Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
19-01-2023 04:06
Behavioral task
behavioral1
Sample
3d454a64e7f14ab734752a9414f8cbd0.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3d454a64e7f14ab734752a9414f8cbd0.exe
Resource
win10v2004-20221111-en
General
-
Target
3d454a64e7f14ab734752a9414f8cbd0.exe
-
Size
2.5MB
-
MD5
3d454a64e7f14ab734752a9414f8cbd0
-
SHA1
a239dccbba74d4d17fae19552e122043f9501b2d
-
SHA256
286acc4048494eecfb642fa7c95f459551c0fa3f7d2d117c8792cb6a1b3ab33d
-
SHA512
4cfb9e4005fd18c3d9b0805c64fd34627c7090e8945fd7aa8fc0ba91babe6840a660245547b8971467416c629ad28e4362298520dbe9efdb734c310ff3ed0f77
-
SSDEEP
49152:iSg8kOqBMdDhtQM4I+MkmJm9LcBwQYdXQ4J:9fkOqGhhtn9+nmJm9LcBCXvJ
Malware Config
Signatures
-
DcRat 38 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Processes:
schtasks.exeschtasks.exe3d454a64e7f14ab734752a9414f8cbd0.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1760 schtasks.exe 4788 schtasks.exe File created C:\Windows\Registration\CRMLog\27d1bcfc3c54e0 3d454a64e7f14ab734752a9414f8cbd0.exe 2120 schtasks.exe 1816 schtasks.exe 3860 schtasks.exe 1872 schtasks.exe 1696 schtasks.exe 1512 schtasks.exe 1276 schtasks.exe 3896 schtasks.exe 4412 schtasks.exe 2696 schtasks.exe 2192 schtasks.exe 4156 schtasks.exe 4184 schtasks.exe 2668 schtasks.exe 2852 schtasks.exe 4328 schtasks.exe 5100 schtasks.exe 4732 schtasks.exe 2196 schtasks.exe 4268 schtasks.exe 3440 schtasks.exe 3856 schtasks.exe 3628 schtasks.exe File created C:\Windows\Registration\CRMLog\System.exe 3d454a64e7f14ab734752a9414f8cbd0.exe 3104 schtasks.exe 1620 schtasks.exe 3192 schtasks.exe 3060 schtasks.exe 3436 schtasks.exe 4004 schtasks.exe 2152 schtasks.exe 2536 schtasks.exe 4336 schtasks.exe 2524 schtasks.exe 1972 schtasks.exe -
Modifies WinLogon for persistence 2 TTPs 12 IoCs
Processes:
3d454a64e7f14ab734752a9414f8cbd0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\sihost.exe\", \"C:\\Users\\All Users\\spoolsv.exe\", \"C:\\odt\\spoolsv.exe\", \"C:\\odt\\taskhostw.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\sihost.exe\", \"C:\\Users\\All Users\\spoolsv.exe\", \"C:\\odt\\spoolsv.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\odt\\wininit.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\sihost.exe\", \"C:\\Users\\All Users\\spoolsv.exe\", \"C:\\odt\\spoolsv.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\odt\\wininit.exe\", \"C:\\Users\\Admin\\Saved Games\\services.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\odt\\SppExtComObj.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\sihost.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\sihost.exe\", \"C:\\Users\\All Users\\spoolsv.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\sihost.exe\", \"C:\\Users\\All Users\\spoolsv.exe\", \"C:\\odt\\spoolsv.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\sihost.exe\", \"C:\\Users\\All Users\\spoolsv.exe\", \"C:\\odt\\spoolsv.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\odt\\csrss.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\sihost.exe\", \"C:\\Users\\All Users\\spoolsv.exe\", \"C:\\odt\\spoolsv.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Registration\\CRMLog\\System.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe -
Process spawned unexpected child process 36 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4184 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2152 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1696 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4336 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3104 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2668 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1512 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2120 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1816 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1620 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1276 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4268 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2852 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3860 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3060 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3440 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3192 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3436 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4328 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3896 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3856 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4412 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5100 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2524 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2536 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2696 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1972 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4004 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2192 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4156 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4732 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1872 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2196 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1760 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3628 1260 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4788 1260 schtasks.exe -
Processes:
resource yara_rule behavioral2/memory/4476-132-0x0000000000D20000-0x0000000000FAE000-memory.dmp dcrat C:\Program Files\Windows Photo Viewer\csrss.exe dcrat C:\Program Files\Windows Photo Viewer\csrss.exe dcrat behavioral2/memory/1944-163-0x0000000000FE0000-0x000000000126E000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 1944 csrss.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3d454a64e7f14ab734752a9414f8cbd0.execsrss.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 3d454a64e7f14ab734752a9414f8cbd0.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation csrss.exe -
Adds Run key to start application 2 TTPs 24 IoCs
Processes:
3d454a64e7f14ab734752a9414f8cbd0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\Registration\\CRMLog\\System.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\odt\\SppExtComObj.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\odt\\spoolsv.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\Registration\\CRMLog\\System.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\odt\\SppExtComObj.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\odt\\sihost.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\odt\\taskhostw.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\odt\\wininit.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Admin\\Saved Games\\services.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\odt\\wininit.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\odt\\sihost.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\All Users\\spoolsv.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\odt\\spoolsv.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\odt\\taskhostw.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\odt\\csrss.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\odt\\csrss.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows Photo Viewer\\csrss.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\WindowsRE\\lsass.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\WindowsRE\\lsass.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\All Users\\spoolsv.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Admin\\Saved Games\\services.exe\"" 3d454a64e7f14ab734752a9414f8cbd0.exe -
Drops file in Program Files directory 5 IoCs
Processes:
3d454a64e7f14ab734752a9414f8cbd0.exedescription ioc process File opened for modification C:\Program Files\Windows Photo Viewer\csrss.exe 3d454a64e7f14ab734752a9414f8cbd0.exe File created C:\Program Files\Windows Photo Viewer\csrss.exe 3d454a64e7f14ab734752a9414f8cbd0.exe File created C:\Program Files\Windows Photo Viewer\886983d96e3d3e 3d454a64e7f14ab734752a9414f8cbd0.exe File opened for modification C:\Program Files\Windows Photo Viewer\RCXA7B2.tmp 3d454a64e7f14ab734752a9414f8cbd0.exe File opened for modification C:\Program Files\Windows Photo Viewer\RCXAC86.tmp 3d454a64e7f14ab734752a9414f8cbd0.exe -
Drops file in Windows directory 5 IoCs
Processes:
3d454a64e7f14ab734752a9414f8cbd0.exedescription ioc process File created C:\Windows\Registration\CRMLog\System.exe 3d454a64e7f14ab734752a9414f8cbd0.exe File opened for modification C:\Windows\Registration\CRMLog\System.exe 3d454a64e7f14ab734752a9414f8cbd0.exe File created C:\Windows\Registration\CRMLog\27d1bcfc3c54e0 3d454a64e7f14ab734752a9414f8cbd0.exe File opened for modification C:\Windows\Registration\CRMLog\RCX988D.tmp 3d454a64e7f14ab734752a9414f8cbd0.exe File opened for modification C:\Windows\Registration\CRMLog\RCX9BF9.tmp 3d454a64e7f14ab734752a9414f8cbd0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 36 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2536 schtasks.exe 2192 schtasks.exe 1512 schtasks.exe 3440 schtasks.exe 4328 schtasks.exe 3896 schtasks.exe 1620 schtasks.exe 2696 schtasks.exe 1816 schtasks.exe 1276 schtasks.exe 3060 schtasks.exe 3856 schtasks.exe 4184 schtasks.exe 4336 schtasks.exe 3104 schtasks.exe 2120 schtasks.exe 1760 schtasks.exe 2152 schtasks.exe 4156 schtasks.exe 3628 schtasks.exe 4788 schtasks.exe 1696 schtasks.exe 4412 schtasks.exe 4732 schtasks.exe 2196 schtasks.exe 3192 schtasks.exe 4004 schtasks.exe 2668 schtasks.exe 2852 schtasks.exe 3860 schtasks.exe 1872 schtasks.exe 1972 schtasks.exe 4268 schtasks.exe 3436 schtasks.exe 5100 schtasks.exe 2524 schtasks.exe -
Modifies registry class 2 IoCs
Processes:
3d454a64e7f14ab734752a9414f8cbd0.execsrss.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 3d454a64e7f14ab734752a9414f8cbd0.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings csrss.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
3d454a64e7f14ab734752a9414f8cbd0.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exepid process 4476 3d454a64e7f14ab734752a9414f8cbd0.exe 4476 3d454a64e7f14ab734752a9414f8cbd0.exe 4476 3d454a64e7f14ab734752a9414f8cbd0.exe 4476 3d454a64e7f14ab734752a9414f8cbd0.exe 4476 3d454a64e7f14ab734752a9414f8cbd0.exe 4476 3d454a64e7f14ab734752a9414f8cbd0.exe 4476 3d454a64e7f14ab734752a9414f8cbd0.exe 4476 3d454a64e7f14ab734752a9414f8cbd0.exe 4476 3d454a64e7f14ab734752a9414f8cbd0.exe 5080 powershell.exe 5080 powershell.exe 2756 powershell.exe 2756 powershell.exe 4632 powershell.exe 4632 powershell.exe 4592 powershell.exe 4592 powershell.exe 4228 powershell.exe 4228 powershell.exe 4880 powershell.exe 4880 powershell.exe 4708 powershell.exe 4708 powershell.exe 3596 powershell.exe 3596 powershell.exe 3048 powershell.exe 3048 powershell.exe 60 powershell.exe 60 powershell.exe 1696 powershell.exe 1696 powershell.exe 5080 powershell.exe 5080 powershell.exe 4592 powershell.exe 4592 powershell.exe 2756 powershell.exe 2756 powershell.exe 4632 powershell.exe 4632 powershell.exe 4228 powershell.exe 3596 powershell.exe 4880 powershell.exe 4708 powershell.exe 60 powershell.exe 3048 powershell.exe 1696 powershell.exe 1944 csrss.exe 1944 csrss.exe 1944 csrss.exe 1944 csrss.exe 1944 csrss.exe 1944 csrss.exe 1944 csrss.exe 1944 csrss.exe 1944 csrss.exe 1944 csrss.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
csrss.exepid process 1944 csrss.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
3d454a64e7f14ab734752a9414f8cbd0.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exedescription pid process Token: SeDebugPrivilege 4476 3d454a64e7f14ab734752a9414f8cbd0.exe Token: SeDebugPrivilege 5080 powershell.exe Token: SeDebugPrivilege 2756 powershell.exe Token: SeDebugPrivilege 4632 powershell.exe Token: SeDebugPrivilege 4592 powershell.exe Token: SeDebugPrivilege 4228 powershell.exe Token: SeDebugPrivilege 4880 powershell.exe Token: SeDebugPrivilege 4708 powershell.exe Token: SeDebugPrivilege 3596 powershell.exe Token: SeDebugPrivilege 3048 powershell.exe Token: SeDebugPrivilege 60 powershell.exe Token: SeDebugPrivilege 1696 powershell.exe Token: SeDebugPrivilege 1944 csrss.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
3d454a64e7f14ab734752a9414f8cbd0.execsrss.exedescription pid process target process PID 4476 wrote to memory of 5080 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 5080 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 4632 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 4632 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 4880 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 4880 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 2756 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 2756 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 4228 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 4228 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 4708 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 4708 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 4592 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 4592 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 3596 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 3596 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 3048 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 3048 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 60 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 60 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 3168 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 3168 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 1696 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 1696 4476 3d454a64e7f14ab734752a9414f8cbd0.exe powershell.exe PID 4476 wrote to memory of 1944 4476 3d454a64e7f14ab734752a9414f8cbd0.exe csrss.exe PID 4476 wrote to memory of 1944 4476 3d454a64e7f14ab734752a9414f8cbd0.exe csrss.exe PID 1944 wrote to memory of 4232 1944 csrss.exe WScript.exe PID 1944 wrote to memory of 4232 1944 csrss.exe WScript.exe PID 1944 wrote to memory of 3036 1944 csrss.exe WScript.exe PID 1944 wrote to memory of 3036 1944 csrss.exe WScript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d454a64e7f14ab734752a9414f8cbd0.exe"C:\Users\Admin\AppData\Local\Temp\3d454a64e7f14ab734752a9414f8cbd0.exe"1⤵
- DcRat
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Windows Photo Viewer\csrss.exe"C:\Program Files\Windows Photo Viewer\csrss.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08d753b6-7335-4895-b6d7-e34190c54518.vbs"3⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26a721e9-d492-4675-abaa-88a2629d1e8b.vbs"3⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\Registration\CRMLog\System.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Windows\Registration\CRMLog\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\odt\SppExtComObj.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\odt\sihost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\spoolsv.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\spoolsv.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\spoolsv.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\odt\spoolsv.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\odt\taskhostw.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\odt\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\odt\wininit.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Saved Games\services.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Saved Games\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Windows Photo Viewer\csrss.exeFilesize
2.5MB
MD578ffb5e93e36f6a32bdba7a188d17cec
SHA18d2bbb42bfcd1172b3c34ac8cd102772acad0dc5
SHA256b7aa42acc94bd6031b13c09c0543ba746e0bcfb6277273fdcf20f76c01d201a1
SHA512d05f23e09550cee48d7711133cfe63bb6af4089b66197f6bd7743db04bc88f1267593fb4d52ae182a65aa7c92f80c1cf287fd730c07135ada8fb61ab00ab03e5
-
C:\Program Files\Windows Photo Viewer\csrss.exeFilesize
2.5MB
MD578ffb5e93e36f6a32bdba7a188d17cec
SHA18d2bbb42bfcd1172b3c34ac8cd102772acad0dc5
SHA256b7aa42acc94bd6031b13c09c0543ba746e0bcfb6277273fdcf20f76c01d201a1
SHA512d05f23e09550cee48d7711133cfe63bb6af4089b66197f6bd7743db04bc88f1267593fb4d52ae182a65aa7c92f80c1cf287fd730c07135ada8fb61ab00ab03e5
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Temp\08d753b6-7335-4895-b6d7-e34190c54518.vbsFilesize
723B
MD53df076e507aa83c232d4aafa89e3bd16
SHA1c6d519736685cc6601c44f79826fdd5a76f29fba
SHA256f4eabb91768744fce2c33ac4f62cb3251930184826217f3e18ae822b16503a10
SHA512a2d47714da3229ceba6b404abb725ac184ee9b90fa75c2467f5fa70078cd65d2790d6da92fff73ef343382a10590eb1e0d8524bc4ebb0829831a77def1f1fb40
-
C:\Users\Admin\AppData\Local\Temp\26a721e9-d492-4675-abaa-88a2629d1e8b.vbsFilesize
499B
MD5dcadcccdc5c1b6dc13383adf20ca0c99
SHA1124927dfe44e571ffb4b4acf502d15bdedc1aa8e
SHA256a7beb971ec2be423545a46133459fd6ec429a0686d0d870ca4d30c2b3ede08d4
SHA51263c558f88fac0eebb1b0ba8cb51d0a33feec390b9523b5544b1455a83d3617b12cc81b430d814a56af81a0f6fcd7f37d33313d73ec28411ae9fdaa24b22b7218
-
memory/60-183-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/60-146-0x0000000000000000-mapping.dmp
-
memory/60-162-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/1696-148-0x0000000000000000-mapping.dmp
-
memory/1696-185-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/1696-164-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/1944-193-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/1944-163-0x0000000000FE0000-0x000000000126E000-memory.dmpFilesize
2.6MB
-
memory/1944-158-0x0000000000000000-mapping.dmp
-
memory/1944-175-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/2756-170-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/2756-140-0x0000000000000000-mapping.dmp
-
memory/2756-153-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/3036-191-0x0000000000000000-mapping.dmp
-
memory/3048-159-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/3048-145-0x0000000000000000-mapping.dmp
-
memory/3048-187-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/3168-147-0x0000000000000000-mapping.dmp
-
memory/3596-181-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/3596-157-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/3596-144-0x0000000000000000-mapping.dmp
-
memory/4228-141-0x0000000000000000-mapping.dmp
-
memory/4228-177-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/4228-156-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/4232-189-0x0000000000000000-mapping.dmp
-
memory/4476-165-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/4476-132-0x0000000000D20000-0x0000000000FAE000-memory.dmpFilesize
2.6MB
-
memory/4476-134-0x00000000032D0000-0x0000000003320000-memory.dmpFilesize
320KB
-
memory/4476-133-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/4476-135-0x000000001D840000-0x000000001DD68000-memory.dmpFilesize
5.2MB
-
memory/4476-136-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/4592-143-0x0000000000000000-mapping.dmp
-
memory/4592-171-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/4592-149-0x000001BE60470000-0x000001BE60492000-memory.dmpFilesize
136KB
-
memory/4592-154-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/4632-138-0x0000000000000000-mapping.dmp
-
memory/4632-173-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/4632-151-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/4708-142-0x0000000000000000-mapping.dmp
-
memory/4708-188-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/4708-155-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/4880-139-0x0000000000000000-mapping.dmp
-
memory/4880-180-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/4880-152-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/5080-172-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB
-
memory/5080-137-0x0000000000000000-mapping.dmp
-
memory/5080-150-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmpFilesize
10.8MB