073d9e84cca8313d0270706d10854beb
SSDEEP 24576:n2G/nvxW3WpH8FURYbo7uyzjZiws8r2/Ypt01Sbpw7WEEq3EvjmzYd0n5:nbA3viYboSytY4VmdE7K5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 15 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Program Files\\Windows NT\\dwm.exe\", \"C:\\MsHyper\\smss.exe\", \"C:\\MsHyper\\spoolsv.exe\", \"C:\\MsHyper\\WMIADAP.exe\", \"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\lsass.exe\", \"C:\\Windows\\Offline Web Pages\\System.exe\", \"C:\\Users\\All Users\\Start Menu\\Idle.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Program Files\\Windows NT\\dwm.exe\", \"C:\\MsHyper\\smss.exe\", \"C:\\MsHyper\\spoolsv.exe\", \"C:\\MsHyper\\WMIADAP.exe\", \"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\lsass.exe\", \"C:\\Windows\\Offline Web Pages\\System.exe\", \"C:\\Users\\All Users\\Start Menu\\Idle.exe\", \"C:\\MsHyper\\WmiPrvSE.exe\", \"C:\\MsHyper\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows NT\\TableTextService\\it-IT\\spoolsv.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\wininit.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Program Files\\Windows NT\\dwm.exe\", \"C:\\MsHyper\\smss.exe\", \"C:\\MsHyper\\spoolsv.exe\", \"C:\\MsHyper\\WMIADAP.exe\", \"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\lsass.exe\", \"C:\\Windows\\Offline Web Pages\\System.exe\", \"C:\\Users\\All Users\\Start Menu\\Idle.exe\", \"C:\\MsHyper\\WmiPrvSE.exe\", \"C:\\MsHyper\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows NT\\TableTextService\\it-IT\\spoolsv.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\wininit.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\dwm.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Program Files\\Windows NT\\dwm.exe\", \"C:\\MsHyper\\smss.exe\", \"C:\\MsHyper\\spoolsv.exe\", \"C:\\MsHyper\\WMIADAP.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Program Files\\Windows NT\\dwm.exe\", \"C:\\MsHyper\\smss.exe\", \"C:\\MsHyper\\spoolsv.exe\", \"C:\\MsHyper\\WMIADAP.exe\", \"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\lsass.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Program Files\\Windows NT\\dwm.exe\", \"C:\\MsHyper\\smss.exe\", \"C:\\MsHyper\\spoolsv.exe\", \"C:\\MsHyper\\WMIADAP.exe\", \"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\lsass.exe\", \"C:\\Windows\\Offline Web Pages\\System.exe\", \"C:\\Users\\All Users\\Start Menu\\Idle.exe\", \"C:\\MsHyper\\WmiPrvSE.exe\", \"C:\\MsHyper\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows NT\\TableTextService\\it-IT\\spoolsv.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Program Files\\Windows NT\\dwm.exe\", \"C:\\MsHyper\\smss.exe\", \"C:\\MsHyper\\spoolsv.exe\", \"C:\\MsHyper\\WMIADAP.exe\", \"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\lsass.exe\", \"C:\\Windows\\Offline Web Pages\\System.exe\", \"C:\\Users\\All Users\\Start Menu\\Idle.exe\", \"C:\\MsHyper\\WmiPrvSE.exe\", \"C:\\MsHyper\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows NT\\TableTextService\\it-IT\\spoolsv.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\wininit.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\spoolsv.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Program Files\\Windows NT\\dwm.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Program Files\\Windows NT\\dwm.exe\", \"C:\\MsHyper\\smss.exe\", \"C:\\MsHyper\\spoolsv.exe\", \"C:\\MsHyper\\WMIADAP.exe\", \"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\lsass.exe\", \"C:\\Windows\\Offline Web Pages\\System.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Program Files\\Windows NT\\dwm.exe\", \"C:\\MsHyper\\smss.exe\", \"C:\\MsHyper\\spoolsv.exe\", \"C:\\MsHyper\\WMIADAP.exe\", \"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\lsass.exe\", \"C:\\Windows\\Offline Web Pages\\System.exe\", \"C:\\Users\\All Users\\Start Menu\\Idle.exe\", \"C:\\MsHyper\\WmiPrvSE.exe\", \"C:\\MsHyper\\WmiPrvSE.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\spoolsv.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Program Files\\Windows NT\\dwm.exe\", \"C:\\MsHyper\\smss.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Program Files\\Windows NT\\dwm.exe\", \"C:\\MsHyper\\smss.exe\", \"C:\\MsHyper\\spoolsv.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Program Files\\Windows NT\\dwm.exe\", \"C:\\MsHyper\\smss.exe\", \"C:\\MsHyper\\spoolsv.exe\", \"C:\\MsHyper\\WMIADAP.exe\", \"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\lsass.exe\", \"C:\\Windows\\Offline Web Pages\\System.exe\", \"C:\\Users\\All Users\\Start Menu\\Idle.exe\", \"C:\\MsHyper\\WmiPrvSE.exe\""	hypernet.exe

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	268	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	300	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	108	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	280	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	572	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	284	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	908	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	1668	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	1668	schtasks.exe	33

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00080000000122f1-63.dat	dcrat
behavioral1/files/0x00080000000122f1-65.dat	dcrat
behavioral1/files/0x00080000000122f1-67.dat	dcrat
behavioral1/files/0x00080000000122f1-64.dat	dcrat
behavioral1/memory/1264-68-0x0000000000C40000-0x0000000000D6A000-memory.dmp	dcrat
behavioral1/files/0x00070000000126f1-77.dat	dcrat
behavioral1/files/0x00070000000126f1-79.dat	dcrat
behavioral1/memory/2352-80-0x0000000001190000-0x00000000012BA000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
1264	hypernet.exe
2352	WmiPrvSE.exe

Loads dropped DLL 2 IoCs

pid	Process
1468	cmd.exe
1468	cmd.exe

Adds Run key to start application 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\MsHyper\\smss.exe\""	hypernet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\dwm.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Windows NT\\dwm.exe\""	hypernet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\lsass.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\dwm.exe\""	hypernet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\MsHyper\\WMIADAP.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\MsHyper\\WMIADAP.exe\""	hypernet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\All Users\\Start Menu\\Idle.exe\""	hypernet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Windows NT\\TableTextService\\it-IT\\spoolsv.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\MsHyper\\spoolsv.exe\""	hypernet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\WmiPrvSE.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\spoolsv.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\Offline Web Pages\\System.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\MsHyper\\WmiPrvSE.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Windows NT\\TableTextService\\it-IT\\spoolsv.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\DigitalLocker\\en-US\\wininit.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Windows Sidebar\\spoolsv.exe\""	hypernet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\spoolsv.exe\""	hypernet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Windows NT\\dwm.exe\""	hypernet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\DigitalLocker\\en-US\\wininit.exe\""	hypernet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Windows Sidebar\\spoolsv.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\lsass.exe\""	hypernet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\Offline Web Pages\\System.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\All Users\\Start Menu\\Idle.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\MsHyper\\smss.exe\""	hypernet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\MsHyper\\spoolsv.exe\""	hypernet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\MsHyper\\WmiPrvSE.exe\""	hypernet.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Windows NT\dwm.exe	hypernet.exe
File created	C:\Program Files\Windows NT\TableTextService\it-IT\spoolsv.exe	hypernet.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\WmiPrvSE.exe	hypernet.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\24dbde2999530e	hypernet.exe
File created	C:\Program Files (x86)\Windows Sidebar\spoolsv.exe	hypernet.exe
File created	C:\Program Files (x86)\Windows Sidebar\f3b6ecef712a24	hypernet.exe
File created	C:\Program Files\Windows NT\6cb0b6c459d5d3	hypernet.exe
File created	C:\Program Files\Windows NT\TableTextService\it-IT\f3b6ecef712a24	hypernet.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\explorer.exe	hypernet.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\spoolsv.exe	hypernet.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Boot\PCAT\services.exe	hypernet.exe
File created	C:\Windows\servicing\en-US\cmd.exe	hypernet.exe
File created	C:\Windows\Offline Web Pages\System.exe	hypernet.exe
File created	C:\Windows\Offline Web Pages\27d1bcfc3c54e0	hypernet.exe
File created	C:\Windows\DigitalLocker\en-US\wininit.exe	hypernet.exe
File created	C:\Windows\DigitalLocker\en-US\56085415360792	hypernet.exe
File created	C:\Windows\security\ApplicationId\PolicyManagement\dwm.exe	hypernet.exe
File created	C:\Windows\security\ApplicationId\PolicyManagement\6cb0b6c459d5d3	hypernet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1688	schtasks.exe
1568	schtasks.exe
2024	schtasks.exe
1948	schtasks.exe
2000	schtasks.exe
1408	schtasks.exe
572	schtasks.exe
996	schtasks.exe
2236	schtasks.exe
1720	schtasks.exe
2260	schtasks.exe
1824	schtasks.exe
300	schtasks.exe
1680	schtasks.exe
1724	schtasks.exe
908	schtasks.exe
1700	schtasks.exe
1776	schtasks.exe
984	schtasks.exe
1516	schtasks.exe
2072	schtasks.exe
2188	schtasks.exe
1608	schtasks.exe
1812	schtasks.exe
1872	schtasks.exe
284	schtasks.exe
964	schtasks.exe
1616	schtasks.exe
2208	schtasks.exe
892	schtasks.exe
280	schtasks.exe
688	schtasks.exe
784	schtasks.exe
2116	schtasks.exe
2140	schtasks.exe
1800	schtasks.exe
1048	schtasks.exe
1068	schtasks.exe
268	schtasks.exe
1944	schtasks.exe
1472	schtasks.exe
976	schtasks.exe
108	schtasks.exe
2096	schtasks.exe
2160	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2332	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1264	hypernet.exe
2352	WmiPrvSE.exe
2352	WmiPrvSE.exe
2352	WmiPrvSE.exe
2352	WmiPrvSE.exe
2352	WmiPrvSE.exe
2352	WmiPrvSE.exe
2352	WmiPrvSE.exe
2352	WmiPrvSE.exe
2352	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1264	hypernet.exe
Token: SeDebugPrivilege	2352	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1724	1960	06f5e7e201f516c298baa0a3f64cec71.exe	28
PID 1960 wrote to memory of 1724	1960	06f5e7e201f516c298baa0a3f64cec71.exe	28
PID 1960 wrote to memory of 1724	1960	06f5e7e201f516c298baa0a3f64cec71.exe	28
PID 1960 wrote to memory of 1724	1960	06f5e7e201f516c298baa0a3f64cec71.exe	28
PID 1960 wrote to memory of 956	1960	06f5e7e201f516c298baa0a3f64cec71.exe	29
PID 1960 wrote to memory of 956	1960	06f5e7e201f516c298baa0a3f64cec71.exe	29
PID 1960 wrote to memory of 956	1960	06f5e7e201f516c298baa0a3f64cec71.exe	29
PID 1960 wrote to memory of 956	1960	06f5e7e201f516c298baa0a3f64cec71.exe	29
PID 1724 wrote to memory of 1468	1724	WScript.exe	30
PID 1724 wrote to memory of 1468	1724	WScript.exe	30
PID 1724 wrote to memory of 1468	1724	WScript.exe	30
PID 1724 wrote to memory of 1468	1724	WScript.exe	30
PID 1468 wrote to memory of 1264	1468	cmd.exe	32
PID 1468 wrote to memory of 1264	1468	cmd.exe	32
PID 1468 wrote to memory of 1264	1468	cmd.exe	32
PID 1468 wrote to memory of 1264	1468	cmd.exe	32
PID 1264 wrote to memory of 2284	1264	hypernet.exe	79
PID 1264 wrote to memory of 2284	1264	hypernet.exe	79
PID 1264 wrote to memory of 2284	1264	hypernet.exe	79
PID 2284 wrote to memory of 2320	2284	cmd.exe	81
PID 2284 wrote to memory of 2320	2284	cmd.exe	81
PID 2284 wrote to memory of 2320	2284	cmd.exe	81
PID 1468 wrote to memory of 2332	1468	cmd.exe	82
PID 1468 wrote to memory of 2332	1468	cmd.exe	82
PID 1468 wrote to memory of 2332	1468	cmd.exe	82
PID 1468 wrote to memory of 2332	1468	cmd.exe	82
PID 2284 wrote to memory of 2352	2284	cmd.exe	83
PID 2284 wrote to memory of 2352	2284	cmd.exe	83
PID 2284 wrote to memory of 2352	2284	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\06f5e7e201f516c298baa0a3f64cec71.exe
"C:\Users\Admin\AppData\Local\Temp\06f5e7e201f516c298baa0a3f64cec71.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\MsHyper\hymtX7zEN4U5nshgBbRY88oEFl63P.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\MsHyper\SKFOl8fXFh.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\MsHyper\hypernet.exe
      "C:\MsHyper\hypernet.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1264
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZUgF3RjQao.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2284
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2320
      - C:\MsHyper\WmiPrvSE.exe
        
        "C:\MsHyper\WmiPrvSE.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2332
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\MsHyper\file.vbs"
  2⤵
  PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows NT\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\MsHyper\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MsHyper\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\MsHyper\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\MsHyper\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MsHyper\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\MsHyper\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 12 /tr "'C:\MsHyper\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MsHyper\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\MsHyper\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\Offline Web Pages\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\Offline Web Pages\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Start Menu\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Start Menu\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\MsHyper\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MsHyper\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\MsHyper\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\MsHyper\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MsHyper\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\MsHyper\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\TableTextService\it-IT\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\TableTextService\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\DigitalLocker\en-US\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\DigitalLocker\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\security\ApplicationId\PolicyManagement\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\security\ApplicationId\PolicyManagement\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\security\ApplicationId\PolicyManagement\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SKFOl8fXFh.bat

Path C:\MsHyper\SKFOl8fXFh.bat
Size 137B
SHA256 38a693268e38a59827c69cc3f5b3d44f8107d348e9c6c785f20d15350b85f62a
MD5 865871f22822269e24249c9c5a8a6908
SHA1 045fbdd7704d001fc44e24bd75fd296d8c953372
SHA512 04d49a92439d2c1eb50a5359b240f141aade1e836a42617bb9f038ac15062f1ee0788328655051aaa3a3ff5724c5f1cb44ada76b09c1c75460baf2f3bfc9066a
MD5 SHA1 SHA512

Submit Download

WmiPrvSE.exe

Path C:\MsHyper\WmiPrvSE.exe
Size 1.1MB
SHA256 ae1b099ce5538752b28e4ff9f982fd6580d0af74e8979c6832516f0a9792bda9
MD5 b3051c4d8552873dc3f09220b5698c1b
SHA1 1801edef53727d4cdb55d5c139b47a55f45f33e7
SHA512 d463364a87b03996468695b991365cac3007da97b9c0b082583e4684b061139d1a897e37de7585cc38ab5440d8b5fe2281a64bed92714a4af5d5adef2490093d
SSDEEP 24576:vURYbo7uyzjZiws8r2/Ypt01Sbpw7WEEq3EvjmzYd0n:UYboSytY4VmdE7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiPrvSE.exe

Path C:\MsHyper\WmiPrvSE.exe
Size 1.1MB
SHA256 ae1b099ce5538752b28e4ff9f982fd6580d0af74e8979c6832516f0a9792bda9
MD5 b3051c4d8552873dc3f09220b5698c1b
SHA1 1801edef53727d4cdb55d5c139b47a55f45f33e7
SHA512 d463364a87b03996468695b991365cac3007da97b9c0b082583e4684b061139d1a897e37de7585cc38ab5440d8b5fe2281a64bed92714a4af5d5adef2490093d
SSDEEP 24576:vURYbo7uyzjZiws8r2/Ypt01Sbpw7WEEq3EvjmzYd0n:UYboSytY4VmdE7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

file.vbs

Path C:\MsHyper\file.vbs
Size 34B
SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
MD5 677cc4360477c72cb0ce00406a949c61
SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
MD5 SHA1 SHA512

Submit Download

hymtX7zEN4U5nshgBbRY88oEFl63P.vbe

Path C:\MsHyper\hymtX7zEN4U5nshgBbRY88oEFl63P.vbe
Size 194B
SHA256 1a09a2899b741156424bea0997767d972e12c24d19fe23b44a97d43f1596b78f
MD5 e9b12e498cef9cc3900867991adb10d9
SHA1 0e99385c38aa2cc0f8314d8d28f051183687f17a
SHA512 f80980b6307a10a1882d50e1d0b088f9fcc7da8fd85e2ec199d35add9c5bf4ecd35b5f705eda05c6cb2b37ff3593fbc70dcd3548fd2ddd541c9bbe1c1abcafbd
MD5 SHA1 SHA512

Submit Download

hypernet.exe

Path C:\MsHyper\hypernet.exe
Size 1.1MB
SHA256 ae1b099ce5538752b28e4ff9f982fd6580d0af74e8979c6832516f0a9792bda9
MD5 b3051c4d8552873dc3f09220b5698c1b
SHA1 1801edef53727d4cdb55d5c139b47a55f45f33e7
SHA512 d463364a87b03996468695b991365cac3007da97b9c0b082583e4684b061139d1a897e37de7585cc38ab5440d8b5fe2281a64bed92714a4af5d5adef2490093d
SSDEEP 24576:vURYbo7uyzjZiws8r2/Ypt01Sbpw7WEEq3EvjmzYd0n:UYboSytY4VmdE7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

hypernet.exe

Path C:\MsHyper\hypernet.exe
Size 1.1MB
SHA256 ae1b099ce5538752b28e4ff9f982fd6580d0af74e8979c6832516f0a9792bda9
MD5 b3051c4d8552873dc3f09220b5698c1b
SHA1 1801edef53727d4cdb55d5c139b47a55f45f33e7
SHA512 d463364a87b03996468695b991365cac3007da97b9c0b082583e4684b061139d1a897e37de7585cc38ab5440d8b5fe2281a64bed92714a4af5d5adef2490093d
SSDEEP 24576:vURYbo7uyzjZiws8r2/Ypt01Sbpw7WEEq3EvjmzYd0n:UYboSytY4VmdE7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZUgF3RjQao.bat

Path C:\Users\Admin\AppData\Local\Temp\ZUgF3RjQao.bat
Size 188B
SHA256 4ae31f15848abbdd756abee9e38ba7780987bbf07e9d4cdf7bdfd8a5394af702
MD5 005d69733687234790158bdb3bb3a800
SHA1 784f34408a304794fa5596d648a68bd6c5192d82
SHA512 1e60dfe5bf889bc23a42b2737b79dea7e98a959039d14f5bf086ee3d1ea9bf5aa7c038f16f2480605a90de8b2a8581b616e98568bbf95383503c98a028852275
MD5 SHA1 SHA512

Submit Download

hypernet.exe

Path \MsHyper\hypernet.exe
Size 1.1MB
SHA256 ae1b099ce5538752b28e4ff9f982fd6580d0af74e8979c6832516f0a9792bda9
MD5 b3051c4d8552873dc3f09220b5698c1b
SHA1 1801edef53727d4cdb55d5c139b47a55f45f33e7
SHA512 d463364a87b03996468695b991365cac3007da97b9c0b082583e4684b061139d1a897e37de7585cc38ab5440d8b5fe2281a64bed92714a4af5d5adef2490093d
SSDEEP 24576:vURYbo7uyzjZiws8r2/Ypt01Sbpw7WEEq3EvjmzYd0n:UYboSytY4VmdE7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

hypernet.exe

Path \MsHyper\hypernet.exe
Size 1.1MB
SHA256 ae1b099ce5538752b28e4ff9f982fd6580d0af74e8979c6832516f0a9792bda9
MD5 b3051c4d8552873dc3f09220b5698c1b
SHA1 1801edef53727d4cdb55d5c139b47a55f45f33e7
SHA512 d463364a87b03996468695b991365cac3007da97b9c0b082583e4684b061139d1a897e37de7585cc38ab5440d8b5fe2281a64bed92714a4af5d5adef2490093d
SSDEEP 24576:vURYbo7uyzjZiws8r2/Ypt01Sbpw7WEEq3EvjmzYd0n:UYboSytY4VmdE7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1264-68-0x0000000000C40000-0x0000000000D6A000-memory.dmp

Download

memory/1264-69-0x00000000005C0000-0x00000000005C8000-memory.dmp

Download

memory/1264-70-0x0000000000900000-0x000000000091C000-memory.dmp

Download

memory/1264-71-0x0000000000920000-0x0000000000936000-memory.dmp

Download

memory/1264-72-0x0000000000C30000-0x0000000000C38000-memory.dmp

Download

memory/1960-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

Download

memory/2352-80-0x0000000001190000-0x00000000012BA000-memory.dmp

Download