dcrat | bec2656a4413d2cb9d64f99d3b72472989197434a637ed136858ed782b293a50

Analysis

max time kernel
122s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2023 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ebda5cfb762d7884f46792cb1d12adb.exe
Size

8.0MB
MD5

1ebda5cfb762d7884f46792cb1d12adb
SHA1

22f9c3c64dd3d13c2453a1872e3ad59491f6d101
SHA256

bec2656a4413d2cb9d64f99d3b72472989197434a637ed136858ed782b293a50
SHA512

ec700ceb9af2b0eea226d3f1f0b2ed46dfe60a0364f4b676f524db4d2a542db1eb961d466c59bb0e3a2fcbfc9521d8d354ac607c528b90ebd1787edd0126437a
SSDEEP

196608:0PbgMfpayqnxbAQ5owejuJDUX47dwdW0vnFwBTYPERR+:KzYyoxCaUX47d4XnwZQ

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3740	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2092	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2092	schtasks.exe

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\INST.exe	dcrat
C:\Users\Admin\AppData\Local\Temp\INST.exe	dcrat
C:\mshyperSurrogatewebdll\containercomponentcrt.exe	dcrat
C:\mshyperSurrogatewebdll\containercomponentcrt.exe	dcrat
behavioral2/memory/4036-256-0x0000000000350000-0x0000000000426000-memory.dmp	dcrat
C:\mshyperSurrogatewebdll\dwm.exe	dcrat
C:\mshyperSurrogatewebdll\sppsvc.exe	dcrat
C:\mshyperSurrogatewebdll\sppsvc.exe	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

INST.exeWScript.execontainercomponentcrt.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	INST.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	containercomponentcrt.exe

Executes dropped EXE 3 IoCs

Processes:

INST.execontainercomponentcrt.exesppsvc.exe

pid process

3752 INST.exe
4036 containercomponentcrt.exe
2340 sppsvc.exe
Loads dropped DLL 3 IoCs

Processes:

1ebda5cfb762d7884f46792cb1d12adb.exe

pid process

3016 1ebda5cfb762d7884f46792cb1d12adb.exe
3016 1ebda5cfb762d7884f46792cb1d12adb.exe
3016 1ebda5cfb762d7884f46792cb1d12adb.exe

pid	process
3752	INST.exe
4036	containercomponentcrt.exe
2340	sppsvc.exe

pid	process
3016	1ebda5cfb762d7884f46792cb1d12adb.exe
3016	1ebda5cfb762d7884f46792cb1d12adb.exe
3016	1ebda5cfb762d7884f46792cb1d12adb.exe

Drops file in Program Files directory 11 IoCs

Processes:

containercomponentcrt.exe

description	ioc	process
File created	C:\Program Files (x86)\Reference Assemblies\dllhost.exe	containercomponentcrt.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\csrss.exe	containercomponentcrt.exe
File created	C:\Program Files (x86)\Windows Sidebar\088424020bedd6	containercomponentcrt.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\lsass.exe	containercomponentcrt.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\6203df4a6bafc7	containercomponentcrt.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\55b276f4edf653	containercomponentcrt.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\dllhost.exe	containercomponentcrt.exe
File created	C:\Program Files (x86)\Reference Assemblies\5940a34987c991	containercomponentcrt.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\886983d96e3d3e	containercomponentcrt.exe
File created	C:\Program Files (x86)\Windows Sidebar\conhost.exe	containercomponentcrt.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\StartMenuExperienceHost.exe	containercomponentcrt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
3112	schtasks.exe
1564	schtasks.exe
4724	schtasks.exe
4388	schtasks.exe
2792	schtasks.exe
3728	schtasks.exe
2272	schtasks.exe
3404	schtasks.exe
4524	schtasks.exe
5116	schtasks.exe
4756	schtasks.exe
1104	schtasks.exe
3908	schtasks.exe
3740	schtasks.exe
4632	schtasks.exe
4004	schtasks.exe
2856	schtasks.exe
4768	schtasks.exe
3396	schtasks.exe
1552	schtasks.exe
3524	schtasks.exe
3016	schtasks.exe
1100	schtasks.exe
1652	schtasks.exe
4144	schtasks.exe
2952	schtasks.exe
4684	schtasks.exe
1216	schtasks.exe
4296	schtasks.exe
2384	schtasks.exe

Modifies registry class 2 IoCs

Processes:

INST.execontainercomponentcrt.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	INST.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	containercomponentcrt.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

containercomponentcrt.exesppsvc.exe

pid	process
4036	containercomponentcrt.exe
4036	containercomponentcrt.exe
4036	containercomponentcrt.exe
2340	sppsvc.exe
2340	sppsvc.exe
2340	sppsvc.exe
2340	sppsvc.exe
2340	sppsvc.exe
2340	sppsvc.exe
2340	sppsvc.exe
2340	sppsvc.exe
2340	sppsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

containercomponentcrt.exesppsvc.exe

description pid process

Token: SeDebugPrivilege 4036 containercomponentcrt.exe
Token: SeDebugPrivilege 2340 sppsvc.exe

description	pid	process
Token: SeDebugPrivilege	4036	containercomponentcrt.exe
Token: SeDebugPrivilege	2340	sppsvc.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

1ebda5cfb762d7884f46792cb1d12adb.exe1ebda5cfb762d7884f46792cb1d12adb.execmd.exeINST.exeWScript.execmd.execontainercomponentcrt.execmd.exe

description	pid	process	target process
PID 4544 wrote to memory of 3016	4544	1ebda5cfb762d7884f46792cb1d12adb.exe	1ebda5cfb762d7884f46792cb1d12adb.exe
PID 4544 wrote to memory of 3016	4544	1ebda5cfb762d7884f46792cb1d12adb.exe	1ebda5cfb762d7884f46792cb1d12adb.exe
PID 3016 wrote to memory of 1700	3016	1ebda5cfb762d7884f46792cb1d12adb.exe	cmd.exe
PID 3016 wrote to memory of 1700	3016	1ebda5cfb762d7884f46792cb1d12adb.exe	cmd.exe
PID 3016 wrote to memory of 2404	3016	1ebda5cfb762d7884f46792cb1d12adb.exe	cmd.exe
PID 3016 wrote to memory of 2404	3016	1ebda5cfb762d7884f46792cb1d12adb.exe	cmd.exe
PID 2404 wrote to memory of 3752	2404	cmd.exe	INST.exe
PID 2404 wrote to memory of 3752	2404	cmd.exe	INST.exe
PID 2404 wrote to memory of 3752	2404	cmd.exe	INST.exe
PID 3752 wrote to memory of 556	3752	INST.exe	WScript.exe
PID 3752 wrote to memory of 556	3752	INST.exe	WScript.exe
PID 3752 wrote to memory of 556	3752	INST.exe	WScript.exe
PID 556 wrote to memory of 4776	556	WScript.exe	cmd.exe
PID 556 wrote to memory of 4776	556	WScript.exe	cmd.exe
PID 556 wrote to memory of 4776	556	WScript.exe	cmd.exe
PID 4776 wrote to memory of 4036	4776	cmd.exe	containercomponentcrt.exe
PID 4776 wrote to memory of 4036	4776	cmd.exe	containercomponentcrt.exe
PID 4036 wrote to memory of 3780	4036	containercomponentcrt.exe	cmd.exe
PID 4036 wrote to memory of 3780	4036	containercomponentcrt.exe	cmd.exe
PID 3780 wrote to memory of 1684	3780	cmd.exe	w32tm.exe
PID 3780 wrote to memory of 1684	3780	cmd.exe	w32tm.exe
PID 3780 wrote to memory of 2340	3780	cmd.exe	sppsvc.exe
PID 3780 wrote to memory of 2340	3780	cmd.exe	sppsvc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1ebda5cfb762d7884f46792cb1d12adb.exe
"C:\Users\Admin\AppData\Local\Temp\1ebda5cfb762d7884f46792cb1d12adb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4544

C:\Users\Admin\AppData\Local\Temp\1ebda5cfb762d7884f46792cb1d12adb.exe
"C:\Users\Admin\AppData\Local\Temp\1ebda5cfb762d7884f46792cb1d12adb.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016

C:\Windows\SYSTEM32\cmd.exe
cmd /c echo %temp%
3⤵
PID:1700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\INST.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2404

C:\Users\Admin\AppData\Local\Temp\INST.exe
C:\Users\Admin\AppData\Local\Temp\INST.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3752

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\mshyperSurrogatewebdll\r29x1UikXJ.vbe"
5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:556

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\mshyperSurrogatewebdll\ExpQO8XM2UsA8U.bat" "
6⤵
- Suspicious use of WriteProcessMemory
PID:4776

C:\mshyperSurrogatewebdll\containercomponentcrt.exe
"C:\mshyperSurrogatewebdll\containercomponentcrt.exe"
7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YnO59MeEL3.bat"
8⤵
- Suspicious use of WriteProcessMemory
PID:3780

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
9⤵
PID:1684

C:\mshyperSurrogatewebdll\sppsvc.exe
"C:\mshyperSurrogatewebdll\sppsvc.exe"
9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\mshyperSurrogatewebdll\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\mshyperSurrogatewebdll\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\mshyperSurrogatewebdll\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Pictures\Saved Pictures\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Saved Pictures\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Pictures\Saved Pictures\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Application Data\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Application Data\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\mshyperSurrogatewebdll\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\mshyperSurrogatewebdll\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\mshyperSurrogatewebdll\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\PrintHood\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\PrintHood\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\PrintHood\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\INST.exe
Filesize
1.1MB

MD5
647ee4600c15dba14d7a7215eb0530e9

SHA1
8b694f3b61311fd1a9619a37eff1d5818d6f2b33

SHA256
20ed06ddbb4bcb44ab39de5dd74d277c02594eda6e19f3e5e8b693652e4bf621

SHA512
6378049eacbf0a9a25194e92eb033e5944324abf7fd5cc1afc7b71b17af40df23e0756df86ed660c3a8ce160a398a101d35bbf323551f5dae5f646288c5b5986

Download Submit
C:\Users\Admin\AppData\Local\Temp\INST.exe
Filesize
1.1MB

MD5
647ee4600c15dba14d7a7215eb0530e9

SHA1
8b694f3b61311fd1a9619a37eff1d5818d6f2b33

SHA256
20ed06ddbb4bcb44ab39de5dd74d277c02594eda6e19f3e5e8b693652e4bf621

SHA512
6378049eacbf0a9a25194e92eb033e5944324abf7fd5cc1afc7b71b17af40df23e0756df86ed660c3a8ce160a398a101d35bbf323551f5dae5f646288c5b5986

Download Submit
C:\Users\Admin\AppData\Local\Temp\YnO59MeEL3.bat
Filesize
201B

MD5
b3b4ef13fba10aa852be7ad3e9134fd9

SHA1
712e5ab8882300b5e523c006a06622dfbac80fd4

SHA256
2bd5c6ebb4768ec6ef058c9a1723dd458fbe869c7ae15cdbcd7a1f7d8c03f31d

SHA512
947286c70768fbd4e0e6b9c94f374d147f4c0f538a04f4e4b6875e56768d34f83774df42cdd5cf8511e80e4188d3a8851f3e7ef22b920e417dbbb7191e713e41

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45442\VCRUNTIME140.dll
Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45442\VCRUNTIME140.dll
Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45442\base_library.zip
Filesize
1.7MB

MD5
948430bbba768d83a37fc725d7d31fbb

SHA1
e00d912fe85156f61fd8cd109d840d2d69b9629b

SHA256
65ebc074b147d65841a467a49f30a5f2f54659a0cc5dc31411467263a37c02df

SHA512
aad73403964228ed690ce3c5383e672b76690f776d4ff38792544c67e6d7b54eb56dd6653f4a89f7954752dae78ca35f738e000ffff07fdfb8ef2af708643186

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45442\python311.dll
Filesize
5.5MB

MD5
1fe47c83669491bf38a949253d7d960f

SHA1
de5cc181c0e26cbcb31309fe00d9f2f5264d2b25

SHA256
0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae

SHA512
05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45442\python311.dll
Filesize
5.5MB

MD5
1fe47c83669491bf38a949253d7d960f

SHA1
de5cc181c0e26cbcb31309fe00d9f2f5264d2b25

SHA256
0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae

SHA512
05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45442\ucrtbase.dll
Filesize
993KB

MD5
9679f79d724bcdbd3338824ffe8b00c7

SHA1
5ded91cc6e3346f689d079594cf3a9bf1200bd61

SHA256
962c50afcb9fbfd0b833e0d2d7c2ba5cb35cd339ecf1c33ddfb349253ff95f36

SHA512
74ac8deb4a30f623af1e90e594d66fe28a1f86a11519c542c2bad44e556b2c5e03d41842f34f127f8f7f7cb217a6f357604cb2dc6aa5edc5cba8b83673d8b8bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45442\ucrtbase.dll
Filesize
993KB

MD5
9679f79d724bcdbd3338824ffe8b00c7

SHA1
5ded91cc6e3346f689d079594cf3a9bf1200bd61

SHA256
962c50afcb9fbfd0b833e0d2d7c2ba5cb35cd339ecf1c33ddfb349253ff95f36

SHA512
74ac8deb4a30f623af1e90e594d66fe28a1f86a11519c542c2bad44e556b2c5e03d41842f34f127f8f7f7cb217a6f357604cb2dc6aa5edc5cba8b83673d8b8bd

Download Submit
C:\mshyperSurrogatewebdll\ExpQO8XM2UsA8U.bat
Filesize
53B

MD5
28da2fe7d9e6e148f4bd076437674da0

SHA1
bfa422e68f83b704f45e6ac9d347e54a3987d1af

SHA256
1375428ee07dd79dfd1075b1fb9af0426095b52fb6ea34531d6eee58ed4455b8

SHA512
10285de9c1006c470b1eb9f56bf0ea5ace31a07e1c4a2e5e0fe611eacfb74014cc6917e6855456a5a4916e04d75d012cb6a888696d78c1a1b5d9a4d7f3f129b5

Download Submit
C:\mshyperSurrogatewebdll\containercomponentcrt.exe
Filesize
828KB

MD5
53dee3a4b4231beb405a8bdbea635aeb

SHA1
8ad1eba33de9a663de6e3e6244420735a06ef69d

SHA256
7956af9a9f6c06a01251031eaa07ec95e2ca8f84bb2f8d07968a03c784fb1a35

SHA512
2e92dd691572da551645d071140250686471b79e5bc94c3042a8eef70069cdf1358f22430c9b2de523230f933ff7a9ec4ce04df80c28a464feb3f7dc21e7be0e

Download Submit
C:\mshyperSurrogatewebdll\containercomponentcrt.exe
Filesize
828KB

MD5
53dee3a4b4231beb405a8bdbea635aeb

SHA1
8ad1eba33de9a663de6e3e6244420735a06ef69d

SHA256
7956af9a9f6c06a01251031eaa07ec95e2ca8f84bb2f8d07968a03c784fb1a35

SHA512
2e92dd691572da551645d071140250686471b79e5bc94c3042a8eef70069cdf1358f22430c9b2de523230f933ff7a9ec4ce04df80c28a464feb3f7dc21e7be0e

Download Submit
C:\mshyperSurrogatewebdll\dwm.exe
Filesize
828KB

MD5
53dee3a4b4231beb405a8bdbea635aeb

SHA1
8ad1eba33de9a663de6e3e6244420735a06ef69d

SHA256
7956af9a9f6c06a01251031eaa07ec95e2ca8f84bb2f8d07968a03c784fb1a35

SHA512
2e92dd691572da551645d071140250686471b79e5bc94c3042a8eef70069cdf1358f22430c9b2de523230f933ff7a9ec4ce04df80c28a464feb3f7dc21e7be0e

Download Submit
C:\mshyperSurrogatewebdll\r29x1UikXJ.vbe
Filesize
213B

MD5
da7e75e2f652053670953d37fa81a712

SHA1
1a992cbe4cb8f43967f176803a733d10f154a0a9

SHA256
64f891a1682340493ecbef9d02c54b33ccd808947f3c5e9a03ba4c04211c0ba5

SHA512
90f6bcfd4723abbe947367c1063bdad541b612e9242a0b8d22f28375020feaf9c9c6129a59563ebaa27793fbbfd096201315c2fad1cf29c879abb6451a6e467d

Download Submit
C:\mshyperSurrogatewebdll\sppsvc.exe
Filesize
828KB

MD5
53dee3a4b4231beb405a8bdbea635aeb

SHA1
8ad1eba33de9a663de6e3e6244420735a06ef69d

SHA256
7956af9a9f6c06a01251031eaa07ec95e2ca8f84bb2f8d07968a03c784fb1a35

SHA512
2e92dd691572da551645d071140250686471b79e5bc94c3042a8eef70069cdf1358f22430c9b2de523230f933ff7a9ec4ce04df80c28a464feb3f7dc21e7be0e

Download Submit
C:\mshyperSurrogatewebdll\sppsvc.exe
Filesize
828KB

MD5
53dee3a4b4231beb405a8bdbea635aeb

SHA1
8ad1eba33de9a663de6e3e6244420735a06ef69d

SHA256
7956af9a9f6c06a01251031eaa07ec95e2ca8f84bb2f8d07968a03c784fb1a35

SHA512
2e92dd691572da551645d071140250686471b79e5bc94c3042a8eef70069cdf1358f22430c9b2de523230f933ff7a9ec4ce04df80c28a464feb3f7dc21e7be0e

Download Submit
memory/2340-287-0x0000000002C80000-0x0000000002C90000-memory.dmp

Filesize
64KB

Download
memory/4036-256-0x0000000000350000-0x0000000000426000-memory.dmp

Filesize
856KB

Download
memory/4036-259-0x000000001B0A0000-0x000000001B0B0000-memory.dmp

Filesize
64KB

Download