dcrat | 6d95012691b58c36574d4b1061b07e0a8340909664908e991fad91028777fdd1

Resubmissions

12/01/2023, 20:01

230112-yrh6hsae5210

07/01/2023, 04:41

230107-fa3jqagb8t10

07/01/2023, 04:21

230107-eynj2acf8710

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2023, 20:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Size 3.8MB
Sample230112-yrh6hsae52
SHA256 6d95012691b58c36574d4b1061b07e0a8340909664908e991fad91028777fdd1
MD5 0a0a64f3c4fa7d960be983aa0a7d0ce8
SHA1 b597c7397ecaff7c5c1aa27f5124fc7b8a94e643
SHA512 ef04e3eb8f2b10dae6845b97fa66086c3d02c5508adcd1923a93975c88f1ad0f80f984b563c36c4868276670b1dee9e11ae3c57faf7b0509118d121d920df7d4
SSDEEP 98304:F7b3a0t2TiPhx6Sp+ybfnDA4qo34n1oO:FH3Z8cp+gDZ4n1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 23 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		1684	schtasks.exe
		1224	schtasks.exe
		1212	schtasks.exe
		3536	schtasks.exe
		3200	schtasks.exe
		1196	schtasks.exe
		1392	schtasks.exe
		4460	schtasks.exe
		1064	schtasks.exe
		1916	schtasks.exe
		1472	schtasks.exe
		3736	schtasks.exe
		2248	schtasks.exe
		1644	schtasks.exe
		4972	schtasks.exe
		5012	schtasks.exe
		4416	schtasks.exe
		2528	schtasks.exe
		4856	schtasks.exe
		1972	schtasks.exe
		2760	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files\Uninstall Information\27d1bcfc3c54e0		0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Modifies WinLogon for persistence 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\System.exe\", \"C:\\Users\\Public\\AccountPictures\\Registry.exe\", \"C:\\Users\\Default User\\wininit.exe\", \"C:\\Program Files\\Uninstall Information\\explorer.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\System.exe\", \"C:\\Users\\Public\\AccountPictures\\Registry.exe\", \"C:\\Users\\Default User\\wininit.exe\", \"C:\\Program Files\\Uninstall Information\\explorer.exe\", \"C:\\Users\\Default\\Local Settings\\smss.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\System.exe\", \"C:\\Users\\Public\\AccountPictures\\Registry.exe\", \"C:\\Users\\Default User\\wininit.exe\", \"C:\\Program Files\\Uninstall Information\\explorer.exe\", \"C:\\Users\\Default\\Local Settings\\smss.exe\", \"C:\\Users\\Admin\\smss.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\System.exe\", \"C:\\Users\\Public\\AccountPictures\\Registry.exe\", \"C:\\Users\\Default User\\wininit.exe\", \"C:\\Program Files\\Uninstall Information\\explorer.exe\", \"C:\\Users\\Default\\Local Settings\\smss.exe\", \"C:\\Users\\Admin\\smss.exe\", \"C:\\Users\\Admin\\Searches\\lsass.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\System.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\System.exe\", \"C:\\Users\\Public\\AccountPictures\\Registry.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\System.exe\", \"C:\\Users\\Public\\AccountPictures\\Registry.exe\", \"C:\\Users\\Default User\\wininit.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1212	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	1140	schtasks.exe	13
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	1140	schtasks.exe	13

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4316-132-0x0000000000770000-0x0000000000B3A000-memory.dmp	dcrat
behavioral2/files/0x0007000000022dae-153.dat	dcrat
behavioral2/files/0x0007000000022dae-152.dat	dcrat
behavioral2/memory/3092-155-0x00000000004B0000-0x000000000087A000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
3092	System.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	System.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Uninstall Information\\explorer.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Default\\Local Settings\\smss.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Admin\\smss.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Admin\\Searches\\lsass.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Uninstall Information\\System.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Public\\AccountPictures\\Registry.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default User\\wininit.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Admin\\smss.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Admin\\Searches\\lsass.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Uninstall Information\\System.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Public\\AccountPictures\\Registry.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default User\\wininit.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Uninstall Information\\explorer.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Default\\Local Settings\\smss.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
26	ipinfo.io
27	ipinfo.io

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\System.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files\Uninstall Information\System.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files\Uninstall Information\27d1bcfc3c54e0	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files\Uninstall Information\7a0fd90576e088	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files\Uninstall Information\RCX6AA8.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files\Uninstall Information\RCX7424.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files\Uninstall Information\explorer.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File created	C:\Program Files\Uninstall Information\explorer.exe	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files\Uninstall Information\RCX6A0B.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
File opened for modification	C:\Program Files\Uninstall Information\RCX7387.tmp	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1196	schtasks.exe
2528	schtasks.exe
3736	schtasks.exe
4460	schtasks.exe
1644	schtasks.exe
3536	schtasks.exe
4972	schtasks.exe
1972	schtasks.exe
5012	schtasks.exe
3200	schtasks.exe
1472	schtasks.exe
1392	schtasks.exe
2248	schtasks.exe
1064	schtasks.exe
2760	schtasks.exe
4416	schtasks.exe
1916	schtasks.exe
1684	schtasks.exe
1224	schtasks.exe
4856	schtasks.exe
1212	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	System.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
260	powershell.exe
224	powershell.exe
1932	powershell.exe
3688	powershell.exe
212	powershell.exe
3964	powershell.exe
3780	powershell.exe
4156	powershell.exe
4156	powershell.exe
1932	powershell.exe
1932	powershell.exe
212	powershell.exe
212	powershell.exe
260	powershell.exe
260	powershell.exe
224	powershell.exe
224	powershell.exe
3964	powershell.exe
3964	powershell.exe
3688	powershell.exe
3688	powershell.exe
3780	powershell.exe
3780	powershell.exe
4156	powershell.exe
3092	System.exe
3092	System.exe
3092	System.exe
3092	System.exe
3092	System.exe
3092	System.exe
3092	System.exe
3092	System.exe
3092	System.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3092	System.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Token: SeDebugPrivilege	260	powershell.exe
Token: SeDebugPrivilege	224	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	3688	powershell.exe
Token: SeDebugPrivilege	212	powershell.exe
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeDebugPrivilege	3780	powershell.exe
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeDebugPrivilege	3092	System.exe
Token: SeBackupPrivilege	3280	vssvc.exe
Token: SeRestorePrivilege	3280	vssvc.exe
Token: SeAuditPrivilege	3280	vssvc.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 260	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	101
PID 4316 wrote to memory of 260	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	101
PID 4316 wrote to memory of 212	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	103
PID 4316 wrote to memory of 212	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	103
PID 4316 wrote to memory of 224	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	105
PID 4316 wrote to memory of 224	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	105
PID 4316 wrote to memory of 1932	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	107
PID 4316 wrote to memory of 1932	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	107
PID 4316 wrote to memory of 3688	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	108
PID 4316 wrote to memory of 3688	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	108
PID 4316 wrote to memory of 3964	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	110
PID 4316 wrote to memory of 3964	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	110
PID 4316 wrote to memory of 3780	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	111
PID 4316 wrote to memory of 3780	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	111
PID 4316 wrote to memory of 4156	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	114
PID 4316 wrote to memory of 4156	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	114
PID 4316 wrote to memory of 3092	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	117
PID 4316 wrote to memory of 3092	4316	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	117
PID 3092 wrote to memory of 4668	3092	System.exe	119
PID 3092 wrote to memory of 4668	3092	System.exe	119
PID 3092 wrote to memory of 1712	3092	System.exe	120
PID 3092 wrote to memory of 1712	3092	System.exe	120

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
"C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\System.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\Registry.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\wininit.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\explorer.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Local Settings\smss.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\smss.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Searches\lsass.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4156
- C:\Program Files\Uninstall Information\System.exe
  "C:\Program Files\Uninstall Information\System.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3092
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\453d52b7-942c-45b2-92b8-4ec4d3e64db0.vbs"
    3⤵
    PID:4668
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ba3150a8-e2f4-46a1-9023-aad34c8cfd05.vbs"
    3⤵
    PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\AccountPictures\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Users\Public\AccountPictures\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Local Settings\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\Local Settings\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Local Settings\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Admin\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Searches\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\Searches\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Searches\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2760

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.exe

Path C:\Program Files\Uninstall Information\System.exe
Size 3.8MB
SHA256 c8e5d3077b9f0e1dac0a5c89fa8cf80cbb29d478516793f161cfb0b80de4a565
MD5 e128ebfa9ef32b6a105535f3618f7d49
SHA1 410d347537ef1797ed8098525418a6611b7a6378
SHA512 f0557eec178748412ebb2b5fd2053868f32c2aba11602f719c05dd998203a0815f4b8b3599b1f4d3d2ba79fa7bf059fc70cd412435e8b9f8c4b2c4975bbdd9c7
SSDEEP 98304:V7b3a0t2TiPhx6Sp+ybfnDA4qo34n1oO:VH3Z8cp+gDZ4n1
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.exe

Path C:\Program Files\Uninstall Information\System.exe
Size 3.8MB
SHA256 c8e5d3077b9f0e1dac0a5c89fa8cf80cbb29d478516793f161cfb0b80de4a565
MD5 e128ebfa9ef32b6a105535f3618f7d49
SHA1 410d347537ef1797ed8098525418a6611b7a6378
SHA512 f0557eec178748412ebb2b5fd2053868f32c2aba11602f719c05dd998203a0815f4b8b3599b1f4d3d2ba79fa7bf059fc70cd412435e8b9f8c4b2c4975bbdd9c7
SSDEEP 98304:V7b3a0t2TiPhx6Sp+ybfnDA4qo34n1oO:VH3Z8cp+gDZ4n1
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download