dcrat | 946a6844d3ab11e9550bf3ecc40187aef2ff2e5b049af7fe9f75b28a9ca6acf0

Analysis

max time kernel
91s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2023, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1e507f0fb860258d1fb4673200763c3.exe
Size 1001KB
Sample230205-fa4f1sgc45
SHA256 946a6844d3ab11e9550bf3ecc40187aef2ff2e5b049af7fe9f75b28a9ca6acf0
MD5 a1e507f0fb860258d1fb4673200763c3
SHA1 aa7903af457e39469493c3078ea941da372e7734
SHA512 4cf52ce8a3eaaf6d1003750780ab5e6f415e7cfaf3d3b57f4b6c84ada12054bb653ee4518f893b8d858e634a678abd03196e698769121cb014eb56955e240179
SSDEEP 24576:Ga8qqs90Axyz/A4PI8v5wp5lvLg23R2Sj:G1s90AxilPI8v5elvL9gS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3740	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3336	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	260	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3568	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4368	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	520	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4208	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	744	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	932	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	4424	schtasks.exe	64
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	4424	schtasks.exe	64

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1800-132-0x0000000000010000-0x0000000000112000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	a1e507f0fb860258d1fb4673200763c3.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender\it-IT\spoolsv.exe	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Program Files\Windows Defender\it-IT\f3b6ecef712a24	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Program Files\Google\Chrome\sihost.exe	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Program Files\Google\Chrome\66fc9ff0ee96c2	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Program Files\Uninstall Information\System.exe	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Program Files\Uninstall Information\27d1bcfc3c54e0	a1e507f0fb860258d1fb4673200763c3.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Registration\CRMLog\taskhostw.exe	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Windows\Registration\CRMLog\ea9f0e6c9e2dcd	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Windows\Prefetch\ReadyBoot\upfc.exe	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Windows\Prefetch\ReadyBoot\ea1d8f6d871115	a1e507f0fb860258d1fb4673200763c3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2148	schtasks.exe
2228	schtasks.exe
4368	schtasks.exe
3884	schtasks.exe
1712	schtasks.exe
2140	schtasks.exe
924	schtasks.exe
3472	schtasks.exe
744	schtasks.exe
4496	schtasks.exe
932	schtasks.exe
5044	schtasks.exe
1752	schtasks.exe
3888	schtasks.exe
208	schtasks.exe
3052	schtasks.exe
5040	schtasks.exe
1300	schtasks.exe
4208	schtasks.exe
2112	schtasks.exe
3040	schtasks.exe
1476	schtasks.exe
2292	schtasks.exe
3724	schtasks.exe
2840	schtasks.exe
1060	schtasks.exe
4668	schtasks.exe
4016	schtasks.exe
912	schtasks.exe
1464	schtasks.exe
4928	schtasks.exe
3568	schtasks.exe
4680	schtasks.exe
3740	schtasks.exe
260	schtasks.exe
520	schtasks.exe
956	schtasks.exe
4332	schtasks.exe
3512	schtasks.exe
532	schtasks.exe
1552	schtasks.exe
3336	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	a1e507f0fb860258d1fb4673200763c3.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1800	a1e507f0fb860258d1fb4673200763c3.exe
1800	a1e507f0fb860258d1fb4673200763c3.exe
1800	a1e507f0fb860258d1fb4673200763c3.exe
1800	a1e507f0fb860258d1fb4673200763c3.exe
1800	a1e507f0fb860258d1fb4673200763c3.exe
1800	a1e507f0fb860258d1fb4673200763c3.exe
1800	a1e507f0fb860258d1fb4673200763c3.exe
1800	a1e507f0fb860258d1fb4673200763c3.exe
1800	a1e507f0fb860258d1fb4673200763c3.exe
1800	a1e507f0fb860258d1fb4673200763c3.exe
1800	a1e507f0fb860258d1fb4673200763c3.exe
1800	a1e507f0fb860258d1fb4673200763c3.exe
1800	a1e507f0fb860258d1fb4673200763c3.exe
1800	a1e507f0fb860258d1fb4673200763c3.exe
1800	a1e507f0fb860258d1fb4673200763c3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	a1e507f0fb860258d1fb4673200763c3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2328	1800	a1e507f0fb860258d1fb4673200763c3.exe	120
PID 1800 wrote to memory of 2328	1800	a1e507f0fb860258d1fb4673200763c3.exe	120
PID 2328 wrote to memory of 3096	2328	cmd.exe	122
PID 2328 wrote to memory of 3096	2328	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\a1e507f0fb860258d1fb4673200763c3.exe
"C:\Users\Admin\AppData\Local\Temp\a1e507f0fb860258d1fb4673200763c3.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hg70ucPPde.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\odt\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Windows\Registration\CRMLog\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Windows\Registration\CRMLog\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Downloads\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Downloads\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Downloads\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\odt\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\it-IT\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Windows\Prefetch\ReadyBoot\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Windows\Prefetch\ReadyBoot\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hg70ucPPde.bat

Path C:\Users\Admin\AppData\Local\Temp\hg70ucPPde.bat
Size 209B
SHA256 de61dbf169c0901b4ae55a0f72ba7983cf525ffd2b92d1a9c8c5bda72e5476b2
MD5 b721efb31ca79e9b9f79e2b64c5f1470
SHA1 17d77286b02d7db22a342a4a6626d51b2d2db8c0
SHA512 6c467abb59eef4f9fc08f64e75e65a937cf0e9be241405c614af6274eb5b893bdcd9c3df4a1f9274122c9c773dbfdabfe71c71ec43f8060566334bee045cc017
MD5 SHA1 SHA512

Submit Download

memory/1800-132-0x0000000000010000-0x0000000000112000-memory.dmp

Download

memory/1800-133-0x00007FFD78560000-0x00007FFD79021000-memory.dmp

Download

memory/1800-134-0x0000000002330000-0x0000000002380000-memory.dmp

Download

memory/1800-138-0x00007FFD78560000-0x00007FFD79021000-memory.dmp

Download