dcrat | f67b08acb8ae930c53b21771a17f4e28b528eb31a70781cbdce31fef6c97b00a

Analysis

max time kernel
91s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2022, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
Size 1.4MB
Sample221116-d8rh1ach7s
SHA256 f67b08acb8ae930c53b21771a17f4e28b528eb31a70781cbdce31fef6c97b00a
MD5 f2f63fb441e54b56e81107f0da947e42
SHA1 f1f8e1b7a05f8bb4a6badca7e45c3442aa3f2a4e
SHA512 20bcbeadfe13d307b184c525613a1e1a999a8909063cad299426af38a24526617d80b450276bc5b10971d5a785feee257ea6a462fb635e61b359c583737e3f17
SSDEEP 24576:/OCM+rjknX/kjTg8fH4pNBKO9rOZZAoQ2o28magzg9lkAOkamIwqm8jQziHXIOP/:bNjknYg8CKKrOwSo8JzwlkAvQdHXlU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 34 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		1536	schtasks.exe
		4928	schtasks.exe
		4552	schtasks.exe
		2084	schtasks.exe
		4160	schtasks.exe
		4736	schtasks.exe
		4172	schtasks.exe
		4428	schtasks.exe
		3928	schtasks.exe
File created	C:\Windows\Logs\MeasuredBoot\886983d96e3d3e		F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
		4964	schtasks.exe
		5000	schtasks.exe
		4372	schtasks.exe
		4164	schtasks.exe
		4632	schtasks.exe
		3400	schtasks.exe
		4936	schtasks.exe
		1456	schtasks.exe
File created	C:\Windows\Logs\MeasuredBoot\csrss.exe		F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
		4892	schtasks.exe
		1828	schtasks.exe
		4472	schtasks.exe
		2732	schtasks.exe
		1112	schtasks.exe
		2020	schtasks.exe
		2292	schtasks.exe
		3384	schtasks.exe
		932	schtasks.exe
		3152	schtasks.exe
		4972	schtasks.exe
		3428	schtasks.exe
		5012	schtasks.exe
		756	schtasks.exe
		4532	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Logs\\MeasuredBoot\\csrss.exe\""	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Logs\\MeasuredBoot\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\csrss.exe\""	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Logs\\MeasuredBoot\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\csrss.exe\", \"C:\\ProgramData\\regid.1991-06.com.microsoft\\csrss.exe\""	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Logs\\MeasuredBoot\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\csrss.exe\", \"C:\\ProgramData\\regid.1991-06.com.microsoft\\csrss.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\sppsvc.exe\""	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Logs\\MeasuredBoot\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\csrss.exe\", \"C:\\ProgramData\\regid.1991-06.com.microsoft\\csrss.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\en-US\\smss.exe\""	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Logs\\MeasuredBoot\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\csrss.exe\", \"C:\\ProgramData\\regid.1991-06.com.microsoft\\csrss.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\en-US\\smss.exe\", \"C:\\ProgramData\\SoftwareDistribution\\OfficeClickToRun.exe\""	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Logs\\MeasuredBoot\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\csrss.exe\", \"C:\\ProgramData\\regid.1991-06.com.microsoft\\csrss.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\en-US\\smss.exe\", \"C:\\ProgramData\\SoftwareDistribution\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\SearchApp.exe\""	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Logs\\MeasuredBoot\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\csrss.exe\", \"C:\\ProgramData\\regid.1991-06.com.microsoft\\csrss.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\en-US\\smss.exe\", \"C:\\ProgramData\\SoftwareDistribution\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe

Process spawned unexpected child process 32 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	932	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4736	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4164	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3400	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4172	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3384	2392	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	2392	schtasks.exe	78

Executes dropped EXE 1 IoCs

pid	Process
1128	OfficeClickToRun.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\SearchApp.exe\""	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\Logs\\MeasuredBoot\\csrss.exe\""	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\7-Zip\\Lang\\csrss.exe\""	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\ProgramData\\regid.1991-06.com.microsoft\\csrss.exe\""	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Performance\\WinSAT\\DataStore\\sppsvc.exe\""	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Windows Media Player\\en-US\\smss.exe\""	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\ProgramData\\SoftwareDistribution\\OfficeClickToRun.exe\""	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
476	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
1128	OfficeClickToRun.exe
1128	OfficeClickToRun.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\SearchApp.exe	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\38384e6a620884	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
File created	C:\Program Files\7-Zip\Lang\csrss.exe	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
File created	C:\Program Files\7-Zip\Lang\886983d96e3d3e	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
File created	C:\Program Files (x86)\Windows Media Player\en-US\smss.exe	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
File created	C:\Program Files (x86)\Windows Media Player\en-US\69ddcba757bf72	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\MeasuredBoot\csrss.exe	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
File created	C:\Windows\Logs\MeasuredBoot\886983d96e3d3e	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
File created	C:\Windows\Performance\WinSAT\DataStore\sppsvc.exe	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
File created	C:\Windows\Performance\WinSAT\DataStore\0a1fd5f707cd16	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
File created	C:\Windows\Logs\MeasuredBoot\csrss.exe	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 32 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3928	schtasks.exe
1112	schtasks.exe
3152	schtasks.exe
4372	schtasks.exe
4172	schtasks.exe
1456	schtasks.exe
4972	schtasks.exe
5000	schtasks.exe
1828	schtasks.exe
4164	schtasks.exe
4160	schtasks.exe
4736	schtasks.exe
2292	schtasks.exe
4472	schtasks.exe
4428	schtasks.exe
4928	schtasks.exe
5012	schtasks.exe
756	schtasks.exe
4632	schtasks.exe
3384	schtasks.exe
4532	schtasks.exe
4964	schtasks.exe
4892	schtasks.exe
3428	schtasks.exe
4552	schtasks.exe
3400	schtasks.exe
2020	schtasks.exe
932	schtasks.exe
1536	schtasks.exe
2732	schtasks.exe
2084	schtasks.exe
4936	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
476	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
476	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
476	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	476	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
Token: SeDebugPrivilege	1128	OfficeClickToRun.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
476	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
1128	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 1128	476	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe	114
PID 476 wrote to memory of 1128	476	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe	114
PID 476 wrote to memory of 1128	476	F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe	114

C:\Users\Admin\AppData\Local\Temp\F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe
"C:\Users\Admin\AppData\Local\Temp\F67B08ACB8AE930C53B21771A17F4E28B528EB31A7078.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:476
- C:\ProgramData\SoftwareDistribution\OfficeClickToRun.exe
  "C:\ProgramData\SoftwareDistribution\OfficeClickToRun.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc MINUTE /mo 5 /tr "'C:\Windows\Logs\MeasuredBoot\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Logs\MeasuredBoot\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONSTART /tr "'C:\Windows\Logs\MeasuredBoot\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\Logs\MeasuredBoot\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONSTART /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc MINUTE /mo 14 /tr "'C:\ProgramData\regid.1991-06.com.microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\ProgramData\regid.1991-06.com.microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONSTART /tr "'C:\ProgramData\regid.1991-06.com.microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\ProgramData\regid.1991-06.com.microsoft\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc MINUTE /mo 7 /tr "'C:\Windows\Performance\WinSAT\DataStore\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONSTART /tr "'C:\Windows\Performance\WinSAT\DataStore\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\Performance\WinSAT\DataStore\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONSTART /tr "'C:\Program Files (x86)\Windows Media Player\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc MINUTE /mo 9 /tr "'C:\ProgramData\SoftwareDistribution\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\ProgramData\SoftwareDistribution\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONSTART /tr "'C:\ProgramData\SoftwareDistribution\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\ProgramData\SoftwareDistribution\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONSTART /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONSTART /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OfficeClickToRun.exe

Path C:\ProgramData\SoftwareDistribution\OfficeClickToRun.exe
Size 1.4MB
SHA256 f67b08acb8ae930c53b21771a17f4e28b528eb31a70781cbdce31fef6c97b00a
MD5 f2f63fb441e54b56e81107f0da947e42
SHA1 f1f8e1b7a05f8bb4a6badca7e45c3442aa3f2a4e
SHA512 20bcbeadfe13d307b184c525613a1e1a999a8909063cad299426af38a24526617d80b450276bc5b10971d5a785feee257ea6a462fb635e61b359c583737e3f17
SSDEEP 24576:/OCM+rjknX/kjTg8fH4pNBKO9rOZZAoQ2o28magzg9lkAOkamIwqm8jQziHXIOP/:bNjknYg8CKKrOwSo8JzwlkAvQdHXlU
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeClickToRun.exe

Path C:\ProgramData\SoftwareDistribution\OfficeClickToRun.exe
Size 1.4MB
SHA256 f67b08acb8ae930c53b21771a17f4e28b528eb31a70781cbdce31fef6c97b00a
MD5 f2f63fb441e54b56e81107f0da947e42
SHA1 f1f8e1b7a05f8bb4a6badca7e45c3442aa3f2a4e
SHA512 20bcbeadfe13d307b184c525613a1e1a999a8909063cad299426af38a24526617d80b450276bc5b10971d5a785feee257ea6a462fb635e61b359c583737e3f17
SSDEEP 24576:/OCM+rjknX/kjTg8fH4pNBKO9rOZZAoQ2o28magzg9lkAOkamIwqm8jQziHXIOP/:bNjknYg8CKKrOwSo8JzwlkAvQdHXlU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/476-141-0x0000000000BA0000-0x0000000000FC8000-memory.dmp

Download

memory/476-133-0x0000000000BA0000-0x0000000000FC8000-memory.dmp

Download

memory/476-134-0x0000000006C90000-0x0000000007234000-memory.dmp

Download

memory/476-135-0x0000000006A10000-0x0000000006A60000-memory.dmp

Download

memory/476-136-0x0000000007240000-0x00000000072D2000-memory.dmp

Download

memory/476-137-0x0000000007520000-0x0000000007586000-memory.dmp

Download

memory/476-132-0x0000000000BA0000-0x0000000000FC8000-memory.dmp

Download

memory/1128-142-0x0000000000C00000-0x0000000001028000-memory.dmp

Download

memory/1128-143-0x0000000000C00000-0x0000000001028000-memory.dmp

Download

memory/1128-144-0x0000000000C00000-0x0000000001028000-memory.dmp

Download

memory/1128-145-0x0000000000C00000-0x0000000001028000-memory.dmp

Download