dcrat | 1599ba5aa350aa5536bec9b4380abf38c053fb5b3cfc747d641ae60867a6e752

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/01/2023, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b85837ded88ca22d08e2e50dada29379.exe
Size

3.8MB
MD5

b85837ded88ca22d08e2e50dada29379
SHA1

f9cc008b67ee2061c12477143e824550f08540fb
SHA256

1599ba5aa350aa5536bec9b4380abf38c053fb5b3cfc747d641ae60867a6e752
SHA512

461ae9188033919293ca06a424bb049ee600e0f8b63f264bb3505195761dac9e8ae288fc8271e53431b699abd0f99d64b33f2c01ec27c995e3432f4b2ee2a7d4
SSDEEP

98304:V7b3a0t2TiPhx6Sp+ybfnDA4qo34n1oO:VH3Z8cp+gDZ4n1

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 32 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		1644	schtasks.exe
		1924	schtasks.exe
		1392	schtasks.exe
		1256	schtasks.exe
		1252	schtasks.exe
		864	schtasks.exe
		340	schtasks.exe
		1980	schtasks.exe
		1960	schtasks.exe
		436	schtasks.exe
		1692	schtasks.exe
		1348	schtasks.exe
File created	C:\Windows\security\database\6cb0b6c459d5d3		b85837ded88ca22d08e2e50dada29379.exe
		1668	schtasks.exe
		588	schtasks.exe
		768	schtasks.exe
		584	schtasks.exe
		1092	schtasks.exe
		1584	schtasks.exe
		1928	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		b85837ded88ca22d08e2e50dada29379.exe
		944	schtasks.exe
		1300	schtasks.exe
		1160	schtasks.exe
		824	schtasks.exe
		820	schtasks.exe
		1004	schtasks.exe
		1572	schtasks.exe
		852	schtasks.exe
		976	schtasks.exe
		1600	schtasks.exe
		520	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\dwm.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\dwm.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sppsvc.exe\", \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\smss.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\dwm.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\dwm.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sppsvc.exe\", \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\smss.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\lsm.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\explorer.exe\", \"C:\\Users\\Public\\Libraries\\WMIADAP.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\dwm.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\dwm.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sppsvc.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\dwm.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\dwm.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sppsvc.exe\", \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\dwm.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\dwm.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sppsvc.exe\", \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\dwm.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\dwm.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\dwm.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sppsvc.exe\", \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\smss.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\lsm.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\dwm.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\dwm.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sppsvc.exe\", \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\smss.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\lsm.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\explorer.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\dwm.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\dwm.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sppsvc.exe\", \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\smss.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\lsm.exe\", \"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\explorer.exe\", \"C:\\Users\\Public\\Libraries\\WMIADAP.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\WMIADAP.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\dwm.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\dwm.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\dwm.exe\""	b85837ded88ca22d08e2e50dada29379.exe

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	520	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	340	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	1904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	1904	schtasks.exe	28

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b85837ded88ca22d08e2e50dada29379.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b85837ded88ca22d08e2e50dada29379.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b85837ded88ca22d08e2e50dada29379.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	smss.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1956-54-0x0000000000300000-0x00000000006CA000-memory.dmp	dcrat
behavioral1/files/0x0008000000013a03-109.dat	dcrat
behavioral1/files/0x0008000000013a03-111.dat	dcrat
behavioral1/memory/2176-113-0x0000000000A00000-0x0000000000DCA000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2176	smss.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\dwm.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\dwm.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\lsm.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\explorer.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sppsvc.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sppsvc.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\dwm.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Users\\Public\\Libraries\\WMIADAP.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\WMIADAP.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\security\\database\\dwm.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\dwm.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\smss.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\lsm.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\WMIADAP.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\security\\database\\dwm.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\smss.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\c11c4da2-1a8a-11ed-8505-e0b24281b398\\explorer.exe\""	b85837ded88ca22d08e2e50dada29379.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Users\\Public\\Libraries\\WMIADAP.exe\""	b85837ded88ca22d08e2e50dada29379.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b85837ded88ca22d08e2e50dada29379.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b85837ded88ca22d08e2e50dada29379.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ipinfo.io
8	ipinfo.io

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\Idle.exe	b85837ded88ca22d08e2e50dada29379.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sppsvc.exe	b85837ded88ca22d08e2e50dada29379.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\it-IT\RCX5C04.tmp	b85837ded88ca22d08e2e50dada29379.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RCX83B7.tmp	b85837ded88ca22d08e2e50dada29379.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\6cb0b6c459d5d3	b85837ded88ca22d08e2e50dada29379.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\0a1fd5f707cd16	b85837ded88ca22d08e2e50dada29379.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\RCX1FA6.tmp	b85837ded88ca22d08e2e50dada29379.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RCX2BC9.tmp	b85837ded88ca22d08e2e50dada29379.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\lsm.exe	b85837ded88ca22d08e2e50dada29379.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\101b941d020240	b85837ded88ca22d08e2e50dada29379.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\RCX37DB.tmp	b85837ded88ca22d08e2e50dada29379.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\RCX3B65.tmp	b85837ded88ca22d08e2e50dada29379.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\it-IT\lsm.exe	b85837ded88ca22d08e2e50dada29379.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\6ccacd8608530f	b85837ded88ca22d08e2e50dada29379.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RCX2F52.tmp	b85837ded88ca22d08e2e50dada29379.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\WMIADAP.exe	b85837ded88ca22d08e2e50dada29379.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\75a57c1bdf437c	b85837ded88ca22d08e2e50dada29379.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\RCX2330.tmp	b85837ded88ca22d08e2e50dada29379.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\dwm.exe	b85837ded88ca22d08e2e50dada29379.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\Idle.exe	b85837ded88ca22d08e2e50dada29379.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\it-IT\RCX5F7E.tmp	b85837ded88ca22d08e2e50dada29379.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\dwm.exe	b85837ded88ca22d08e2e50dada29379.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sppsvc.exe	b85837ded88ca22d08e2e50dada29379.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RCX802D.tmp	b85837ded88ca22d08e2e50dada29379.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\WMIADAP.exe	b85837ded88ca22d08e2e50dada29379.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\security\database\RCX170D.tmp	b85837ded88ca22d08e2e50dada29379.exe
File created	C:\Windows\security\database\dwm.exe	b85837ded88ca22d08e2e50dada29379.exe
File opened for modification	C:\Windows\security\database\dwm.exe	b85837ded88ca22d08e2e50dada29379.exe
File created	C:\Windows\security\database\6cb0b6c459d5d3	b85837ded88ca22d08e2e50dada29379.exe
File opened for modification	C:\Windows\security\database\RCX1374.tmp	b85837ded88ca22d08e2e50dada29379.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1300	schtasks.exe
1348	schtasks.exe
1928	schtasks.exe
1960	schtasks.exe
436	schtasks.exe
1092	schtasks.exe
1668	schtasks.exe
1392	schtasks.exe
1924	schtasks.exe
852	schtasks.exe
864	schtasks.exe
976	schtasks.exe
1160	schtasks.exe
1644	schtasks.exe
340	schtasks.exe
1980	schtasks.exe
820	schtasks.exe
1252	schtasks.exe
1572	schtasks.exe
1600	schtasks.exe
824	schtasks.exe
1004	schtasks.exe
944	schtasks.exe
1584	schtasks.exe
584	schtasks.exe
588	schtasks.exe
768	schtasks.exe
520	schtasks.exe
1256	schtasks.exe
1692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1956	b85837ded88ca22d08e2e50dada29379.exe
2176	smss.exe
520	powershell.exe
1576	powershell.exe
1596	powershell.exe
972	powershell.exe
1420	powershell.exe
584	powershell.exe
1256	powershell.exe
880	powershell.exe
1924	powershell.exe
2176	smss.exe
2176	smss.exe
2176	smss.exe
2176	smss.exe
2176	smss.exe
2176	smss.exe
2176	smss.exe
2176	smss.exe
944	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	1956	b85837ded88ca22d08e2e50dada29379.exe
Token: SeDebugPrivilege	2176	smss.exe
Token: SeDebugPrivilege	520	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	972	powershell.exe
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeDebugPrivilege	584	powershell.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeBackupPrivilege	2940	vssvc.exe
Token: SeRestorePrivilege	2940	vssvc.exe
Token: SeAuditPrivilege	2940	vssvc.exe
Token: SeDebugPrivilege	944	powershell.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 324	1956	b85837ded88ca22d08e2e50dada29379.exe	59
PID 1956 wrote to memory of 324	1956	b85837ded88ca22d08e2e50dada29379.exe	59
PID 1956 wrote to memory of 324	1956	b85837ded88ca22d08e2e50dada29379.exe	59
PID 1956 wrote to memory of 1924	1956	b85837ded88ca22d08e2e50dada29379.exe	60
PID 1956 wrote to memory of 1924	1956	b85837ded88ca22d08e2e50dada29379.exe	60
PID 1956 wrote to memory of 1924	1956	b85837ded88ca22d08e2e50dada29379.exe	60
PID 1956 wrote to memory of 1420	1956	b85837ded88ca22d08e2e50dada29379.exe	61
PID 1956 wrote to memory of 1420	1956	b85837ded88ca22d08e2e50dada29379.exe	61
PID 1956 wrote to memory of 1420	1956	b85837ded88ca22d08e2e50dada29379.exe	61
PID 1956 wrote to memory of 1256	1956	b85837ded88ca22d08e2e50dada29379.exe	63
PID 1956 wrote to memory of 1256	1956	b85837ded88ca22d08e2e50dada29379.exe	63
PID 1956 wrote to memory of 1256	1956	b85837ded88ca22d08e2e50dada29379.exe	63
PID 1956 wrote to memory of 972	1956	b85837ded88ca22d08e2e50dada29379.exe	65
PID 1956 wrote to memory of 972	1956	b85837ded88ca22d08e2e50dada29379.exe	65
PID 1956 wrote to memory of 972	1956	b85837ded88ca22d08e2e50dada29379.exe	65
PID 1956 wrote to memory of 520	1956	b85837ded88ca22d08e2e50dada29379.exe	67
PID 1956 wrote to memory of 520	1956	b85837ded88ca22d08e2e50dada29379.exe	67
PID 1956 wrote to memory of 520	1956	b85837ded88ca22d08e2e50dada29379.exe	67
PID 1956 wrote to memory of 1576	1956	b85837ded88ca22d08e2e50dada29379.exe	69
PID 1956 wrote to memory of 1576	1956	b85837ded88ca22d08e2e50dada29379.exe	69
PID 1956 wrote to memory of 1576	1956	b85837ded88ca22d08e2e50dada29379.exe	69
PID 1956 wrote to memory of 880	1956	b85837ded88ca22d08e2e50dada29379.exe	72
PID 1956 wrote to memory of 880	1956	b85837ded88ca22d08e2e50dada29379.exe	72
PID 1956 wrote to memory of 880	1956	b85837ded88ca22d08e2e50dada29379.exe	72
PID 1956 wrote to memory of 1596	1956	b85837ded88ca22d08e2e50dada29379.exe	74
PID 1956 wrote to memory of 1596	1956	b85837ded88ca22d08e2e50dada29379.exe	74
PID 1956 wrote to memory of 1596	1956	b85837ded88ca22d08e2e50dada29379.exe	74
PID 1956 wrote to memory of 584	1956	b85837ded88ca22d08e2e50dada29379.exe	76
PID 1956 wrote to memory of 584	1956	b85837ded88ca22d08e2e50dada29379.exe	76
PID 1956 wrote to memory of 584	1956	b85837ded88ca22d08e2e50dada29379.exe	76
PID 1956 wrote to memory of 944	1956	b85837ded88ca22d08e2e50dada29379.exe	79
PID 1956 wrote to memory of 944	1956	b85837ded88ca22d08e2e50dada29379.exe	79
PID 1956 wrote to memory of 944	1956	b85837ded88ca22d08e2e50dada29379.exe	79
PID 1956 wrote to memory of 864	1956	b85837ded88ca22d08e2e50dada29379.exe	81
PID 1956 wrote to memory of 864	1956	b85837ded88ca22d08e2e50dada29379.exe	81
PID 1956 wrote to memory of 864	1956	b85837ded88ca22d08e2e50dada29379.exe	81
PID 864 wrote to memory of 2116	864	cmd.exe	83
PID 864 wrote to memory of 2116	864	cmd.exe	83
PID 864 wrote to memory of 2116	864	cmd.exe	83
PID 864 wrote to memory of 2176	864	cmd.exe	84
PID 864 wrote to memory of 2176	864	cmd.exe	84
PID 864 wrote to memory of 2176	864	cmd.exe	84
PID 2176 wrote to memory of 2552	2176	smss.exe	85
PID 2176 wrote to memory of 2552	2176	smss.exe	85
PID 2176 wrote to memory of 2552	2176	smss.exe	85
PID 2176 wrote to memory of 2576	2176	smss.exe	86
PID 2176 wrote to memory of 2576	2176	smss.exe	86
PID 2176 wrote to memory of 2576	2176	smss.exe	86

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b85837ded88ca22d08e2e50dada29379.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b85837ded88ca22d08e2e50dada29379.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b85837ded88ca22d08e2e50dada29379.exe

C:\Users\Admin\AppData\Local\Temp\b85837ded88ca22d08e2e50dada29379.exe
"C:\Users\Admin\AppData\Local\Temp\b85837ded88ca22d08e2e50dada29379.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\b85837ded88ca22d08e2e50dada29379.exe'
  2⤵
  PID:324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\database\dwm.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\dwm.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sppsvc.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\Idle.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\dwm.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\it-IT\lsm.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\explorer.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\WMIADAP.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\WMIADAP.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l07988a5Ko.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2116
- - C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe
    "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2176
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc347e9b-fab6-45c1-a6a1-5cb50383714a.vbs"
      4⤵
      PID:2552
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5e2cf6cd-9737-49e1-a2d7-659f2eac80bd.vbs"
      4⤵
      PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\security\database\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\security\database\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Windows\security\database\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Libraries\WMIADAP.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Users\Public\Libraries\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Libraries\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\WMIADAP.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1160

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe

Filesize
3.8MB

MD5
ad202d1239ed7905e301a5803f3a0225

SHA1
93dd212ff8329259520f48c138de04317bf6a0fb

SHA256
154cbbff20716ec15095e4e0e2bed5112072ef4c32bb0e7bd76f1af9f3e4fac7

SHA512
f25c71e355ec0b4da5192f455873b80201d6cc931dbc339c4056bd9eb7b40e690d77c5cfab009542edb3e4d380afe95edc0320c3f95c22879240fa90b8299dc3

Download Submit
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe

Filesize
3.8MB

MD5
ad202d1239ed7905e301a5803f3a0225

SHA1
93dd212ff8329259520f48c138de04317bf6a0fb

SHA256
154cbbff20716ec15095e4e0e2bed5112072ef4c32bb0e7bd76f1af9f3e4fac7

SHA512
f25c71e355ec0b4da5192f455873b80201d6cc931dbc339c4056bd9eb7b40e690d77c5cfab009542edb3e4d380afe95edc0320c3f95c22879240fa90b8299dc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\5e2cf6cd-9737-49e1-a2d7-659f2eac80bd.vbs

Filesize
523B

MD5
e9f418718dbc383e784d27718a74e683

SHA1
9707594d09e0f39fa4dcf024069170d66007f811

SHA256
cafe514c5b016d3dd0833389373e758db0712236b6fa58d854e74130c248dbe1

SHA512
77ac056e06791352bc3f8f34fe4758babe6070941a09a53e78407d6aafdc968763732c18545b16cbdb015b694504eab6a08057c54e1521c35fc384b5ecfec154

Download Submit
C:\Users\Admin\AppData\Local\Temp\cc347e9b-fab6-45c1-a6a1-5cb50383714a.vbs

Filesize
747B

MD5
e36f7cdb45433d485232d292cc665702

SHA1
3649b474a93d4123f2d7ccb5cdece38f4b5ba117

SHA256
d33c1b2e3b1d0434741f1dce5d21d29ed7c2ca37de58c7465f764e3c53ddacfe

SHA512
2c9529b16529db497d52e640a23eb21121d7ee61b5d7a92c4b9b840df572640bdc3db726b721a890ac955c0d06c28684e5d70540b90aa259185c78f27506492f

Download Submit
C:\Users\Admin\AppData\Local\Temp\l07988a5Ko.bat

Filesize
236B

MD5
7bdf79521d2325576be59e0349fbee6e

SHA1
52cea9b8a88b864457083b88b25ff6e2e16b7d9b

SHA256
ae8f5889d5258e6a61f94dd6754b3beb89bf788c94c09be63be1147c1b60a49d

SHA512
0fde9b69617f2621223b2f378476a898f66a5071ab250508a84335cf916722a70d17a064fc062b346bcc7fd99aa178f0261547bfe06485499f1f9e83f90c4c28

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
34b625303ea12fd2be9f75d1a10a2752

SHA1
532b25161e780a0947338fc72fcc1e469359f0d8

SHA256
ee257fac412a4d4224458fc0ce1dea34e6e4250ff4c3e33a92a796993c904d22

SHA512
262d1e830007658bc8abc66a2eb308363287712def28af38cf16b7f5510c840f094f6d50260fe0aa65f819a0775d0fe524831da4db1494299943ce7a2e071ee2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
34b625303ea12fd2be9f75d1a10a2752

SHA1
532b25161e780a0947338fc72fcc1e469359f0d8

SHA256
ee257fac412a4d4224458fc0ce1dea34e6e4250ff4c3e33a92a796993c904d22

SHA512
262d1e830007658bc8abc66a2eb308363287712def28af38cf16b7f5510c840f094f6d50260fe0aa65f819a0775d0fe524831da4db1494299943ce7a2e071ee2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
34b625303ea12fd2be9f75d1a10a2752

SHA1
532b25161e780a0947338fc72fcc1e469359f0d8

SHA256
ee257fac412a4d4224458fc0ce1dea34e6e4250ff4c3e33a92a796993c904d22

SHA512
262d1e830007658bc8abc66a2eb308363287712def28af38cf16b7f5510c840f094f6d50260fe0aa65f819a0775d0fe524831da4db1494299943ce7a2e071ee2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
34b625303ea12fd2be9f75d1a10a2752

SHA1
532b25161e780a0947338fc72fcc1e469359f0d8

SHA256
ee257fac412a4d4224458fc0ce1dea34e6e4250ff4c3e33a92a796993c904d22

SHA512
262d1e830007658bc8abc66a2eb308363287712def28af38cf16b7f5510c840f094f6d50260fe0aa65f819a0775d0fe524831da4db1494299943ce7a2e071ee2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
34b625303ea12fd2be9f75d1a10a2752

SHA1
532b25161e780a0947338fc72fcc1e469359f0d8

SHA256
ee257fac412a4d4224458fc0ce1dea34e6e4250ff4c3e33a92a796993c904d22

SHA512
262d1e830007658bc8abc66a2eb308363287712def28af38cf16b7f5510c840f094f6d50260fe0aa65f819a0775d0fe524831da4db1494299943ce7a2e071ee2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
34b625303ea12fd2be9f75d1a10a2752

SHA1
532b25161e780a0947338fc72fcc1e469359f0d8

SHA256
ee257fac412a4d4224458fc0ce1dea34e6e4250ff4c3e33a92a796993c904d22

SHA512
262d1e830007658bc8abc66a2eb308363287712def28af38cf16b7f5510c840f094f6d50260fe0aa65f819a0775d0fe524831da4db1494299943ce7a2e071ee2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
34b625303ea12fd2be9f75d1a10a2752

SHA1
532b25161e780a0947338fc72fcc1e469359f0d8

SHA256
ee257fac412a4d4224458fc0ce1dea34e6e4250ff4c3e33a92a796993c904d22

SHA512
262d1e830007658bc8abc66a2eb308363287712def28af38cf16b7f5510c840f094f6d50260fe0aa65f819a0775d0fe524831da4db1494299943ce7a2e071ee2

Download Submit
memory/520-127-0x0000000002444000-0x0000000002447000-memory.dmp

Filesize
12KB

Download
memory/520-145-0x0000000002444000-0x0000000002447000-memory.dmp

Filesize
12KB

Download
memory/520-161-0x000000000244B000-0x000000000246A000-memory.dmp

Filesize
124KB

Download
memory/520-160-0x0000000002444000-0x0000000002447000-memory.dmp

Filesize
12KB

Download
memory/520-120-0x000007FEEB3B0000-0x000007FEEBDD3000-memory.dmp

Filesize
10.1MB

Download
memory/520-142-0x000000001B9A0000-0x000000001BC9F000-memory.dmp

Filesize
3.0MB

Download
memory/520-132-0x000007FEEDE60000-0x000007FEEE9BD000-memory.dmp

Filesize
11.4MB

Download
memory/584-172-0x00000000026D4000-0x00000000026D7000-memory.dmp

Filesize
12KB

Download
memory/584-130-0x000007FEEDE60000-0x000007FEEE9BD000-memory.dmp

Filesize
11.4MB

Download
memory/584-155-0x000000001B7A0000-0x000000001BA9F000-memory.dmp

Filesize
3.0MB

Download
memory/584-144-0x00000000026D4000-0x00000000026D7000-memory.dmp

Filesize
12KB

Download
memory/584-112-0x000007FEEB3B0000-0x000007FEEBDD3000-memory.dmp

Filesize
10.1MB

Download
memory/584-126-0x00000000026D4000-0x00000000026D7000-memory.dmp

Filesize
12KB

Download
memory/584-173-0x00000000026DB000-0x00000000026FA000-memory.dmp

Filesize
124KB

Download
memory/880-174-0x000000000279B000-0x00000000027BA000-memory.dmp

Filesize
124KB

Download
memory/880-146-0x0000000002794000-0x0000000002797000-memory.dmp

Filesize
12KB

Download
memory/880-128-0x0000000002794000-0x0000000002797000-memory.dmp

Filesize
12KB

Download
memory/880-133-0x000007FEEDE60000-0x000007FEEE9BD000-memory.dmp

Filesize
11.4MB

Download
memory/880-176-0x000000000279B000-0x00000000027BA000-memory.dmp

Filesize
124KB

Download
memory/880-175-0x0000000002794000-0x0000000002797000-memory.dmp

Filesize
12KB

Download
memory/944-179-0x000007FEEBBB0000-0x000007FEEC70D000-memory.dmp

Filesize
11.4MB

Download
memory/944-182-0x00000000028CB000-0x00000000028EA000-memory.dmp

Filesize
124KB

Download
memory/944-181-0x00000000028C4000-0x00000000028C7000-memory.dmp

Filesize
12KB

Download
memory/944-180-0x00000000028C4000-0x00000000028C7000-memory.dmp

Filesize
12KB

Download
memory/944-178-0x000007FEEC710000-0x000007FEED133000-memory.dmp

Filesize
10.1MB

Download
memory/972-169-0x00000000024D4000-0x00000000024D7000-memory.dmp

Filesize
12KB

Download
memory/972-167-0x00000000024DB000-0x00000000024FA000-memory.dmp

Filesize
124KB

Download
memory/972-153-0x000000001B950000-0x000000001BC4F000-memory.dmp

Filesize
3.0MB

Download
memory/972-106-0x000007FEEB3B0000-0x000007FEEBDD3000-memory.dmp

Filesize
10.1MB

Download
memory/972-117-0x00000000024D4000-0x00000000024D7000-memory.dmp

Filesize
12KB

Download
memory/1256-140-0x00000000027C4000-0x00000000027C7000-memory.dmp

Filesize
12KB

Download
memory/1256-134-0x000007FEEDE60000-0x000007FEEE9BD000-memory.dmp

Filesize
11.4MB

Download
memory/1256-124-0x00000000027C4000-0x00000000027C7000-memory.dmp

Filesize
12KB

Download
memory/1256-116-0x000007FEEB3B0000-0x000007FEEBDD3000-memory.dmp

Filesize
10.1MB

Download
memory/1256-154-0x000000001B8F0000-0x000000001BBEF000-memory.dmp

Filesize
3.0MB

Download
memory/1256-171-0x00000000027CB000-0x00000000027EA000-memory.dmp

Filesize
124KB

Download
memory/1256-170-0x00000000027C4000-0x00000000027C7000-memory.dmp

Filesize
12KB

Download
memory/1420-123-0x0000000002534000-0x0000000002537000-memory.dmp

Filesize
12KB

Download
memory/1420-99-0x000007FEEB3B0000-0x000007FEEBDD3000-memory.dmp

Filesize
10.1MB

Download
memory/1420-166-0x0000000002534000-0x0000000002537000-memory.dmp

Filesize
12KB

Download
memory/1420-168-0x000000000253B000-0x000000000255A000-memory.dmp

Filesize
124KB

Download
memory/1420-151-0x000000001B750000-0x000000001BA4F000-memory.dmp

Filesize
3.0MB

Download
memory/1420-139-0x0000000002534000-0x0000000002537000-memory.dmp

Filesize
12KB

Download
memory/1420-135-0x000007FEEDE60000-0x000007FEEE9BD000-memory.dmp

Filesize
11.4MB

Download
memory/1576-141-0x000000001B840000-0x000000001BB3F000-memory.dmp

Filesize
3.0MB

Download
memory/1576-159-0x000000000283B000-0x000000000285A000-memory.dmp

Filesize
124KB

Download
memory/1576-104-0x000007FEEB3B0000-0x000007FEEBDD3000-memory.dmp

Filesize
10.1MB

Download
memory/1576-121-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/1576-118-0x000007FEEDE60000-0x000007FEEE9BD000-memory.dmp

Filesize
11.4MB

Download
memory/1576-158-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/1576-137-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/1596-122-0x00000000027A4000-0x00000000027A7000-memory.dmp

Filesize
12KB

Download
memory/1596-138-0x00000000027A4000-0x00000000027A7000-memory.dmp

Filesize
12KB

Download
memory/1596-162-0x00000000027A4000-0x00000000027A7000-memory.dmp

Filesize
12KB

Download
memory/1596-163-0x00000000027AB000-0x00000000027CA000-memory.dmp

Filesize
124KB

Download
memory/1596-131-0x000007FEEDE60000-0x000007FEEE9BD000-memory.dmp

Filesize
11.4MB

Download
memory/1596-152-0x000000001B6E0000-0x000000001B9DF000-memory.dmp

Filesize
3.0MB

Download
memory/1596-105-0x000007FEEB3B0000-0x000007FEEBDD3000-memory.dmp

Filesize
10.1MB

Download
memory/1924-125-0x00000000027A4000-0x00000000027A7000-memory.dmp

Filesize
12KB

Download
memory/1924-157-0x000000001B6F0000-0x000000001B9EF000-memory.dmp

Filesize
3.0MB

Download
memory/1924-114-0x000007FEEB3B0000-0x000007FEEBDD3000-memory.dmp

Filesize
10.1MB

Download
memory/1924-165-0x00000000027AB000-0x00000000027CA000-memory.dmp

Filesize
124KB

Download
memory/1924-136-0x000007FEEDE60000-0x000007FEEE9BD000-memory.dmp

Filesize
11.4MB

Download
memory/1924-86-0x000007FEFC421000-0x000007FEFC423000-memory.dmp

Filesize
8KB

Download
memory/1924-164-0x00000000027A4000-0x00000000027A7000-memory.dmp

Filesize
12KB

Download
memory/1924-143-0x00000000027A4000-0x00000000027A7000-memory.dmp

Filesize
12KB

Download
memory/1956-65-0x0000000002320000-0x0000000002328000-memory.dmp

Filesize
32KB

Download
memory/1956-62-0x00000000008E0000-0x00000000008F2000-memory.dmp

Filesize
72KB

Download
memory/1956-55-0x00000000001C0000-0x00000000001DC000-memory.dmp

Filesize
112KB

Download
memory/1956-73-0x000000001B1C0000-0x000000001B1CA000-memory.dmp

Filesize
40KB

Download
memory/1956-71-0x000000001AEC0000-0x000000001AEC8000-memory.dmp

Filesize
32KB

Download
memory/1956-70-0x000000001A900000-0x000000001A90E000-memory.dmp

Filesize
56KB

Download
memory/1956-56-0x00000000001E0000-0x00000000001E8000-memory.dmp

Filesize
32KB

Download
memory/1956-74-0x000000001B1D0000-0x000000001B1DC000-memory.dmp

Filesize
48KB

Download
memory/1956-57-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1956-69-0x000000001A8F0000-0x000000001A8F8000-memory.dmp

Filesize
32KB

Download
memory/1956-68-0x0000000002350000-0x000000000235E000-memory.dmp

Filesize
56KB

Download
memory/1956-67-0x0000000002340000-0x000000000234A000-memory.dmp

Filesize
40KB

Download
memory/1956-58-0x00000000006D0000-0x00000000006E6000-memory.dmp

Filesize
88KB

Download
memory/1956-59-0x00000000006F0000-0x00000000006FA000-memory.dmp

Filesize
40KB

Download
memory/1956-66-0x0000000002330000-0x0000000002338000-memory.dmp

Filesize
32KB

Download
memory/1956-54-0x0000000000300000-0x00000000006CA000-memory.dmp

Filesize
3.8MB

Download
memory/1956-60-0x0000000000A00000-0x0000000000A56000-memory.dmp

Filesize
344KB

Download
memory/1956-64-0x0000000000A50000-0x0000000000A5C000-memory.dmp

Filesize
48KB

Download
memory/1956-63-0x0000000000970000-0x0000000000978000-memory.dmp

Filesize
32KB

Download
memory/1956-72-0x000000001AED0000-0x000000001AEDC000-memory.dmp

Filesize
48KB

Download
memory/1956-61-0x00000000008D0000-0x00000000008DC000-memory.dmp

Filesize
48KB

Download
memory/2176-113-0x0000000000A00000-0x0000000000DCA000-memory.dmp

Filesize
3.8MB

Download
memory/2176-129-0x00000000009F0000-0x0000000000A02000-memory.dmp

Filesize
72KB

Download