dcrat | 941f69dfaf5589ff59a8e9e2958af2ebad874806e533f74a47982c9491c26e2c

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-02-2023 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PZCheat.exe
Size

1.5MB
MD5

164ba5ee6f6b30539e874248ccfa4c05
SHA1

6b14ed8dab712359453779f2896e1cbad78871d7
SHA256

fc7ca5dbd9e3d228416ea9725c7283d105d75533f7a4e069d89f2632840e1a5d
SHA512

c9b2eef0e4499832f9c4eca8b503f17f4cc7589d0d2b12fe82572ad5df23e85cef9267bdc24928b7ac6df0fff70fe49d2422d6e9a549f07a74c8f9bd47892cfc
SSDEEP

24576:B2G/nvxW3WLRnhzLfSRyBWkNUk9tJIzxIq2+kt3S5wFAiQuwV4ilByjNTVu1:BbA3+p9SRyBW0Tty2E5wFzQuo4iupRu1

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	276	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	1964	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	1964	schtasks.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/1528-66-0x0000000000ED0000-0x000000000128C000-memory.dmp	dcrat
behavioral1/memory/1528-71-0x0000000000ED0000-0x000000000128C000-memory.dmp	dcrat
behavioral1/memory/1952-80-0x0000000000160000-0x000000000051C000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

Processes:

containersavesCrt.exewininit.exe

pid process

1528 containersavesCrt.exe
1952 wininit.exe
Loads dropped DLL 4 IoCs

Processes:

cmd.execmd.exe

pid process

1724 cmd.exe
1724 cmd.exe
1464 cmd.exe
1464 cmd.exe

pid	process
1724	cmd.exe
1724	cmd.exe
1464	cmd.exe
1464	cmd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

Processes:

containersavesCrt.exewininit.exe

pid	process
1528	containersavesCrt.exe
1952	wininit.exe
1952	wininit.exe
1952	wininit.exe
1952	wininit.exe
1952	wininit.exe
1952	wininit.exe
1952	wininit.exe
1952	wininit.exe
1952	wininit.exe

Drops file in Program Files directory 6 IoCs

Processes:

containersavesCrt.exe

description	ioc	process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\csrss.exe	containersavesCrt.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\886983d96e3d3e	containersavesCrt.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe	containersavesCrt.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\886983d96e3d3e	containersavesCrt.exe
File created	C:\Program Files (x86)\Common Files\System\csrss.exe	containersavesCrt.exe
File created	C:\Program Files (x86)\Common Files\System\886983d96e3d3e	containersavesCrt.exe

Drops file in Windows directory 4 IoCs

Processes:

containersavesCrt.exe

description	ioc	process
File created	C:\Windows\TAPI\conhost.exe	containersavesCrt.exe
File created	C:\Windows\TAPI\088424020bedd6	containersavesCrt.exe
File created	C:\Windows\ModemLogs\lsass.exe	containersavesCrt.exe
File created	C:\Windows\ModemLogs\6203df4a6bafc7	containersavesCrt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
1872	schtasks.exe
1116	schtasks.exe
1492	schtasks.exe
1400	schtasks.exe
1464	schtasks.exe
1744	schtasks.exe
1784	schtasks.exe
1716	schtasks.exe
900	schtasks.exe
1704	schtasks.exe
992	schtasks.exe
1984	schtasks.exe
1184	schtasks.exe
1672	schtasks.exe
1688	schtasks.exe
856	schtasks.exe
2040	schtasks.exe
1560	schtasks.exe
1472	schtasks.exe
1596	schtasks.exe
684	schtasks.exe
1880	schtasks.exe
1956	schtasks.exe
2004	schtasks.exe
1992	schtasks.exe
1484	schtasks.exe
276	schtasks.exe
2024	schtasks.exe
1060	schtasks.exe
2000	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

containersavesCrt.exewininit.exechrome.exechrome.exe

pid	process
1528	containersavesCrt.exe
1952	wininit.exe
1716	chrome.exe
592	chrome.exe
592	chrome.exe
1952	wininit.exe
1952	wininit.exe
1952	wininit.exe
1952	wininit.exe
1952	wininit.exe
1952	wininit.exe
1952	wininit.exe
1952	wininit.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

containersavesCrt.exewininit.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	1528	containersavesCrt.exe
Token: SeDebugPrivilege	1952	wininit.exe
Token: 33	468	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	468	AUDIODG.EXE
Token: 33	468	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	468	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

chrome.exe

pid	process
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

containersavesCrt.exewininit.exe

pid process

1528 containersavesCrt.exe
1952 wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

PZCheat.exeWScript.execmd.execontainersavesCrt.execmd.exew32tm.exechrome.exe

description	pid	process	target process
PID 2028 wrote to memory of 900	2028	PZCheat.exe	WScript.exe
PID 2028 wrote to memory of 900	2028	PZCheat.exe	WScript.exe
PID 2028 wrote to memory of 900	2028	PZCheat.exe	WScript.exe
PID 2028 wrote to memory of 900	2028	PZCheat.exe	WScript.exe
PID 900 wrote to memory of 1724	900	WScript.exe	cmd.exe
PID 900 wrote to memory of 1724	900	WScript.exe	cmd.exe
PID 900 wrote to memory of 1724	900	WScript.exe	cmd.exe
PID 900 wrote to memory of 1724	900	WScript.exe	cmd.exe
PID 1724 wrote to memory of 1528	1724	cmd.exe	containersavesCrt.exe
PID 1724 wrote to memory of 1528	1724	cmd.exe	containersavesCrt.exe
PID 1724 wrote to memory of 1528	1724	cmd.exe	containersavesCrt.exe
PID 1724 wrote to memory of 1528	1724	cmd.exe	containersavesCrt.exe
PID 1528 wrote to memory of 1464	1528	containersavesCrt.exe	cmd.exe
PID 1528 wrote to memory of 1464	1528	containersavesCrt.exe	cmd.exe
PID 1528 wrote to memory of 1464	1528	containersavesCrt.exe	cmd.exe
PID 1528 wrote to memory of 1464	1528	containersavesCrt.exe	cmd.exe
PID 1464 wrote to memory of 560	1464	cmd.exe	w32tm.exe
PID 1464 wrote to memory of 560	1464	cmd.exe	w32tm.exe
PID 1464 wrote to memory of 560	1464	cmd.exe	w32tm.exe
PID 1464 wrote to memory of 560	1464	cmd.exe	w32tm.exe
PID 560 wrote to memory of 1744	560	w32tm.exe	w32tm.exe
PID 560 wrote to memory of 1744	560	w32tm.exe	w32tm.exe
PID 560 wrote to memory of 1744	560	w32tm.exe	w32tm.exe
PID 560 wrote to memory of 1744	560	w32tm.exe	w32tm.exe
PID 1464 wrote to memory of 1952	1464	cmd.exe	wininit.exe
PID 1464 wrote to memory of 1952	1464	cmd.exe	wininit.exe
PID 1464 wrote to memory of 1952	1464	cmd.exe	wininit.exe
PID 1464 wrote to memory of 1952	1464	cmd.exe	wininit.exe
PID 592 wrote to memory of 760	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 760	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 760	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe
PID 592 wrote to memory of 1120	592	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\PZCheat.exe
"C:\Users\Admin\AppData\Local\Temp\PZCheat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\surrogateContainerhostcrtDll\qAjDBhKogos2S0J68ty6.vbe"
2⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\surrogateContainerhostcrtDll\fba6WO2dA9UqWb6NlbxSa.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724

C:\surrogateContainerhostcrtDll\containersavesCrt.exe
"C:\surrogateContainerhostcrtDll\containersavesCrt.exe"
4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\w53ldcAzoh.bat"
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
6⤵
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
7⤵
PID:1744

C:\Users\Admin\wininit.exe
"C:\Users\Admin\wininit.exe"
6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Windows\TAPI\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\TAPI\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\TAPI\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Documents\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\All Users\Documents\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Documents\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\ModemLogs\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\ModemLogs\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Windows\ModemLogs\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Admin\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\System\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\System\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1560

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1612

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x484
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5af4f50,0x7fef5af4f60,0x7fef5af4f70
2⤵
PID:760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1100,3369944359613240076,1813972108871914973,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1120 /prefetch:2
2⤵
PID:1120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1100,3369944359613240076,1813972108871914973,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1256 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1100,3369944359613240076,1813972108871914973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1832 /prefetch:8
2⤵
PID:1980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,3369944359613240076,1813972108871914973,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:1
2⤵
PID:1400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,3369944359613240076,1813972108871914973,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2032 /prefetch:1
2⤵
PID:596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,3369944359613240076,1813972108871914973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
2⤵
PID:2232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1100,3369944359613240076,1813972108871914973,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3256 /prefetch:2
2⤵
PID:2320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,3369944359613240076,1813972108871914973,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2384 /prefetch:1
2⤵
PID:2368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,3369944359613240076,1813972108871914973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3504 /prefetch:8
2⤵
PID:2432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,3369944359613240076,1813972108871914973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3604 /prefetch:8
2⤵
PID:2440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,3369944359613240076,1813972108871914973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1488 /prefetch:8
2⤵
PID:2884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\w53ldcAzoh.bat

Filesize
191B

MD5
707dbd69276542291fe36a3768ce6109

SHA1
09888a052d4378c4c6eef5ea5030b5622e73d3a1

SHA256
81534768f892b951a7b86e53bc377c7a21d302f98f2afe415c1669300f4d0fb0

SHA512
ed2cec5307c139a779ee301cc677220d94e70fc9e0bc4ae9d079af564465537f7e8f5f25df422bce7d3761eb84506ed07f678700d55c3f3668f0c94a088741d6

Download Submit
C:\Users\Admin\wininit.exe

Filesize
1.2MB

MD5
963f8f811b559d489ac8f0f5128acb7a

SHA1
91b273936ab1e1f562d29893f18bfe13a8be6448

SHA256
a3add9edc4b19b2b4e1061b0f1e685c2738bed0be41a5b6bfb6f85b66f21d923

SHA512
6c969271651bb4480d66c17665155e3a9590f41cc59091f2219b9f54bd86eabd6dee0deb758a12980b98740aa3859e670bf0cffa889702b3e038b1f9131a94c7

Download Submit
C:\Users\Admin\wininit.exe

Filesize
1.2MB

MD5
963f8f811b559d489ac8f0f5128acb7a

SHA1
91b273936ab1e1f562d29893f18bfe13a8be6448

SHA256
a3add9edc4b19b2b4e1061b0f1e685c2738bed0be41a5b6bfb6f85b66f21d923

SHA512
6c969271651bb4480d66c17665155e3a9590f41cc59091f2219b9f54bd86eabd6dee0deb758a12980b98740aa3859e670bf0cffa889702b3e038b1f9131a94c7

Download Submit
C:\surrogateContainerhostcrtDll\containersavesCrt.exe

Filesize
1.2MB

MD5
963f8f811b559d489ac8f0f5128acb7a

SHA1
91b273936ab1e1f562d29893f18bfe13a8be6448

SHA256
a3add9edc4b19b2b4e1061b0f1e685c2738bed0be41a5b6bfb6f85b66f21d923

SHA512
6c969271651bb4480d66c17665155e3a9590f41cc59091f2219b9f54bd86eabd6dee0deb758a12980b98740aa3859e670bf0cffa889702b3e038b1f9131a94c7

Download Submit
C:\surrogateContainerhostcrtDll\containersavesCrt.exe

Filesize
1.2MB

MD5
963f8f811b559d489ac8f0f5128acb7a

SHA1
91b273936ab1e1f562d29893f18bfe13a8be6448

SHA256
a3add9edc4b19b2b4e1061b0f1e685c2738bed0be41a5b6bfb6f85b66f21d923

SHA512
6c969271651bb4480d66c17665155e3a9590f41cc59091f2219b9f54bd86eabd6dee0deb758a12980b98740aa3859e670bf0cffa889702b3e038b1f9131a94c7

Download Submit
C:\surrogateContainerhostcrtDll\fba6WO2dA9UqWb6NlbxSa.bat

Filesize
55B

MD5
f1a7c3c3ddb14918973adcec0ca793e5

SHA1
cd8dc923af6be2083d0a41f69fb32c9a08b2ea7a

SHA256
ed360b14dbbe3a7a03e882f0bd9b892af8357642fcbb296e62bac96112d4a526

SHA512
472f2d9d775d7b3a9a17fc8327040438e591ffbaaf87be8353a4e02446bd5ee805ce39fa2c57f1b32ca6f971210fba6532d3b993b7f861a6dd49edb0986dbccf

Download Submit
C:\surrogateContainerhostcrtDll\qAjDBhKogos2S0J68ty6.vbe

Filesize
226B

MD5
6a5882c4cb8293cb361d7f95c51de59e

SHA1
48662867659024019cfc01e2e4731f9efaa83c67

SHA256
1ce3ab815dfa8ab817dab9bb42c012e940041735fa4f2064f780cd44b7a5c0a2

SHA512
e5c5940e4f1358688df06cb84ab1b9ea3a26a336ccbef7b02b0c40cb6477894855c8513f037ec602b4fce7a72f4a54b4f4ccf314437b595521aa4b3d4f21fe9f

Download Submit
\??\pipe\crashpad_592_FKFXTOCZOIJIIGLQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\wininit.exe

Filesize
1.2MB

MD5
963f8f811b559d489ac8f0f5128acb7a

SHA1
91b273936ab1e1f562d29893f18bfe13a8be6448

SHA256
a3add9edc4b19b2b4e1061b0f1e685c2738bed0be41a5b6bfb6f85b66f21d923

SHA512
6c969271651bb4480d66c17665155e3a9590f41cc59091f2219b9f54bd86eabd6dee0deb758a12980b98740aa3859e670bf0cffa889702b3e038b1f9131a94c7

Download Submit
\Users\Admin\wininit.exe

Filesize
1.2MB

MD5
963f8f811b559d489ac8f0f5128acb7a

SHA1
91b273936ab1e1f562d29893f18bfe13a8be6448

SHA256
a3add9edc4b19b2b4e1061b0f1e685c2738bed0be41a5b6bfb6f85b66f21d923

SHA512
6c969271651bb4480d66c17665155e3a9590f41cc59091f2219b9f54bd86eabd6dee0deb758a12980b98740aa3859e670bf0cffa889702b3e038b1f9131a94c7

Download Submit
\surrogateContainerhostcrtDll\containersavesCrt.exe

Filesize
1.2MB

MD5
963f8f811b559d489ac8f0f5128acb7a

SHA1
91b273936ab1e1f562d29893f18bfe13a8be6448

SHA256
a3add9edc4b19b2b4e1061b0f1e685c2738bed0be41a5b6bfb6f85b66f21d923

SHA512
6c969271651bb4480d66c17665155e3a9590f41cc59091f2219b9f54bd86eabd6dee0deb758a12980b98740aa3859e670bf0cffa889702b3e038b1f9131a94c7

Download Submit
\surrogateContainerhostcrtDll\containersavesCrt.exe

Filesize
1.2MB

MD5
963f8f811b559d489ac8f0f5128acb7a

SHA1
91b273936ab1e1f562d29893f18bfe13a8be6448

SHA256
a3add9edc4b19b2b4e1061b0f1e685c2738bed0be41a5b6bfb6f85b66f21d923

SHA512
6c969271651bb4480d66c17665155e3a9590f41cc59091f2219b9f54bd86eabd6dee0deb758a12980b98740aa3859e670bf0cffa889702b3e038b1f9131a94c7

Download Submit
memory/560-70-0x0000000000000000-mapping.dmp

Download
memory/900-55-0x0000000000000000-mapping.dmp

Download
memory/1464-68-0x0000000000000000-mapping.dmp

Download
memory/1528-66-0x0000000000ED0000-0x000000000128C000-memory.dmp

Filesize
3.7MB

Download
memory/1528-71-0x0000000000ED0000-0x000000000128C000-memory.dmp

Filesize
3.7MB

Download
memory/1528-63-0x0000000000000000-mapping.dmp

Download
memory/1612-82-0x000007FEFB871000-0x000007FEFB873000-memory.dmp

Filesize
8KB

Download
memory/1724-67-0x00000000020A0000-0x000000000245C000-memory.dmp

Filesize
3.7MB

Download
memory/1724-59-0x0000000000000000-mapping.dmp

Download
memory/1744-73-0x0000000000000000-mapping.dmp

Download
memory/1952-77-0x0000000000000000-mapping.dmp

Download
memory/1952-80-0x0000000000160000-0x000000000051C000-memory.dmp

Filesize
3.7MB

Download
memory/1952-81-0x0000000000160000-0x000000000051C000-memory.dmp

Filesize
3.7MB

Download
memory/2028-54-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download