dcrat | 02eac3477d8072f8a2e1eb518a741c467ec260aee8766b2ecbbe99bee947844a

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2023, 07:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
05fd4119fba50cfd1d88fe2ffed24456.exe
Size 2.4MB
Sample230101-je84vabc93
SHA256 02eac3477d8072f8a2e1eb518a741c467ec260aee8766b2ecbbe99bee947844a
MD5 05fd4119fba50cfd1d88fe2ffed24456
SHA1 d2ff273193bc6f26878ce9594f44794371babbe5
SHA512 30d3a5ee8a685f7e2a8980a61d0fde643820e18a1d29240edbab92765a9e99f3d27f7f50fa47d33bdeb211931d92728ab3f19437cb103f188f231916fa6f0d83
SSDEEP 24576:1RNpngHRc5DYZYLUsZ9p48N41XMFBDeQzC/tqELdO0U7TBd1X/SQOvjASm:PPDvx94V0eQuPdmJdV/J
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	988	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3336	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4288	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4280	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3784	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	428	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3800	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1020	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	720	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	4320	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	4320	schtasks.exe	19

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	05fd4119fba50cfd1d88fe2ffed24456.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	05fd4119fba50cfd1d88fe2ffed24456.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	05fd4119fba50cfd1d88fe2ffed24456.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	upfc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	upfc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	upfc.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4616-132-0x00000000000F0000-0x000000000035A000-memory.dmp	dcrat
behavioral2/files/0x0007000000022e5a-214.dat	dcrat
behavioral2/files/0x0007000000022e5a-215.dat	dcrat
behavioral2/memory/3968-216-0x0000000000F40000-0x00000000011AA000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
3968	upfc.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	05fd4119fba50cfd1d88fe2ffed24456.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	upfc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	upfc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	upfc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	05fd4119fba50cfd1d88fe2ffed24456.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	05fd4119fba50cfd1d88fe2ffed24456.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\lsass.exe	05fd4119fba50cfd1d88fe2ffed24456.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\dllhost.exe	05fd4119fba50cfd1d88fe2ffed24456.exe
File opened for modification	C:\Program Files\Windows Portable Devices\taskhostw.exe	05fd4119fba50cfd1d88fe2ffed24456.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\5940a34987c991	05fd4119fba50cfd1d88fe2ffed24456.exe
File created	C:\Program Files\Windows Portable Devices\ea9f0e6c9e2dcd	05fd4119fba50cfd1d88fe2ffed24456.exe
File created	C:\Program Files\Windows Portable Devices\taskhostw.exe	05fd4119fba50cfd1d88fe2ffed24456.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX8EAD.tmp	05fd4119fba50cfd1d88fe2ffed24456.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OfficeClickToRun.exe	05fd4119fba50cfd1d88fe2ffed24456.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\e6c9b481da804f	05fd4119fba50cfd1d88fe2ffed24456.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\dllhost.exe	05fd4119fba50cfd1d88fe2ffed24456.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OfficeClickToRun.exe	05fd4119fba50cfd1d88fe2ffed24456.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCX89AA.tmp	05fd4119fba50cfd1d88fe2ffed24456.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RCX912F.tmp	05fd4119fba50cfd1d88fe2ffed24456.exe
File opened for modification	C:\Program Files\Windows Portable Devices\RCXA048.tmp	05fd4119fba50cfd1d88fe2ffed24456.exe
File created	C:\Program Files\7-Zip\Lang\lsass.exe	05fd4119fba50cfd1d88fe2ffed24456.exe
File created	C:\Program Files\7-Zip\Lang\6203df4a6bafc7	05fd4119fba50cfd1d88fe2ffed24456.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Speech_OneCore\Engines\Lexicon\SIHClient.exe	05fd4119fba50cfd1d88fe2ffed24456.exe
File created	C:\Windows\Speech_OneCore\Engines\Lexicon\7b3bf1de107bcf	05fd4119fba50cfd1d88fe2ffed24456.exe
File opened for modification	C:\Windows\Speech_OneCore\Engines\Lexicon\RCX9DC7.tmp	05fd4119fba50cfd1d88fe2ffed24456.exe
File opened for modification	C:\Windows\Speech_OneCore\Engines\Lexicon\SIHClient.exe	05fd4119fba50cfd1d88fe2ffed24456.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5052	3968	WerFault.exe	160

Creates scheduled task(s) 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3668	schtasks.exe
1164	schtasks.exe
5068	schtasks.exe
456	schtasks.exe
316	schtasks.exe
5012	schtasks.exe
216	schtasks.exe
2244	schtasks.exe
1512	schtasks.exe
3084	schtasks.exe
2168	schtasks.exe
4072	schtasks.exe
4752	schtasks.exe
3888	schtasks.exe
1456	schtasks.exe
3336	schtasks.exe
1716	schtasks.exe
4340	schtasks.exe
4916	schtasks.exe
428	schtasks.exe
4644	schtasks.exe
3476	schtasks.exe
988	schtasks.exe
5108	schtasks.exe
2968	schtasks.exe
3596	schtasks.exe
4288	schtasks.exe
5060	schtasks.exe
2712	schtasks.exe
4280	schtasks.exe
2496	schtasks.exe
1020	schtasks.exe
3144	schtasks.exe
720	schtasks.exe
1228	schtasks.exe
1956	schtasks.exe
4528	schtasks.exe
3800	schtasks.exe
1472	schtasks.exe
2568	schtasks.exe
3784	schtasks.exe
2008	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	upfc.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	05fd4119fba50cfd1d88fe2ffed24456.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
4896	powershell.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe
2172	powershell.exe
4500	powershell.exe
3916	powershell.exe
4884	powershell.exe
4884	powershell.exe
4028	powershell.exe
4028	powershell.exe
1444	powershell.exe
1444	powershell.exe
636	powershell.exe
636	powershell.exe
4616	05fd4119fba50cfd1d88fe2ffed24456.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	05fd4119fba50cfd1d88fe2ffed24456.exe
Token: SeDebugPrivilege	4896	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	4028	powershell.exe
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeDebugPrivilege	636	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	3500	powershell.exe
Token: SeDebugPrivilege	4688	powershell.exe
Token: SeDebugPrivilege	4084	powershell.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	3968	upfc.exe
Token: SeBackupPrivilege	2348	vssvc.exe
Token: SeRestorePrivilege	2348	vssvc.exe
Token: SeAuditPrivilege	2348	vssvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3968	upfc.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4896	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	123
PID 4616 wrote to memory of 4896	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	123
PID 4616 wrote to memory of 4028	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	137
PID 4616 wrote to memory of 4028	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	137
PID 4616 wrote to memory of 3916	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	125
PID 4616 wrote to memory of 3916	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	125
PID 4616 wrote to memory of 4884	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	126
PID 4616 wrote to memory of 4884	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	126
PID 4616 wrote to memory of 2172	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	127
PID 4616 wrote to memory of 2172	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	127
PID 4616 wrote to memory of 4500	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	134
PID 4616 wrote to memory of 4500	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	134
PID 4616 wrote to memory of 1444	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	130
PID 4616 wrote to memory of 1444	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	130
PID 4616 wrote to memory of 636	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	131
PID 4616 wrote to memory of 636	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	131
PID 4616 wrote to memory of 3500	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	138
PID 4616 wrote to memory of 3500	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	138
PID 4616 wrote to memory of 3508	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	141
PID 4616 wrote to memory of 3508	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	141
PID 4616 wrote to memory of 4688	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	142
PID 4616 wrote to memory of 4688	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	142
PID 4616 wrote to memory of 2816	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	151
PID 4616 wrote to memory of 2816	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	151
PID 4616 wrote to memory of 1648	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	150
PID 4616 wrote to memory of 1648	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	150
PID 4616 wrote to memory of 4084	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	149
PID 4616 wrote to memory of 4084	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	149
PID 4616 wrote to memory of 4132	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	146
PID 4616 wrote to memory of 4132	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	146
PID 4616 wrote to memory of 824	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	153
PID 4616 wrote to memory of 824	4616	05fd4119fba50cfd1d88fe2ffed24456.exe	153
PID 824 wrote to memory of 4848	824	cmd.exe	155
PID 824 wrote to memory of 4848	824	cmd.exe	155
PID 824 wrote to memory of 3968	824	cmd.exe	160
PID 824 wrote to memory of 3968	824	cmd.exe	160
PID 3968 wrote to memory of 4124	3968	upfc.exe	164
PID 3968 wrote to memory of 4124	3968	upfc.exe	164
PID 3968 wrote to memory of 816	3968	upfc.exe	165
PID 3968 wrote to memory of 816	3968	upfc.exe	165

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	05fd4119fba50cfd1d88fe2ffed24456.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	05fd4119fba50cfd1d88fe2ffed24456.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	upfc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	upfc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	upfc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	05fd4119fba50cfd1d88fe2ffed24456.exe

C:\Users\Admin\AppData\Local\Temp\05fd4119fba50cfd1d88fe2ffed24456.exe
"C:\Users\Admin\AppData\Local\Temp\05fd4119fba50cfd1d88fe2ffed24456.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\05fd4119fba50cfd1d88fe2ffed24456.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\smss.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\lsass.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SppExtComObj.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Gadgets\dllhost.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SIHClient.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OfficeClickToRun.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\Registry.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\OfficeClickToRun.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\upfc.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\My Videos\dllhost.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\taskhostw.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\Lexicon\SIHClient.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FyH7TMVdIN.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4848
- - C:\odt\upfc.exe
    "C:\odt\upfc.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks computer location settings
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3968
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d3b25359-7ae1-4534-b598-5caaaa36228e.vbs"
      4⤵
      PID:4124
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72856dd8-ebd5-455b-b790-096bc1078e47.vbs"
      4⤵
      PID:816
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3968 -s 3488
      4⤵
      Program crash
      PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SIHClient.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClient" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SIHClient.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SIHClient.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\odt\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 14 /tr "'C:\Windows\Speech_OneCore\Engines\Lexicon\SIHClient.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClient" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\Engines\Lexicon\SIHClient.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 11 /tr "'C:\Windows\Speech_OneCore\Engines\Lexicon\SIHClient.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Documents\My Videos\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Videos\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Documents\My Videos\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\odt\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\odt\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\odt\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1164

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 3968 -ip 3968
1⤵
PID:1188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...