dcrat | 6d95012691b58c36574d4b1061b07e0a8340909664908e991fad91028777fdd1

Resubmissions

12-01-2023 20:01

230112-yrh6hsae52 10

07-01-2023 04:41

230107-fa3jqagb8t 10

07-01-2023 04:21

230107-eynj2acf87 10

Analysis

max time kernel
59s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2023 04:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Size

3.8MB
MD5

0a0a64f3c4fa7d960be983aa0a7d0ce8
SHA1

b597c7397ecaff7c5c1aa27f5124fc7b8a94e643
SHA256

6d95012691b58c36574d4b1061b07e0a8340909664908e991fad91028777fdd1
SHA512

ef04e3eb8f2b10dae6845b97fa66086c3d02c5508adcd1923a93975c88f1ad0f80f984b563c36c4868276670b1dee9e11ae3c57faf7b0509118d121d920df7d4
SSDEEP

98304:F7b3a0t2TiPhx6Sp+ybfnDA4qo34n1oO:FH3Z8cp+gDZ4n1

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 25 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe0a0a64f3c4fa7d960be983aa0a7d0ce8.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4788	schtasks.exe
816	schtasks.exe
2112	schtasks.exe
3032	schtasks.exe
2640	schtasks.exe
1304	schtasks.exe
1308	schtasks.exe
3512	schtasks.exe
2536	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
4968	schtasks.exe
2980	schtasks.exe
2340	schtasks.exe
1356	schtasks.exe
1688	schtasks.exe
4924	schtasks.exe
3028	schtasks.exe
4916	schtasks.exe
32	schtasks.exe
4904	schtasks.exe
364	schtasks.exe
3268	schtasks.exe
1380	schtasks.exe
2628	schtasks.exe
1312	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Adobe\\Setup\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\SIHClient.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\locale\\cgg\\LC_MESSAGES\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\SIHClient.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\dwm.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\OfficeClickToRun.exe\", \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\spoolsv.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Adobe\\Setup\\Registry.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Adobe\\Setup\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\SIHClient.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Adobe\\Setup\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\SIHClient.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\locale\\cgg\\LC_MESSAGES\\csrss.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Adobe\\Setup\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\SIHClient.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\locale\\cgg\\LC_MESSAGES\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\SIHClient.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Adobe\\Setup\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\SIHClient.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\locale\\cgg\\LC_MESSAGES\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\SIHClient.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\winlogon.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Adobe\\Setup\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\SIHClient.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\locale\\cgg\\LC_MESSAGES\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\SIHClient.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\dwm.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Adobe\\Setup\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\SIHClient.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\locale\\cgg\\LC_MESSAGES\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\SIHClient.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\dwm.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\OfficeClickToRun.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	364	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2720	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	32	2720	schtasks.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

dwm.exe0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral3/memory/2700-132-0x0000000000180000-0x000000000054A000-memory.dmp	dcrat
C:\Program Files (x86)\Windows Media Player\dwm.exe	dcrat
C:\Program Files (x86)\Windows Media Player\dwm.exe	dcrat
behavioral3/memory/1768-180-0x0000000000950000-0x0000000000D1A000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

Processes:

dwm.exe

pid process

1768 dwm.exe

pid	process
1768	dwm.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exedwm.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	dwm.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\VideoLAN\\VLC\\locale\\cgg\\LC_MESSAGES\\csrss.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\winlogon.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\OfficeClickToRun.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\OfficeClickToRun.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\spoolsv.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\All Users\\Adobe\\Setup\\Registry.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SIHClient = "\"C:\\Program Files (x86)\\Windows Portable Devices\\SIHClient.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\winlogon.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Media Player\\dwm.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SIHClient = "\"C:\\Recovery\\WindowsRE\\SIHClient.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SIHClient = "\"C:\\Recovery\\WindowsRE\\SIHClient.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Media Player\\dwm.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\spoolsv.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\All Users\\Adobe\\Setup\\Registry.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\VideoLAN\\VLC\\locale\\cgg\\LC_MESSAGES\\csrss.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SIHClient = "\"C:\\Program Files (x86)\\Windows Portable Devices\\SIHClient.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exedwm.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

45 ipinfo.io
46 ipinfo.io

flow	ioc
45	ipinfo.io
46	ipinfo.io

Drops file in Program Files directory 25 IoCs

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\SIGNUP\OfficeClickToRun.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files (x86)\Windows Portable Devices\7b3bf1de107bcf	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files (x86)\Windows Media Player\6cb0b6c459d5d3	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX9568.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\886983d96e3d3e	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX94EA.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\OfficeClickToRun.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\e6c9b481da804f	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\RCX91CB.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX97F9.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\dwm.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files (x86)\Windows Portable Devices\SIHClient.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\cc11b995f2a76d	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files (x86)\Windows Media Player\dwm.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\SIGNUP\RCX9F03.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\SIHClient.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX9877.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\RCX9B08.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\RCX9B96.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\SIGNUP\RCX9E27.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\csrss.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\RCX9259.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\csrss.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Drops file in Windows directory 5 IoCs

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

description	ioc	process
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\spoolsv.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\f3b6ecef712a24	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\RCXA1A4.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\RCXA241.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\spoolsv.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
1304	schtasks.exe
816	schtasks.exe
2112	schtasks.exe
4924	schtasks.exe
3028	schtasks.exe
1308	schtasks.exe
2628	schtasks.exe
4904	schtasks.exe
4968	schtasks.exe
364	schtasks.exe
2980	schtasks.exe
1380	schtasks.exe
3032	schtasks.exe
1312	schtasks.exe
32	schtasks.exe
1356	schtasks.exe
2640	schtasks.exe
3512	schtasks.exe
2536	schtasks.exe
1688	schtasks.exe
3268	schtasks.exe
2340	schtasks.exe
4916	schtasks.exe
4788	schtasks.exe

Modifies registry class 2 IoCs

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exedwm.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	dwm.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedwm.exe

pid	process
2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
3476	powershell.exe
3476	powershell.exe
2960	powershell.exe
2960	powershell.exe
1196	powershell.exe
1196	powershell.exe
1652	powershell.exe
1652	powershell.exe
4588	powershell.exe
4588	powershell.exe
4276	powershell.exe
4276	powershell.exe
2588	powershell.exe
2588	powershell.exe
2208	powershell.exe
2208	powershell.exe
5096	powershell.exe
5096	powershell.exe
3476	powershell.exe
3476	powershell.exe
2960	powershell.exe
2960	powershell.exe
1196	powershell.exe
4276	powershell.exe
2208	powershell.exe
1652	powershell.exe
2588	powershell.exe
4588	powershell.exe
5096	powershell.exe
1768	dwm.exe
1768	dwm.exe
1768	dwm.exe
1768	dwm.exe
1768	dwm.exe
1768	dwm.exe
1768	dwm.exe
1768	dwm.exe
1768	dwm.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedwm.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	4588	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	1768	dwm.exe
Token: SeBackupPrivilege	1556	vssvc.exe
Token: SeRestorePrivilege	1556	vssvc.exe
Token: SeAuditPrivilege	1556	vssvc.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.execmd.exedwm.exe

description	pid	process	target process
PID 2700 wrote to memory of 3476	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 3476	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 2960	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 2960	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 4588	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 4588	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 1652	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 1652	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 1196	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 1196	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 2588	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 2588	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 5096	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 5096	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 4276	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 4276	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 2208	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 2208	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 2700 wrote to memory of 2196	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	cmd.exe
PID 2700 wrote to memory of 2196	2700	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	cmd.exe
PID 2196 wrote to memory of 4916	2196	cmd.exe	w32tm.exe
PID 2196 wrote to memory of 4916	2196	cmd.exe	w32tm.exe
PID 2196 wrote to memory of 1768	2196	cmd.exe	dwm.exe
PID 2196 wrote to memory of 1768	2196	cmd.exe	dwm.exe
PID 1768 wrote to memory of 1300	1768	dwm.exe	WScript.exe
PID 1768 wrote to memory of 1300	1768	dwm.exe	WScript.exe
PID 1768 wrote to memory of 2700	1768	dwm.exe	WScript.exe
PID 1768 wrote to memory of 2700	1768	dwm.exe	WScript.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exedwm.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe

C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
"C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2700

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Adobe\Setup\Registry.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SIHClient.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\SIHClient.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\csrss.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\spoolsv.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\SIGNUP\OfficeClickToRun.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4276

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\dwm.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XJgX3joyyg.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
3⤵
PID:4916

C:\Program Files (x86)\Windows Media Player\dwm.exe
"C:\Program Files (x86)\Windows Media Player\dwm.exe"
3⤵
- UAC bypass
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1768

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\18b95992-22dc-41dd-8aaf-812ca227ed56.vbs"
4⤵
PID:1300

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67fe6794-ea3f-4bf5-9c76-d2589a8d02d7.vbs"
4⤵
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Adobe\Setup\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Setup\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Adobe\Setup\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SIHClient.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClient" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SIHClient.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SIHClient.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\SIHClient.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClient" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\SIHClient.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\SIHClient.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:32

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Media Player\dwm.exe

Filesize
3.8MB

MD5
1ba71683ca2b077c31c086fb9ec1be0c

SHA1
80e166b6a9df8d6347cbfa535d253a981185144e

SHA256
31506cfef39e936206adaf2b95c8cbead6863c344d818bd458697b26bc59cc31

SHA512
1b2745db8d2ccd4924876c4f6d66b0986d32b27308d3fa37b36f85dc2043956f2114ff1d4d8c3981ae53621bedf241c20721ea71a08155126522ff28caa17677

Download Submit
C:\Program Files (x86)\Windows Media Player\dwm.exe

Filesize
3.8MB

MD5
1ba71683ca2b077c31c086fb9ec1be0c

SHA1
80e166b6a9df8d6347cbfa535d253a981185144e

SHA256
31506cfef39e936206adaf2b95c8cbead6863c344d818bd458697b26bc59cc31

SHA512
1b2745db8d2ccd4924876c4f6d66b0986d32b27308d3fa37b36f85dc2043956f2114ff1d4d8c3981ae53621bedf241c20721ea71a08155126522ff28caa17677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\18b95992-22dc-41dd-8aaf-812ca227ed56.vbs

Filesize
727B

MD5
2cfe830c91f32a54876fdc449641db59

SHA1
6a14c1d46bef656ffb523adad934f0f928b81bd5

SHA256
d16c80cd8389a723a278f8219ab9ea3c328e7dab5ee4f93955e3e2ba825adf0a

SHA512
28b36b820889899c7da9bfa78dcf188b33534385405e6a742e27b4ab4a151def5bec00711ac536e1f92454f3a90a120e78111030a3496c515a1050c7eb9d246d

Download Submit
C:\Users\Admin\AppData\Local\Temp\67fe6794-ea3f-4bf5-9c76-d2589a8d02d7.vbs

Filesize
503B

MD5
eccc3ca55e786ac5611f63a1fdc53bf0

SHA1
445f6b013b361639e21c1a04d649e5d1e4d830a1

SHA256
f0c9e34ec34c3eb6b792247173063cae0fc9dfc0c90664ddfff66167d3822ae6

SHA512
d4c9edb27f39d31424679d074675b96b9c45139e1f35cffcdf9e4767b603d1bf2eb2c14ec9aca85c1c6e5fe3ad5fc74ce18ab3b627cba5ba64157689c1a63e94

Download Submit
C:\Users\Admin\AppData\Local\Temp\XJgX3joyyg.bat

Filesize
216B

MD5
65b49ea0066bb3006c0d2688d0a40749

SHA1
d2923af05e2bb2dfb6fe5fb1461ecadcfacc3ee7

SHA256
9aa1c13e9ea87e9139010d647ff1adce4dca690088640c6695fe387e9bc64549

SHA512
3c47f8df39ca9aa38d3a611fb15122061ec38342da55dcb68a4a383143614837d42a05de0d2f9d1ca85762b3d9b6650e1111c38d11af0cf4804e3b19b7c3152c

Download Submit
memory/1196-152-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/1196-140-0x0000000000000000-mapping.dmp

Download
memory/1196-166-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/1300-182-0x0000000000000000-mapping.dmp

Download
memory/1652-169-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/1652-139-0x0000000000000000-mapping.dmp

Download
memory/1652-150-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/1768-181-0x00007FF99EAE0000-0x00007FF99F5A1000-memory.dmp

Filesize
10.8MB

Download
memory/1768-187-0x000000001E490000-0x000000001E652000-memory.dmp

Filesize
1.8MB

Download
memory/1768-186-0x00007FF99EAE0000-0x00007FF99F5A1000-memory.dmp

Filesize
10.8MB

Download
memory/1768-180-0x0000000000950000-0x0000000000D1A000-memory.dmp

Filesize
3.8MB

Download
memory/1768-177-0x0000000000000000-mapping.dmp

Download
memory/2196-146-0x0000000000000000-mapping.dmp

Download
memory/2208-157-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/2208-170-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/2208-144-0x0000000000000000-mapping.dmp

Download
memory/2588-141-0x0000000000000000-mapping.dmp

Download
memory/2588-172-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/2588-153-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/2700-133-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/2700-147-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/2700-132-0x0000000000180000-0x000000000054A000-memory.dmp

Filesize
3.8MB

Download
memory/2700-135-0x000000001C880000-0x000000001CDA8000-memory.dmp

Filesize
5.2MB

Download
memory/2700-184-0x0000000000000000-mapping.dmp

Download
memory/2700-134-0x0000000002750000-0x00000000027A0000-memory.dmp

Filesize
320KB

Download
memory/2960-137-0x0000000000000000-mapping.dmp

Download
memory/2960-168-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/2960-149-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/3476-145-0x000001A136720000-0x000001A136742000-memory.dmp

Filesize
136KB

Download
memory/3476-136-0x0000000000000000-mapping.dmp

Download
memory/3476-148-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/3476-159-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/4276-155-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/4276-143-0x0000000000000000-mapping.dmp

Download
memory/4276-171-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/4588-138-0x0000000000000000-mapping.dmp

Download
memory/4588-151-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/4588-174-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/4916-158-0x0000000000000000-mapping.dmp

Download
memory/5096-156-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download
memory/5096-142-0x0000000000000000-mapping.dmp

Download
memory/5096-176-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp

Filesize
10.8MB

Download