dcrat | 7c00e76d200bb61ac4ad205703541d6d9e11898333759fb876bd5fef0d1fed70

Analysis

max time kernel
144s
max time network
29s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22-11-2022 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c00e76d200bb61ac4ad205703541d6d9e11898333759fb876bd5fef0d1fed70.exe
Size

1.3MB
MD5

e8ab7211bb9f1d8f7853a408c0c4237d
SHA1

b201acf68589dce527a2f64496933a524a2a828f
SHA256

7c00e76d200bb61ac4ad205703541d6d9e11898333759fb876bd5fef0d1fed70
SHA512

fe3b7e3a3b9008aa802d7660b11c1a2b7b953cd222c99287ad891792c35bea51e1523f267e7b1cb0fe80cd140985a52f238fdba835f702b18ac58a00b1cd9c27
SSDEEP

24576:U2G/nvxW3Ww0tiZJVZke3TAJ41sh2D0N6ZotQhiY3obwMGgp9FUQ:UbA30iDV6nJmTh3obXGgp9Fl

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	524	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	780	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	780	schtasks.exe	32

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001399c-62.dat	dcrat
behavioral1/files/0x000800000001399c-61.dat	dcrat
behavioral1/files/0x000800000001399c-60.dat	dcrat
behavioral1/files/0x000800000001399c-64.dat	dcrat
behavioral1/memory/472-65-0x0000000000AB0000-0x0000000000BBA000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
472	fontmonitorcommon.exe

Loads dropped DLL 2 IoCs

pid	Process
1320	cmd.exe
1320	cmd.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\images\lsass.exe	fontmonitorcommon.exe
File created	C:\Program Files\7-Zip\Lang\System.exe	fontmonitorcommon.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXCD.tmp	fontmonitorcommon.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX6C7.tmp	fontmonitorcommon.exe
File created	C:\Program Files\Internet Explorer\images\lsass.exe	fontmonitorcommon.exe
File created	C:\Program Files\7-Zip\Lang\27d1bcfc3c54e0	fontmonitorcommon.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\sppsvc.exe	fontmonitorcommon.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\services.exe	fontmonitorcommon.exe
File created	C:\Program Files (x86)\Windows Mail\c5b4cb5e9653cc	fontmonitorcommon.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\0a1fd5f707cd16	fontmonitorcommon.exe
File opened for modification	C:\Program Files\Internet Explorer\images\RCX5AB1.tmp	fontmonitorcommon.exe
File opened for modification	C:\Program Files\Internet Explorer\images\RCX5D22.tmp	fontmonitorcommon.exe
File opened for modification	C:\Program Files\7-Zip\Lang\System.exe	fontmonitorcommon.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\RCX1896.tmp	fontmonitorcommon.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\sppsvc.exe	fontmonitorcommon.exe
File created	C:\Program Files\Internet Explorer\images\6203df4a6bafc7	fontmonitorcommon.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCXD3D.tmp	fontmonitorcommon.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCXFAE.tmp	fontmonitorcommon.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\RCX1625.tmp	fontmonitorcommon.exe
File created	C:\Program Files (x86)\Windows Mail\services.exe	fontmonitorcommon.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Migration\WTR\csrss.exe	fontmonitorcommon.exe
File created	C:\Windows\Migration\WTR\886983d96e3d3e	fontmonitorcommon.exe
File opened for modification	C:\Windows\Migration\WTR\RCX88D8.tmp	fontmonitorcommon.exe
File opened for modification	C:\Windows\Migration\WTR\RCX8B49.tmp	fontmonitorcommon.exe
File opened for modification	C:\Windows\Migration\WTR\csrss.exe	fontmonitorcommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1800	schtasks.exe
524	schtasks.exe
1492	schtasks.exe
1504	schtasks.exe
2152	schtasks.exe
2372	schtasks.exe
1108	schtasks.exe
1528	schtasks.exe
2200	schtasks.exe
2228	schtasks.exe
2396	schtasks.exe
2540	schtasks.exe
1640	schtasks.exe
1432	schtasks.exe
1568	schtasks.exe
2468	schtasks.exe
1960	schtasks.exe
820	schtasks.exe
2084	schtasks.exe
2300	schtasks.exe
2320	schtasks.exe
2416	schtasks.exe
1008	schtasks.exe
660	schtasks.exe
1596	schtasks.exe
1100	schtasks.exe
1592	schtasks.exe
964	schtasks.exe
1940	schtasks.exe
2172	schtasks.exe
2272	schtasks.exe
2348	schtasks.exe
2444	schtasks.exe
1980	schtasks.exe
1716	schtasks.exe
2492	schtasks.exe
2104	schtasks.exe
2512	schtasks.exe
1872	schtasks.exe
1748	schtasks.exe
2124	schtasks.exe
2248	schtasks.exe
2564	schtasks.exe
2024	schtasks.exe
968	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe
472	fontmonitorcommon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	472	fontmonitorcommon.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1676	1552	7c00e76d200bb61ac4ad205703541d6d9e11898333759fb876bd5fef0d1fed70.exe	28
PID 1552 wrote to memory of 1676	1552	7c00e76d200bb61ac4ad205703541d6d9e11898333759fb876bd5fef0d1fed70.exe	28
PID 1552 wrote to memory of 1676	1552	7c00e76d200bb61ac4ad205703541d6d9e11898333759fb876bd5fef0d1fed70.exe	28
PID 1552 wrote to memory of 1676	1552	7c00e76d200bb61ac4ad205703541d6d9e11898333759fb876bd5fef0d1fed70.exe	28
PID 1676 wrote to memory of 1320	1676	WScript.exe	29
PID 1676 wrote to memory of 1320	1676	WScript.exe	29
PID 1676 wrote to memory of 1320	1676	WScript.exe	29
PID 1676 wrote to memory of 1320	1676	WScript.exe	29
PID 1320 wrote to memory of 472	1320	cmd.exe	31
PID 1320 wrote to memory of 472	1320	cmd.exe	31
PID 1320 wrote to memory of 472	1320	cmd.exe	31
PID 1320 wrote to memory of 472	1320	cmd.exe	31
PID 472 wrote to memory of 2852	472	fontmonitorcommon.exe	78
PID 472 wrote to memory of 2852	472	fontmonitorcommon.exe	78
PID 472 wrote to memory of 2852	472	fontmonitorcommon.exe	78
PID 2852 wrote to memory of 2904	2852	cmd.exe	80
PID 2852 wrote to memory of 2904	2852	cmd.exe	80
PID 2852 wrote to memory of 2904	2852	cmd.exe	80

C:\Users\Admin\AppData\Local\Temp\7c00e76d200bb61ac4ad205703541d6d9e11898333759fb876bd5fef0d1fed70.exe
"C:\Users\Admin\AppData\Local\Temp\7c00e76d200bb61ac4ad205703541d6d9e11898333759fb876bd5fef0d1fed70.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\SurrogateReviewdriverHost\mPQTi.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Roaming\SurrogateReviewdriverHost\0VgGij1TsQ7fEUJcEhLUmBiDHo.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1320
  - - C:\Users\Admin\AppData\Roaming\SurrogateReviewdriverHost\fontmonitorcommon.exe
      "C:\Users\Admin\AppData\Roaming\SurrogateReviewdriverHost\fontmonitorcommon.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:472
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\is3mtUuvpQ.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2852
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\images\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\images\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Recovery\12a0d7a2-621a-11ed-bae9-5e34c4ab0fa3\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\12a0d7a2-621a-11ed-bae9-5e34c4ab0fa3\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Recovery\12a0d7a2-621a-11ed-bae9-5e34c4ab0fa3\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\12a0d7a2-621a-11ed-bae9-5e34c4ab0fa3\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\12a0d7a2-621a-11ed-bae9-5e34c4ab0fa3\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\12a0d7a2-621a-11ed-bae9-5e34c4ab0fa3\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\Migration\WTR\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\Migration\WTR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Recovery\12a0d7a2-621a-11ed-bae9-5e34c4ab0fa3\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\12a0d7a2-621a-11ed-bae9-5e34c4ab0fa3\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Recovery\12a0d7a2-621a-11ed-bae9-5e34c4ab0fa3\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\12a0d7a2-621a-11ed-bae9-5e34c4ab0fa3\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\12a0d7a2-621a-11ed-bae9-5e34c4ab0fa3\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Recovery\12a0d7a2-621a-11ed-bae9-5e34c4ab0fa3\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Desktop\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Desktop\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Desktop\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Admin\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Recovery\12a0d7a2-621a-11ed-bae9-5e34c4ab0fa3\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\12a0d7a2-621a-11ed-bae9-5e34c4ab0fa3\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Recovery\12a0d7a2-621a-11ed-bae9-5e34c4ab0fa3\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Downloads\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Downloads\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Downloads\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is3mtUuvpQ.bat

Filesize
203B

MD5
21e515f05b043f75a92b771a4345d0b2

SHA1
3e9056689f8ddf9651571674a47630032dc7be54

SHA256
b0d74639b6c8078e69de8b03c0a98148646643b8ae6e28b8df76acab990e106d

SHA512
dae91b472df5fc36678639bb8f6f8e3d9692cc4ac7d0bcb966f84e4e79657006299941d65c27157a5c4dfaca2bf039ba8f5bb06a4a2b86ce384b2c0b11ccf103

Download Submit
C:\Users\Admin\AppData\Roaming\SurrogateReviewdriverHost\0VgGij1TsQ7fEUJcEhLUmBiDHo.bat

Filesize
59B

MD5
89803afd00942423ddc4bd21ece57e63

SHA1
525a07e5effd35533a75672123dbbf9da73c4d57

SHA256
bd260c7f3f5b57e0fa4e12391887a58d2dd3aa9939941b86d98bf4e458f8a1a5

SHA512
63b4331cc960837a9701ed80920ca9dfff98816f6c911bee9afc7f22c6f9b7932bcd865dd419704fbda404602535725632c06a97aabaa629b71e74f5dfb81d3e

Download Submit
C:\Users\Admin\AppData\Roaming\SurrogateReviewdriverHost\fontmonitorcommon.exe

Filesize
1.0MB

MD5
5d4bd5f30909e3553904956c07f575e8

SHA1
70c340703499a5ad54e9fe205330e3d295d81c38

SHA256
af8557b923fca616c04d38072a1d280afaf868ebcce244aec6385f756fecbf8a

SHA512
bbecba1ced46b83690e3f15f36898f8ebd5708991f0942fa92f04eae8c8f6fb5c0b745bdb4bcb898c28be287377b7b078b7f519fb6e4b9c58d95806aec5dec25

Download Submit
C:\Users\Admin\AppData\Roaming\SurrogateReviewdriverHost\fontmonitorcommon.exe

Filesize
1.0MB

MD5
5d4bd5f30909e3553904956c07f575e8

SHA1
70c340703499a5ad54e9fe205330e3d295d81c38

SHA256
af8557b923fca616c04d38072a1d280afaf868ebcce244aec6385f756fecbf8a

SHA512
bbecba1ced46b83690e3f15f36898f8ebd5708991f0942fa92f04eae8c8f6fb5c0b745bdb4bcb898c28be287377b7b078b7f519fb6e4b9c58d95806aec5dec25

Download Submit
C:\Users\Admin\AppData\Roaming\SurrogateReviewdriverHost\mPQTi.vbe

Filesize
235B

MD5
058e84411de105b1405e3c9f27a26d0c

SHA1
e2fff2146a8d83f1c2a8f43f7e4be774a0966252

SHA256
6919b7d4b838c5693b3c0e565aaf7fd16e941acc2abdf90348c808c4e9411b53

SHA512
caa79323cb92408ad2dafd8c5a98cf9a31ecc092748106fbaf0d83432ab6ce59d56850e7b59224fe2b03e405b758626a6849a099a1bb0b211a24d732ad00bf0f

Download Submit
\Users\Admin\AppData\Roaming\SurrogateReviewdriverHost\fontmonitorcommon.exe

Filesize
1.0MB

MD5
5d4bd5f30909e3553904956c07f575e8

SHA1
70c340703499a5ad54e9fe205330e3d295d81c38

SHA256
af8557b923fca616c04d38072a1d280afaf868ebcce244aec6385f756fecbf8a

SHA512
bbecba1ced46b83690e3f15f36898f8ebd5708991f0942fa92f04eae8c8f6fb5c0b745bdb4bcb898c28be287377b7b078b7f519fb6e4b9c58d95806aec5dec25

Download Submit
\Users\Admin\AppData\Roaming\SurrogateReviewdriverHost\fontmonitorcommon.exe

Filesize
1.0MB

MD5
5d4bd5f30909e3553904956c07f575e8

SHA1
70c340703499a5ad54e9fe205330e3d295d81c38

SHA256
af8557b923fca616c04d38072a1d280afaf868ebcce244aec6385f756fecbf8a

SHA512
bbecba1ced46b83690e3f15f36898f8ebd5708991f0942fa92f04eae8c8f6fb5c0b745bdb4bcb898c28be287377b7b078b7f519fb6e4b9c58d95806aec5dec25

Download Submit
memory/472-65-0x0000000000AB0000-0x0000000000BBA000-memory.dmp

Filesize
1.0MB

Download
memory/472-63-0x0000000000000000-mapping.dmp

Download
memory/472-66-0x00000000001C0000-0x00000000001CE000-memory.dmp

Filesize
56KB

Download
memory/472-67-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download
memory/472-68-0x0000000000360000-0x000000000036C000-memory.dmp

Filesize
48KB

Download
memory/472-69-0x000000001B086000-0x000000001B0A5000-memory.dmp

Filesize
124KB

Download
memory/472-70-0x000000001B086000-0x000000001B0A5000-memory.dmp

Filesize
124KB

Download
memory/472-72-0x000000001B086000-0x000000001B0A5000-memory.dmp

Filesize
124KB

Download
memory/1320-59-0x0000000000000000-mapping.dmp

Download
memory/1552-54-0x0000000075781000-0x0000000075783000-memory.dmp

Filesize
8KB

Download
memory/1676-55-0x0000000000000000-mapping.dmp

Download
memory/2852-71-0x0000000000000000-mapping.dmp

Download
memory/2904-74-0x0000000000000000-mapping.dmp

Download