dcrat | b52835c7a3e8e3d71540d7f1bbf3387958ca343752ead1f8d09cd040cfeeb74e

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/10/2022, 01:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
B52835C7A3E8E3D71540D7F1BBF3387958CA343752EAD.exe
Size 2.6MB
Sample221025-bxy3labcam
SHA256 b52835c7a3e8e3d71540d7f1bbf3387958ca343752ead1f8d09cd040cfeeb74e
MD5 961884c72f561b66e4ff04e7c330466c
SHA1 bf16ed181dc0b713670dcffbe4bb60d5cd092222
SHA512 afa3b54f8e431b7812e40f543dd2035792060339cabc018ee295aab934636e13350a350ba009c0298ae8c0dccc8cf0105cde24038b664671fb8c0270363d5999
SSDEEP 49152:UbA30rkIOEDTD5PrzrO1FzQBt14rs/IiijcRLsc/sDBDf463fFO:UbHlTlQrViijc9/sVDf463NO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3788	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3864	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	360	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3564	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3236	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	488	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	704	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3196	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	1500	schtasks.exe	44
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	1500	schtasks.exe	44

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0006000000022e48-139.dat	dcrat
behavioral2/files/0x0006000000022e48-140.dat	dcrat
behavioral2/memory/3828-141-0x0000000000BB0000-0x0000000000E02000-memory.dmp	dcrat
behavioral2/files/0x0006000000022e56-146.dat	dcrat
behavioral2/files/0x0006000000022e56-147.dat	dcrat

Executes dropped EXE 2 IoCs

pid	Process
3828	containercrt.exe
4696	OfficeClickToRun.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	B52835C7A3E8E3D71540D7F1BBF3387958CA343752EAD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	containercrt.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\TrustedInstaller.exe	containercrt.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\04c1e7795967e4	containercrt.exe
File created	C:\Program Files (x86)\Internet Explorer\cmd.exe	containercrt.exe
File created	C:\Program Files (x86)\Windows Mail\dwm.exe	containercrt.exe
File created	C:\Program Files (x86)\Windows Portable Devices\38384e6a620884	containercrt.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\containercrt.exe	containercrt.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\8b976d1ab7ecd6	containercrt.exe
File created	C:\Program Files (x86)\Internet Explorer\ebf1f9fa8afd6d	containercrt.exe
File created	C:\Program Files (x86)\Windows Mail\6cb0b6c459d5d3	containercrt.exe
File created	C:\Program Files (x86)\Google\CrashReports\WaaSMedicAgent.exe	containercrt.exe
File created	C:\Program Files (x86)\Google\CrashReports\c82b8037eab33d	containercrt.exe
File created	C:\Program Files (x86)\Windows Portable Devices\SearchApp.exe	containercrt.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\schemas\smss.exe	containercrt.exe
File created	C:\Windows\schemas\69ddcba757bf72	containercrt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1492	schtasks.exe
3268	schtasks.exe
3788	schtasks.exe
360	schtasks.exe
3428	schtasks.exe
3236	schtasks.exe
1824	schtasks.exe
4492	schtasks.exe
824	schtasks.exe
4056	schtasks.exe
1716	schtasks.exe
1320	schtasks.exe
4556	schtasks.exe
4880	schtasks.exe
2888	schtasks.exe
1868	schtasks.exe
1360	schtasks.exe
4348	schtasks.exe
1196	schtasks.exe
3692	schtasks.exe
2544	schtasks.exe
2648	schtasks.exe
4572	schtasks.exe
3564	schtasks.exe
2252	schtasks.exe
2244	schtasks.exe
1960	schtasks.exe
4852	schtasks.exe
2576	schtasks.exe
4656	schtasks.exe
3232	schtasks.exe
4392	schtasks.exe
3948	schtasks.exe
1060	schtasks.exe
2716	schtasks.exe
704	schtasks.exe
3196	schtasks.exe
4264	schtasks.exe
2688	schtasks.exe
1104	schtasks.exe
4632	schtasks.exe
4764	schtasks.exe
1756	schtasks.exe
488	schtasks.exe
3992	schtasks.exe
2548	schtasks.exe
3864	schtasks.exe
4120	schtasks.exe
4404	schtasks.exe
752	schtasks.exe
5080	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	B52835C7A3E8E3D71540D7F1BBF3387958CA343752EAD.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3828	containercrt.exe
3828	containercrt.exe
3828	containercrt.exe
3828	containercrt.exe
3828	containercrt.exe
4696	OfficeClickToRun.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3828	containercrt.exe
Token: SeDebugPrivilege	4696	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 4328	696	B52835C7A3E8E3D71540D7F1BBF3387958CA343752EAD.exe	81
PID 696 wrote to memory of 4328	696	B52835C7A3E8E3D71540D7F1BBF3387958CA343752EAD.exe	81
PID 696 wrote to memory of 4328	696	B52835C7A3E8E3D71540D7F1BBF3387958CA343752EAD.exe	81
PID 696 wrote to memory of 4140	696	B52835C7A3E8E3D71540D7F1BBF3387958CA343752EAD.exe	82
PID 696 wrote to memory of 4140	696	B52835C7A3E8E3D71540D7F1BBF3387958CA343752EAD.exe	82
PID 696 wrote to memory of 4140	696	B52835C7A3E8E3D71540D7F1BBF3387958CA343752EAD.exe	82
PID 4328 wrote to memory of 2748	4328	WScript.exe	87
PID 4328 wrote to memory of 2748	4328	WScript.exe	87
PID 4328 wrote to memory of 2748	4328	WScript.exe	87
PID 2748 wrote to memory of 3828	2748	cmd.exe	89
PID 2748 wrote to memory of 3828	2748	cmd.exe	89
PID 3828 wrote to memory of 4696	3828	containercrt.exe	143
PID 3828 wrote to memory of 4696	3828	containercrt.exe	143

C:\Users\Admin\AppData\Local\Temp\B52835C7A3E8E3D71540D7F1BBF3387958CA343752EAD.exe
"C:\Users\Admin\AppData\Local\Temp\B52835C7A3E8E3D71540D7F1BBF3387958CA343752EAD.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\MsHypercomWindhcp\oJ94LpJg8Y.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\MsHypercomWindhcp\Z5iMmh7mZw12WDeKvMIc0Ixr8J.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\MsHypercomWindhcp\containercrt.exe
      "C:\MsHypercomWindhcp\containercrt.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3828
    - - C:\odt\OfficeClickToRun.exe
        
        "C:\odt\OfficeClickToRun.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4696
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\MsHypercomWindhcp\file.vbs"
  2⤵
  PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\odt\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Cookies\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\Cookies\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Cookies\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\odt\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\schemas\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\schemas\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Windows\schemas\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\odt\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 6 /tr "'C:\MsHypercomWindhcp\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\MsHypercomWindhcp\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 11 /tr "'C:\MsHypercomWindhcp\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\CrashReports\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\CrashReports\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "containercrtc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\containercrt.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "containercrt" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\containercrt.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "containercrtc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\containercrt.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Desktop\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Desktop\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Z5iMmh7mZw12WDeKvMIc0Ixr8J.bat

Path C:\MsHypercomWindhcp\Z5iMmh7mZw12WDeKvMIc0Ixr8J.bat
Size 39B
SHA256 3a66de163f54a8da8942ad6c80105e7c8fc5b74829586f26b195326579a067b7
MD5 9f85f83420d828792d7bf34ec5311fbc
SHA1 ed8515d10874bba1192bdcc2dff46f56889de178
SHA512 1939225ba904048c7212dfde80e6e1b52d7ce2859da8b5b0b35aa0f6e1005f4dc7ab99043aa279a1d2c066998b62c389d9a8ff3021be361042514a0efcd9ce19
MD5 SHA1 SHA512

Submit Download

containercrt.exe

Path C:\MsHypercomWindhcp\containercrt.exe
Size 2.3MB
SHA256 faa426705d165290c5748fbd2d6022a4e269d704fb6dbb24d0167aea0741c3b8
MD5 7a3673360005748ae7855199875ffd75
SHA1 48a43a28451d85a04b6337e49a7c2a5fa026664e
SHA512 ef9366353f40f17986890e476c0ed4696177c8f710399b1fb8776cf4e5ba97dead2907778812a0305bbbe8e57b235d5c8a16e20af1683f9f82c3fb43d7c6656f
SSDEEP 49152:XkIOEDTD5PrzrO1FzQBt14rs/IiijcRLsc/sDBDf463fF:XlTlQrViijc9/sVDf463N
MD5 SHA1 SHA512 SSDEEP

Submit Download

containercrt.exe

Path C:\MsHypercomWindhcp\containercrt.exe
Size 2.3MB
SHA256 faa426705d165290c5748fbd2d6022a4e269d704fb6dbb24d0167aea0741c3b8
MD5 7a3673360005748ae7855199875ffd75
SHA1 48a43a28451d85a04b6337e49a7c2a5fa026664e
SHA512 ef9366353f40f17986890e476c0ed4696177c8f710399b1fb8776cf4e5ba97dead2907778812a0305bbbe8e57b235d5c8a16e20af1683f9f82c3fb43d7c6656f
SSDEEP 49152:XkIOEDTD5PrzrO1FzQBt14rs/IiijcRLsc/sDBDf463fF:XlTlQrViijc9/sVDf463N
MD5 SHA1 SHA512 SSDEEP

Submit Download

file.vbs

Path C:\MsHypercomWindhcp\file.vbs
Size 34B
SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
MD5 677cc4360477c72cb0ce00406a949c61
SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
MD5 SHA1 SHA512

Submit Download

oJ94LpJg8Y.vbe

Path C:\MsHypercomWindhcp\oJ94LpJg8Y.vbe
Size 220B
SHA256 6b7e6898e04e5275ed40bc0ea7aba5bfef1af306f6a93e1d3ed4422a52bfc21c
MD5 1d7be8b6ccf0c64eb237c5254fe7adac
SHA1 e90007141f3ae921bee34f22ad49a5f3d28a6644
SHA512 076412cd3cba558fea044cfc4f5ffc15f0dd7611345f123087f4c819f9b6490b693490570f4101bfa14cabd87f5d2c0941b0e35172553796e598d3cb248417c7
MD5 SHA1 SHA512

Submit Download

OfficeClickToRun.exe

Path C:\odt\OfficeClickToRun.exe
Size 2.3MB
SHA256 faa426705d165290c5748fbd2d6022a4e269d704fb6dbb24d0167aea0741c3b8
MD5 7a3673360005748ae7855199875ffd75
SHA1 48a43a28451d85a04b6337e49a7c2a5fa026664e
SHA512 ef9366353f40f17986890e476c0ed4696177c8f710399b1fb8776cf4e5ba97dead2907778812a0305bbbe8e57b235d5c8a16e20af1683f9f82c3fb43d7c6656f
SSDEEP 49152:XkIOEDTD5PrzrO1FzQBt14rs/IiijcRLsc/sDBDf463fF:XlTlQrViijc9/sVDf463N
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeClickToRun.exe

Path C:\odt\OfficeClickToRun.exe
Size 2.3MB
SHA256 faa426705d165290c5748fbd2d6022a4e269d704fb6dbb24d0167aea0741c3b8
MD5 7a3673360005748ae7855199875ffd75
SHA1 48a43a28451d85a04b6337e49a7c2a5fa026664e
SHA512 ef9366353f40f17986890e476c0ed4696177c8f710399b1fb8776cf4e5ba97dead2907778812a0305bbbe8e57b235d5c8a16e20af1683f9f82c3fb43d7c6656f
SSDEEP 49152:XkIOEDTD5PrzrO1FzQBt14rs/IiijcRLsc/sDBDf463fF:XlTlQrViijc9/sVDf463N
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3828-141-0x0000000000BB0000-0x0000000000E02000-memory.dmp

Download

memory/3828-142-0x00007FFB156D0000-0x00007FFB16191000-memory.dmp

Download

memory/3828-143-0x000000001B940000-0x000000001B990000-memory.dmp

Download

memory/3828-144-0x000000001D980000-0x000000001DEA8000-memory.dmp

Download

memory/3828-148-0x00007FFB156D0000-0x00007FFB16191000-memory.dmp

Download

memory/4696-149-0x00007FFB156D0000-0x00007FFB16191000-memory.dmp

Download

memory/4696-150-0x00007FFB156D0000-0x00007FFB16191000-memory.dmp

Download

memory/4696-151-0x00007FFB156D0000-0x00007FFB16191000-memory.dmp

Download