dcrat | 767918ec340d10abd348a04f4ccb8e0c97f3d94e72cd5cdeb196dd86d1f9227d

Analysis

max time kernel
150s
max time network
153s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
01/11/2022, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
767918ec340d10abd348a04f4ccb8e0c97f3d94e72cd5cdeb196dd86d1f9227d.exe
Size 1.3MB
Sample221101-b4trfsfhfl
SHA256 767918ec340d10abd348a04f4ccb8e0c97f3d94e72cd5cdeb196dd86d1f9227d
MD5 d5f2db9174f8bbb3a77ab0f4dd090092
SHA1 a1e647f624dcae0d9de01b71921cf0599992e0b1
SHA512 cf466f2248ae714c599dce2c0ec883e92131b79bdb784092076030b2634db0dadd2f5e3f76a7d6b5d6a610d85deb0cd5586a5f5b65d76db7a9897fdba033f465
SSDEEP 24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3924	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4444	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	580	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	3808	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	3808	schtasks.exe	70

DCRat payload 17 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000600000001ac1d-280.dat	dcrat
behavioral1/files/0x000600000001ac1d-281.dat	dcrat
behavioral1/memory/4508-282-0x0000000000F10000-0x0000000001020000-memory.dmp	dcrat
behavioral1/files/0x000600000001ac31-333.dat	dcrat
behavioral1/files/0x000600000001ac31-334.dat	dcrat
behavioral1/files/0x000600000001ac31-627.dat	dcrat
behavioral1/files/0x000600000001ac31-634.dat	dcrat
behavioral1/files/0x000600000001ac31-640.dat	dcrat
behavioral1/files/0x000600000001ac31-645.dat	dcrat
behavioral1/files/0x000600000001ac31-650.dat	dcrat
behavioral1/files/0x000600000001ac31-655.dat	dcrat
behavioral1/files/0x000600000001ac31-660.dat	dcrat
behavioral1/files/0x000600000001ac31-665.dat	dcrat
behavioral1/files/0x000600000001ac31-671.dat	dcrat
behavioral1/files/0x000600000001ac31-676.dat	dcrat
behavioral1/files/0x000600000001ac31-682.dat	dcrat
behavioral1/files/0x000600000001ac31-687.dat	dcrat

Executes dropped EXE 14 IoCs

pid	Process
4508	DllCommonsvc.exe
2056	SearchUI.exe
3196	SearchUI.exe
3352	SearchUI.exe
4764	SearchUI.exe
2736	SearchUI.exe
4016	SearchUI.exe
1952	SearchUI.exe
1240	SearchUI.exe
1000	SearchUI.exe
1632	SearchUI.exe
1204	SearchUI.exe
4444	SearchUI.exe
1832	SearchUI.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\Windows Multimedia Platform\DllCommonsvc.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Multimedia Platform\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\spoolsv.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\GameBarPresenceWriter\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\GameBarPresenceWriter\088424020bedd6	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4596	schtasks.exe
4464	schtasks.exe
4360	schtasks.exe
584	schtasks.exe
1200	schtasks.exe
1432	schtasks.exe
3924	schtasks.exe
5048	schtasks.exe
4380	schtasks.exe
1076	schtasks.exe
4236	schtasks.exe
5016	schtasks.exe
4944	schtasks.exe
3184	schtasks.exe
3292	schtasks.exe
4408	schtasks.exe
580	schtasks.exe
640	schtasks.exe
4592	schtasks.exe
4580	schtasks.exe
4624	schtasks.exe
4444	schtasks.exe
1384	schtasks.exe
4940	schtasks.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	767918ec340d10abd348a04f4ccb8e0c97f3d94e72cd5cdeb196dd86d1f9227d.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	SearchUI.exe

Suspicious behavior: EnumeratesProcesses 59 IoCs

pid	Process
4508	DllCommonsvc.exe
4508	DllCommonsvc.exe
4508	DllCommonsvc.exe
4508	DllCommonsvc.exe
4508	DllCommonsvc.exe
4508	DllCommonsvc.exe
4508	DllCommonsvc.exe
4508	DllCommonsvc.exe
4508	DllCommonsvc.exe
1748	powershell.exe
1628	powershell.exe
1748	powershell.exe
1628	powershell.exe
1204	powershell.exe
1204	powershell.exe
1628	powershell.exe
1752	powershell.exe
1752	powershell.exe
1236	powershell.exe
1236	powershell.exe
3368	powershell.exe
3368	powershell.exe
312	powershell.exe
312	powershell.exe
216	powershell.exe
216	powershell.exe
216	powershell.exe
1476	powershell.exe
1476	powershell.exe
1628	powershell.exe
1748	powershell.exe
1204	powershell.exe
1236	powershell.exe
216	powershell.exe
312	powershell.exe
1752	powershell.exe
3368	powershell.exe
2056	SearchUI.exe
2056	SearchUI.exe
1476	powershell.exe
1748	powershell.exe
1204	powershell.exe
1236	powershell.exe
312	powershell.exe
1752	powershell.exe
3368	powershell.exe
1476	powershell.exe
3196	SearchUI.exe
3352	SearchUI.exe
4764	SearchUI.exe
2736	SearchUI.exe
4016	SearchUI.exe
1952	SearchUI.exe
1240	SearchUI.exe
1000	SearchUI.exe
1632	SearchUI.exe
1204	SearchUI.exe
4444	SearchUI.exe
1832	SearchUI.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4508	DllCommonsvc.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	1752	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeDebugPrivilege	312	powershell.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	2056	SearchUI.exe
Token: SeIncreaseQuotaPrivilege	1628	powershell.exe
Token: SeSecurityPrivilege	1628	powershell.exe
Token: SeTakeOwnershipPrivilege	1628	powershell.exe
Token: SeLoadDriverPrivilege	1628	powershell.exe
Token: SeSystemProfilePrivilege	1628	powershell.exe
Token: SeSystemtimePrivilege	1628	powershell.exe
Token: SeProfSingleProcessPrivilege	1628	powershell.exe
Token: SeIncBasePriorityPrivilege	1628	powershell.exe
Token: SeCreatePagefilePrivilege	1628	powershell.exe
Token: SeBackupPrivilege	1628	powershell.exe
Token: SeRestorePrivilege	1628	powershell.exe
Token: SeShutdownPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeSystemEnvironmentPrivilege	1628	powershell.exe
Token: SeRemoteShutdownPrivilege	1628	powershell.exe
Token: SeUndockPrivilege	1628	powershell.exe
Token: SeManageVolumePrivilege	1628	powershell.exe
Token: 33	1628	powershell.exe
Token: 34	1628	powershell.exe
Token: 35	1628	powershell.exe
Token: 36	1628	powershell.exe
Token: SeIncreaseQuotaPrivilege	216	powershell.exe
Token: SeSecurityPrivilege	216	powershell.exe
Token: SeTakeOwnershipPrivilege	216	powershell.exe
Token: SeLoadDriverPrivilege	216	powershell.exe
Token: SeSystemProfilePrivilege	216	powershell.exe
Token: SeSystemtimePrivilege	216	powershell.exe
Token: SeProfSingleProcessPrivilege	216	powershell.exe
Token: SeIncBasePriorityPrivilege	216	powershell.exe
Token: SeCreatePagefilePrivilege	216	powershell.exe
Token: SeBackupPrivilege	216	powershell.exe
Token: SeRestorePrivilege	216	powershell.exe
Token: SeShutdownPrivilege	216	powershell.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeSystemEnvironmentPrivilege	216	powershell.exe
Token: SeRemoteShutdownPrivilege	216	powershell.exe
Token: SeUndockPrivilege	216	powershell.exe
Token: SeManageVolumePrivilege	216	powershell.exe
Token: 33	216	powershell.exe
Token: 34	216	powershell.exe
Token: 35	216	powershell.exe
Token: 36	216	powershell.exe
Token: SeIncreaseQuotaPrivilege	1748	powershell.exe
Token: SeSecurityPrivilege	1748	powershell.exe
Token: SeTakeOwnershipPrivilege	1748	powershell.exe
Token: SeLoadDriverPrivilege	1748	powershell.exe
Token: SeSystemProfilePrivilege	1748	powershell.exe
Token: SeSystemtimePrivilege	1748	powershell.exe
Token: SeProfSingleProcessPrivilege	1748	powershell.exe
Token: SeIncBasePriorityPrivilege	1748	powershell.exe
Token: SeCreatePagefilePrivilege	1748	powershell.exe
Token: SeBackupPrivilege	1748	powershell.exe
Token: SeRestorePrivilege	1748	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 3948	1776	767918ec340d10abd348a04f4ccb8e0c97f3d94e72cd5cdeb196dd86d1f9227d.exe	66
PID 1776 wrote to memory of 3948	1776	767918ec340d10abd348a04f4ccb8e0c97f3d94e72cd5cdeb196dd86d1f9227d.exe	66
PID 1776 wrote to memory of 3948	1776	767918ec340d10abd348a04f4ccb8e0c97f3d94e72cd5cdeb196dd86d1f9227d.exe	66
PID 3948 wrote to memory of 3532	3948	WScript.exe	67
PID 3948 wrote to memory of 3532	3948	WScript.exe	67
PID 3948 wrote to memory of 3532	3948	WScript.exe	67
PID 3532 wrote to memory of 4508	3532	cmd.exe	69
PID 3532 wrote to memory of 4508	3532	cmd.exe	69
PID 4508 wrote to memory of 1748	4508	DllCommonsvc.exe	95
PID 4508 wrote to memory of 1748	4508	DllCommonsvc.exe	95
PID 4508 wrote to memory of 1628	4508	DllCommonsvc.exe	96
PID 4508 wrote to memory of 1628	4508	DllCommonsvc.exe	96
PID 4508 wrote to memory of 1236	4508	DllCommonsvc.exe	97
PID 4508 wrote to memory of 1236	4508	DllCommonsvc.exe	97
PID 4508 wrote to memory of 1204	4508	DllCommonsvc.exe	99
PID 4508 wrote to memory of 1204	4508	DllCommonsvc.exe	99
PID 4508 wrote to memory of 1752	4508	DllCommonsvc.exe	101
PID 4508 wrote to memory of 1752	4508	DllCommonsvc.exe	101
PID 4508 wrote to memory of 3368	4508	DllCommonsvc.exe	102
PID 4508 wrote to memory of 3368	4508	DllCommonsvc.exe	102
PID 4508 wrote to memory of 312	4508	DllCommonsvc.exe	108
PID 4508 wrote to memory of 312	4508	DllCommonsvc.exe	108
PID 4508 wrote to memory of 216	4508	DllCommonsvc.exe	107
PID 4508 wrote to memory of 216	4508	DllCommonsvc.exe	107
PID 4508 wrote to memory of 1476	4508	DllCommonsvc.exe	110
PID 4508 wrote to memory of 1476	4508	DllCommonsvc.exe	110
PID 4508 wrote to memory of 2056	4508	DllCommonsvc.exe	113
PID 4508 wrote to memory of 2056	4508	DllCommonsvc.exe	113
PID 2056 wrote to memory of 488	2056	SearchUI.exe	114
PID 2056 wrote to memory of 488	2056	SearchUI.exe	114
PID 488 wrote to memory of 4408	488	cmd.exe	117
PID 488 wrote to memory of 4408	488	cmd.exe	117
PID 488 wrote to memory of 3196	488	cmd.exe	118
PID 488 wrote to memory of 3196	488	cmd.exe	118
PID 3196 wrote to memory of 1380	3196	SearchUI.exe	119
PID 3196 wrote to memory of 1380	3196	SearchUI.exe	119
PID 1380 wrote to memory of 3152	1380	cmd.exe	121
PID 1380 wrote to memory of 3152	1380	cmd.exe	121
PID 1380 wrote to memory of 3352	1380	cmd.exe	122
PID 1380 wrote to memory of 3352	1380	cmd.exe	122
PID 3352 wrote to memory of 5064	3352	SearchUI.exe	124
PID 3352 wrote to memory of 5064	3352	SearchUI.exe	124
PID 5064 wrote to memory of 1968	5064	cmd.exe	125
PID 5064 wrote to memory of 1968	5064	cmd.exe	125
PID 5064 wrote to memory of 4764	5064	cmd.exe	126
PID 5064 wrote to memory of 4764	5064	cmd.exe	126
PID 4764 wrote to memory of 4400	4764	SearchUI.exe	127
PID 4764 wrote to memory of 4400	4764	SearchUI.exe	127
PID 4400 wrote to memory of 3044	4400	cmd.exe	129
PID 4400 wrote to memory of 3044	4400	cmd.exe	129
PID 4400 wrote to memory of 2736	4400	cmd.exe	130
PID 4400 wrote to memory of 2736	4400	cmd.exe	130
PID 2736 wrote to memory of 4068	2736	SearchUI.exe	131
PID 2736 wrote to memory of 4068	2736	SearchUI.exe	131
PID 4068 wrote to memory of 3548	4068	cmd.exe	133
PID 4068 wrote to memory of 3548	4068	cmd.exe	133
PID 4068 wrote to memory of 4016	4068	cmd.exe	134
PID 4068 wrote to memory of 4016	4068	cmd.exe	134
PID 4016 wrote to memory of 2816	4016	SearchUI.exe	137
PID 4016 wrote to memory of 2816	4016	SearchUI.exe	137
PID 2816 wrote to memory of 4904	2816	cmd.exe	136
PID 2816 wrote to memory of 4904	2816	cmd.exe	136
PID 2816 wrote to memory of 1952	2816	cmd.exe	138
PID 2816 wrote to memory of 1952	2816	cmd.exe	138

C:\Users\Admin\AppData\Local\Temp\767918ec340d10abd348a04f4ccb8e0c97f3d94e72cd5cdeb196dd86d1f9227d.exe
"C:\Users\Admin\AppData\Local\Temp\767918ec340d10abd348a04f4ccb8e0c97f3d94e72cd5cdeb196dd86d1f9227d.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1748
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\GameBarPresenceWriter\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1236
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SearchUI.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:216
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:312
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhostw.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476
    - - C:\providercommon\SearchUI.exe
        
        "C:\providercommon\SearchUI.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2056
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\arqkgCRh4V.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:488
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4408
        
        C:\providercommon\SearchUI.exe
        
        "C:\providercommon\SearchUI.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3196
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tbw0avzYF4.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3152
        
        C:\providercommon\SearchUI.exe
        
        "C:\providercommon\SearchUI.exe"
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fg7ffKrc0I.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1968
        
        C:\providercommon\SearchUI.exe
        
        "C:\providercommon\SearchUI.exe"
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vXy3H03RZr.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4400
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3044
        
        C:\providercommon\SearchUI.exe
        
        "C:\providercommon\SearchUI.exe"
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2736
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xZLz5Ote6t.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:3548
        
        C:\providercommon\SearchUI.exe
        
        "C:\providercommon\SearchUI.exe"
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kYBl3UyOdq.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\providercommon\SearchUI.exe
        
        "C:\providercommon\SearchUI.exe"
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:1952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hlHmrlOhE6.bat"
        18⤵
        
        PID:4900
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4708
        
        C:\providercommon\SearchUI.exe
        
        "C:\providercommon\SearchUI.exe"
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:1240
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\T3kbcxG26A.bat"
        20⤵
        
        PID:1776
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:3048
        
        C:\providercommon\SearchUI.exe
        
        "C:\providercommon\SearchUI.exe"
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:1000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pksuDlslcW.bat"
        22⤵
        
        PID:1544
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4252
        
        C:\providercommon\SearchUI.exe
        
        "C:\providercommon\SearchUI.exe"
        23⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:1632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pksuDlslcW.bat"
        24⤵
        
        PID:4264
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2108
        
        C:\providercommon\SearchUI.exe
        
        "C:\providercommon\SearchUI.exe"
        25⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:1204
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AQ0EpYUV7r.bat"
        26⤵
        
        PID:4636
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:4616
        
        C:\providercommon\SearchUI.exe
        
        "C:\providercommon\SearchUI.exe"
        27⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4444
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sWmtPUST1G.bat"
        28⤵
        
        PID:640
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:2820
        
        C:\providercommon\SearchUI.exe
        
        "C:\providercommon\SearchUI.exe"
        29⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:1832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\axBdnWD1Gl.bat"
        30⤵
        
        PID:4804
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Multimedia Platform\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Multimedia Platform\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Windows\GameBarPresenceWriter\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Windows\GameBarPresenceWriter\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\providercommon\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\Default\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Default\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 9 /tr "'C:\providercommon\SearchUI.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\providercommon\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 7 /tr "'C:\providercommon\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\providercommon\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1384

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:4904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SearchUI.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SearchUI.exe.log
Size 1KB
SHA256 375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12
MD5 d63ff49d7c92016feb39812e4db10419
SHA1 2307d5e35ca9864ffefc93acf8573ea995ba189b
SHA512 00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
MD5 ad5cd538ca58cb28ede39c108acb5785
SHA1 1ae910026f3dbe90ed025e9e96ead2b5399be877
SHA512 c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
MD5 SHA1 SHA512

Submit Download