dcrat | 2725744203c338c3d26fd404c26af2f772c164d6069bd1c0b92e5ada2db82dae

Analysis

max time kernel
31s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14930a13b21a006cc5492488b95d9d59.exe
Size 1.8MB
Sample221201-j82xmaea2v
SHA256 2725744203c338c3d26fd404c26af2f772c164d6069bd1c0b92e5ada2db82dae
MD5 14930a13b21a006cc5492488b95d9d59
SHA1 ab1ff6c3ee32f6c87c4468be15bd48767e8ad593
SHA512 d7000fc78de31e600a8d2d820aa14c478708fedeb04bf22495e30a40a20528c15c0d4e7c3e842e33445229969688dc1ae21ebbfa35838d8541d8bdac536b38e9
SSDEEP 49152:godoalH3Fh0dZXAZPabJ10r+vJqB1zRIm:god93fQwFkhO2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3784	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3720	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3652	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	100	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	176	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4312	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	732	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1280	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	392	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3432	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3096	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3204	1348	schtasks.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	1348	schtasks.exe	42

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3436-132-0x0000000000010000-0x00000000001D8000-memory.dmp	dcrat
behavioral2/files/0x0002000000022e1d-167.dat	dcrat
behavioral2/files/0x0002000000022e1d-165.dat	dcrat
behavioral2/memory/4236-169-0x0000000000090000-0x0000000000258000-memory.dmp	dcrat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	14930a13b21a006cc5492488b95d9d59.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\e6c9b481da804f	14930a13b21a006cc5492488b95d9d59.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\dwm.exe	14930a13b21a006cc5492488b95d9d59.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\6cb0b6c459d5d3	14930a13b21a006cc5492488b95d9d59.exe
File created	C:\Program Files (x86)\Common Files\csrss.exe	14930a13b21a006cc5492488b95d9d59.exe
File created	C:\Program Files (x86)\Common Files\886983d96e3d3e	14930a13b21a006cc5492488b95d9d59.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fontdrvhost.exe	14930a13b21a006cc5492488b95d9d59.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\5b884080fd4f94	14930a13b21a006cc5492488b95d9d59.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\OfficeClickToRun.exe	14930a13b21a006cc5492488b95d9d59.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ModemLogs\sihost.exe	14930a13b21a006cc5492488b95d9d59.exe
File created	C:\Windows\ModemLogs\66fc9ff0ee96c2	14930a13b21a006cc5492488b95d9d59.exe

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3432	schtasks.exe
816	schtasks.exe
2988	schtasks.exe
1368	schtasks.exe
4752	schtasks.exe
3652	schtasks.exe
2948	schtasks.exe
732	schtasks.exe
392	schtasks.exe
2648	schtasks.exe
3488	schtasks.exe
3136	schtasks.exe
2792	schtasks.exe
4392	schtasks.exe
2884	schtasks.exe
1428	schtasks.exe
4588	schtasks.exe
5100	schtasks.exe
2836	schtasks.exe
4192	schtasks.exe
2028	schtasks.exe
1272	schtasks.exe
1068	schtasks.exe
3096	schtasks.exe
1548	schtasks.exe
3300	schtasks.exe
396	schtasks.exe
100	schtasks.exe
4312	schtasks.exe
1280	schtasks.exe
5056	schtasks.exe
3784	schtasks.exe
1444	schtasks.exe
1592	schtasks.exe
3624	schtasks.exe
1948	schtasks.exe
2864	schtasks.exe
3464	schtasks.exe
1660	schtasks.exe
176	schtasks.exe
2240	schtasks.exe
3720	schtasks.exe
1884	schtasks.exe
820	schtasks.exe
3632	schtasks.exe
3204	schtasks.exe
4460	schtasks.exe
1996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe
3436	14930a13b21a006cc5492488b95d9d59.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3436	14930a13b21a006cc5492488b95d9d59.exe

C:\Users\Admin\AppData\Local\Temp\14930a13b21a006cc5492488b95d9d59.exe
"C:\Users\Admin\AppData\Local\Temp\14930a13b21a006cc5492488b95d9d59.exe"
1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  PID:5080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  PID:4336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  PID:4668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  PID:5088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  PID:1468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
  2⤵
  PID:4784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  PID:4696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  PID:3748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  PID:988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  PID:2716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  PID:3520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  PID:3696
- C:\Users\Default\SendTo\smss.exe
  "C:\Users\Default\SendTo\smss.exe"
  2⤵
  PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Templates\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\odt\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "14930a13b21a006cc5492488b95d9d591" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\14930a13b21a006cc5492488b95d9d59.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "14930a13b21a006cc5492488b95d9d59" /sc ONLOGON /tr "'C:\Users\Public\Pictures\14930a13b21a006cc5492488b95d9d59.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "14930a13b21a006cc5492488b95d9d591" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\14930a13b21a006cc5492488b95d9d59.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\odt\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "14930a13b21a006cc5492488b95d9d591" /sc MINUTE /mo 5 /tr "'C:\odt\14930a13b21a006cc5492488b95d9d59.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "14930a13b21a006cc5492488b95d9d59" /sc ONLOGON /tr "'C:\odt\14930a13b21a006cc5492488b95d9d59.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "14930a13b21a006cc5492488b95d9d591" /sc MINUTE /mo 6 /tr "'C:\odt\14930a13b21a006cc5492488b95d9d59.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Windows\ModemLogs\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\ModemLogs\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Windows\ModemLogs\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\Default\SendTo\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\SendTo\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Default\SendTo\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\Cursors\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Cursors\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\Cursors\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\odt\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

smss.exe

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\smss.exe
Size 1.3MB
SHA256 5b2a020cd2d511b841fdd2c295f896a908e6d76e690ec93938f24920e75eabb8
MD5 2804204f751faa6f0e4430ac9423abda
SHA1 3ae4988570fad2b5e6bc57d7b4435ad80b0156c3
SHA512 2e8f90b94738301e04d0cfcccb5cad61a8d39fefb55126a077080b8c2363bcc5c03335b295bf977f3818450b79455341704339d07c9a830ab9c2e9ec631decce
SSDEEP 24576:w27/SyoaErH+H+MNY96X3JhK1pzR1rNZXXvjkRZPaOcs:wodoalH3Fh0dZXAZPabs
MD5 SHA1 SHA512 SSDEEP

Submit Download

smss.exe

Path C:\Users\Default\SendTo\smss.exe
Size 1.2MB
SHA256 11cb1edc6f0b6c16237f5e3c7d13ebd2b6e0151b0bd71b7ed46856c3059cfce2
MD5 3724622d69a7f29ddf89b47e265d72ef
SHA1 6393b9792d1deef22d6b96623cef036f374bc858
SHA512 fd7bbff0f3aabec203dcaef7d3bd7e0895da6d828ee3068dc1c8d5976dc67318a176478090502e672a38049168cf8ab1346a7428c315fd4658402773eb7bfa60
SSDEEP 24576:w27/SyoaErH+H+MNY96X3JhK1pzR1rNZXXvjkRZPc:wodoalH3Fh0dZXAZPc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1468-162-0x00007FFB86930000-0x00007FFB873F1000-memory.dmp

Download

memory/2716-166-0x00007FFB86930000-0x00007FFB873F1000-memory.dmp

Download

memory/3436-170-0x00007FFB86930000-0x00007FFB873F1000-memory.dmp

Download

memory/3436-132-0x0000000000010000-0x00000000001D8000-memory.dmp

Download

memory/3436-141-0x000000001CFE7000-0x000000001CFEA000-memory.dmp

Download

memory/3436-133-0x00007FFB86930000-0x00007FFB873F1000-memory.dmp

Download

memory/3436-139-0x000000001CFE0000-0x000000001CFE4000-memory.dmp

Download

memory/3436-134-0x000000001BC80000-0x000000001BCD0000-memory.dmp

Download

memory/3436-145-0x000000001CFE0000-0x000000001CFE4000-memory.dmp

Download

memory/3436-136-0x0000000000999000-0x000000000099F000-memory.dmp

Download

memory/3436-155-0x000000001CFE4000-0x000000001CFE7000-memory.dmp

Download

memory/3436-138-0x0000000000999000-0x000000000099F000-memory.dmp

Download

memory/3436-140-0x000000001CFE4000-0x000000001CFE7000-memory.dmp

Download

memory/3436-135-0x000000001C3B0000-0x000000001C8D8000-memory.dmp

Download

memory/3436-137-0x00007FFB86930000-0x00007FFB873F1000-memory.dmp

Download

memory/3696-171-0x00007FFB86930000-0x00007FFB873F1000-memory.dmp

Download

memory/3748-168-0x00007FFB86930000-0x00007FFB873F1000-memory.dmp

Download

memory/4236-169-0x0000000000090000-0x0000000000258000-memory.dmp

Download

memory/4336-158-0x00007FFB86930000-0x00007FFB873F1000-memory.dmp

Download

memory/4668-159-0x00007FFB86930000-0x00007FFB873F1000-memory.dmp

Download

memory/4696-163-0x00007FFB86930000-0x00007FFB873F1000-memory.dmp

Download

memory/4784-160-0x00007FFB86930000-0x00007FFB873F1000-memory.dmp

Download

memory/5080-157-0x00007FFB86930000-0x00007FFB873F1000-memory.dmp

Download

memory/5080-156-0x0000017BF78A0000-0x0000017BF78C2000-memory.dmp

Download

memory/5088-161-0x00007FFB86930000-0x00007FFB873F1000-memory.dmp

Download