dcrat | a165146ac8257340eeae4ae6a89a0c81f8e8ef743fda1e671b34b226fca9ff5e

Analysis

max time kernel
17s
max time network
21s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2023 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8BP_Cheto.exe
Size

10.0MB
MD5

718c1a4f0cdacf94d4d6ad97e06a459f
SHA1

f7ea9a4f39e415c15ef563ecd4f381013e52d3a7
SHA256

7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033
SHA512

8a3d55db0a4eae644922895e140269f22f8214af875bf3544255bcc1be6b1de9a1274b1dd41cc4ac5826a9ac5e1d8d216994891dc124c01ba722db214652f80e
SSDEEP

196608:2JJ8G/X6v9189c+HzrMyU59NSOWQqA00aWOj/AoDvVq:2JJTCv8cEnMrrNSOhLPOj/Pv

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4352	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3800	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3892	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	616	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	4848	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	4848	schtasks.exe

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/3092-134-0x0000000000400000-0x00000000015D9000-memory.dmp	dcrat
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe	dcrat
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe	dcrat
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe	dcrat
behavioral1/memory/3772-155-0x0000000000450000-0x00000000005FE000-memory.dmp	dcrat
behavioral1/memory/3092-166-0x0000000000400000-0x00000000015D9000-memory.dmp	dcrat
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe	dcrat
C:\Program Files\Reference Assemblies\Microsoft\Framework\conhost.exe	dcrat
C:\Program Files\Reference Assemblies\Microsoft\Framework\conhost.exe	dcrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8BP_Cheto.exebl_fontreviewmonitordllrefsvc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	8BP_Cheto.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	bl_fontreviewmonitordllrefsvc.exe

Executes dropped EXE 4 IoCs

Processes:

bl_fontreviewmonitordllrefsvc.execonhost_8.exeMASTER 8BP.exebl_fontreviewmonitordllrefsvc.exe

pid process

3772 bl_fontreviewmonitordllrefsvc.exe
4444 conhost_8.exe
2920 MASTER 8BP.exe
2572 bl_fontreviewmonitordllrefsvc.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

8BP_Cheto.exe

pid process

3092 8BP_Cheto.exe

pid	process
3772	bl_fontreviewmonitordllrefsvc.exe
4444	conhost_8.exe
2920	MASTER 8BP.exe
2572	bl_fontreviewmonitordllrefsvc.exe

pid	process
3092	8BP_Cheto.exe

Drops file in Program Files directory 9 IoCs

Processes:

bl_fontreviewmonitordllrefsvc.exebl_fontreviewmonitordllrefsvc.exe

description	ioc	process
File created	C:\Program Files\Windows Defender\it-IT\0a1fd5f707cd16	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\69ddcba757bf72	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files\Windows Defender\it-IT\sppsvc.exe	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\conhost.exe	bl_fontreviewmonitordllrefsvc.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\conhost.exe	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\088424020bedd6	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\ee2ad38f3d4382	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\smss.exe	bl_fontreviewmonitordllrefsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

bl_fontreviewmonitordllrefsvc.exe

description	ioc	process
File created	C:\Windows\ServiceProfiles\LocalService\RuntimeBroker.exe	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Windows\ServiceProfiles\LocalService\9e8d7a4ca61bd9	bl_fontreviewmonitordllrefsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
4140	schtasks.exe
3292	schtasks.exe
3892	schtasks.exe
4464	schtasks.exe
3172	schtasks.exe
1520	schtasks.exe
5104	schtasks.exe
1444	schtasks.exe
4416	schtasks.exe
1012	schtasks.exe
4704	schtasks.exe
2076	schtasks.exe
4412	schtasks.exe
3672	schtasks.exe
4624	schtasks.exe
4212	schtasks.exe
5024	schtasks.exe
1284	schtasks.exe
1480	schtasks.exe
3800	schtasks.exe
4600	schtasks.exe
4460	schtasks.exe
4424	schtasks.exe
4412	schtasks.exe
2496	schtasks.exe
4132	schtasks.exe
4352	schtasks.exe
2372	schtasks.exe
2080	schtasks.exe
1172	schtasks.exe
2980	schtasks.exe
3116	schtasks.exe
2084	schtasks.exe
3608	schtasks.exe
4464	schtasks.exe
4760	schtasks.exe
4868	schtasks.exe
3008	schtasks.exe
616	schtasks.exe

Modifies registry class 1 IoCs

Processes:

bl_fontreviewmonitordllrefsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	bl_fontreviewmonitordllrefsvc.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

MASTER 8BP.exebl_fontreviewmonitordllrefsvc.exepowershell.exebl_fontreviewmonitordllrefsvc.exe

pid	process
2920	MASTER 8BP.exe
2920	MASTER 8BP.exe
3772	bl_fontreviewmonitordllrefsvc.exe
3772	bl_fontreviewmonitordllrefsvc.exe
3772	bl_fontreviewmonitordllrefsvc.exe
3772	bl_fontreviewmonitordllrefsvc.exe
3772	bl_fontreviewmonitordllrefsvc.exe
3772	bl_fontreviewmonitordllrefsvc.exe
3772	bl_fontreviewmonitordllrefsvc.exe
3772	bl_fontreviewmonitordllrefsvc.exe
3772	bl_fontreviewmonitordllrefsvc.exe
4372	powershell.exe
3772	bl_fontreviewmonitordllrefsvc.exe
3772	bl_fontreviewmonitordllrefsvc.exe
4372	powershell.exe
2572	bl_fontreviewmonitordllrefsvc.exe
2572	bl_fontreviewmonitordllrefsvc.exe
2572	bl_fontreviewmonitordllrefsvc.exe
2572	bl_fontreviewmonitordllrefsvc.exe
2572	bl_fontreviewmonitordllrefsvc.exe
2572	bl_fontreviewmonitordllrefsvc.exe
2572	bl_fontreviewmonitordllrefsvc.exe
2572	bl_fontreviewmonitordllrefsvc.exe
2572	bl_fontreviewmonitordllrefsvc.exe
2572	bl_fontreviewmonitordllrefsvc.exe
2572	bl_fontreviewmonitordllrefsvc.exe
2572	bl_fontreviewmonitordllrefsvc.exe
2572	bl_fontreviewmonitordllrefsvc.exe
2572	bl_fontreviewmonitordllrefsvc.exe
2572	bl_fontreviewmonitordllrefsvc.exe
2572	bl_fontreviewmonitordllrefsvc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

bl_fontreviewmonitordllrefsvc.exepowershell.exebl_fontreviewmonitordllrefsvc.exe

description	pid	process
Token: SeDebugPrivilege	3772	bl_fontreviewmonitordllrefsvc.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeDebugPrivilege	2572	bl_fontreviewmonitordllrefsvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

8BP_Cheto.exe

pid process

3092 8BP_Cheto.exe

pid	process
3092	8BP_Cheto.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

8BP_Cheto.exebl_fontreviewmonitordllrefsvc.execmd.exebl_fontreviewmonitordllrefsvc.exe

description	pid	process	target process
PID 3092 wrote to memory of 3772	3092	8BP_Cheto.exe	bl_fontreviewmonitordllrefsvc.exe
PID 3092 wrote to memory of 3772	3092	8BP_Cheto.exe	bl_fontreviewmonitordllrefsvc.exe
PID 3092 wrote to memory of 4444	3092	8BP_Cheto.exe	conhost_8.exe
PID 3092 wrote to memory of 4444	3092	8BP_Cheto.exe	conhost_8.exe
PID 3092 wrote to memory of 2920	3092	8BP_Cheto.exe	MASTER 8BP.exe
PID 3092 wrote to memory of 2920	3092	8BP_Cheto.exe	MASTER 8BP.exe
PID 3092 wrote to memory of 2920	3092	8BP_Cheto.exe	MASTER 8BP.exe
PID 3772 wrote to memory of 4372	3772	bl_fontreviewmonitordllrefsvc.exe	powershell.exe
PID 3772 wrote to memory of 4372	3772	bl_fontreviewmonitordllrefsvc.exe	powershell.exe
PID 3772 wrote to memory of 1396	3772	bl_fontreviewmonitordllrefsvc.exe	cmd.exe
PID 3772 wrote to memory of 1396	3772	bl_fontreviewmonitordllrefsvc.exe	cmd.exe
PID 1396 wrote to memory of 2808	1396	cmd.exe	w32tm.exe
PID 1396 wrote to memory of 2808	1396	cmd.exe	w32tm.exe
PID 1396 wrote to memory of 2572	1396	cmd.exe	bl_fontreviewmonitordllrefsvc.exe
PID 1396 wrote to memory of 2572	1396	cmd.exe	bl_fontreviewmonitordllrefsvc.exe
PID 2572 wrote to memory of 1372	2572	bl_fontreviewmonitordllrefsvc.exe	powershell.exe
PID 2572 wrote to memory of 1372	2572	bl_fontreviewmonitordllrefsvc.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8BP_Cheto.exe
"C:\Users\Admin\AppData\Local\Temp\8BP_Cheto.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092

C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe
"C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3772

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RSrWHD5ous.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
4⤵
PID:2808

C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe
"C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\'
5⤵
PID:1372

C:\Program Files\Reference Assemblies\Microsoft\Framework\conhost.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\conhost.exe"
5⤵
PID:2300

C:\Users\Admin\AppData\Roaming\conhost_8.exe
"C:\Users\Admin\AppData\Roaming\conhost_8.exe"
2⤵
- Executes dropped EXE
PID:4444

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
3⤵
PID:1804

C:\Users\Admin\AppData\Local\Temp\MASTER 8BP.exe
"C:\Users\Admin\AppData\Local\Temp\MASTER 8BP.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\it-IT\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\it-IT\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\it-IT\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\odt\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\odt\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Saved Games\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Saved Games\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\odt\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Desktop\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Desktop\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Desktop\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Microsoft\Office\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\Office\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Microsoft\Office\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\odt\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\ServiceProfiles\LocalService\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\LocalService\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\ServiceProfiles\LocalService\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Users\Default\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Default\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Users\Default\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5024

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Reference Assemblies\Microsoft\Framework\conhost.exe
Filesize
1.6MB

MD5
0ea53df77445bfbde349bd4eed09dae1

SHA1
b4df1111097fbfb9a9ea3ad86ac130716fea12d0

SHA256
83f1a1d7936de3a686abf664e40790ab48bc2043cee630a7f96954935886f335

SHA512
4396c5815c3e2613083e4866d60a363f7cc6a38647abcacfcc7500d2b1654da4821b0c597368c490325196607c40ad80f19b12f87e8594c1e88f2a02a7a73357

Download Submit
C:\Program Files\Reference Assemblies\Microsoft\Framework\conhost.exe
Filesize
1.6MB

MD5
0ea53df77445bfbde349bd4eed09dae1

SHA1
b4df1111097fbfb9a9ea3ad86ac130716fea12d0

SHA256
83f1a1d7936de3a686abf664e40790ab48bc2043cee630a7f96954935886f335

SHA512
4396c5815c3e2613083e4866d60a363f7cc6a38647abcacfcc7500d2b1654da4821b0c597368c490325196607c40ad80f19b12f87e8594c1e88f2a02a7a73357

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\bl_fontreviewmonitordllrefsvc.exe.log
Filesize
1KB

MD5
bbb951a34b516b66451218a3ec3b0ae1

SHA1
7393835a2476ae655916e0a9687eeaba3ee876e9

SHA256
eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a

SHA512
63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MASTER 8BP.exe
Filesize
2.1MB

MD5
3ee631ed0386c88faaad83c97ade2dcd

SHA1
308ac9da54565404430b220881c76f49793c0e9f

SHA256
be66aee2bca9fe25b83908cb03dd991670725c754df97b2ea66eeca5e3d1f8c6

SHA512
976f1d04125ff29c4ef90efc2fd91db9cb146261a14c68a04169c955755a53d3f8c436c5c41a93564b4aa4800317e0b61b170ebc409eb346f5ae29762e518e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MASTER 8BP.exe
Filesize
2.1MB

MD5
3ee631ed0386c88faaad83c97ade2dcd

SHA1
308ac9da54565404430b220881c76f49793c0e9f

SHA256
be66aee2bca9fe25b83908cb03dd991670725c754df97b2ea66eeca5e3d1f8c6

SHA512
976f1d04125ff29c4ef90efc2fd91db9cb146261a14c68a04169c955755a53d3f8c436c5c41a93564b4aa4800317e0b61b170ebc409eb346f5ae29762e518e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MASTER 8BP.exe
Filesize
2.1MB

MD5
3ee631ed0386c88faaad83c97ade2dcd

SHA1
308ac9da54565404430b220881c76f49793c0e9f

SHA256
be66aee2bca9fe25b83908cb03dd991670725c754df97b2ea66eeca5e3d1f8c6

SHA512
976f1d04125ff29c4ef90efc2fd91db9cb146261a14c68a04169c955755a53d3f8c436c5c41a93564b4aa4800317e0b61b170ebc409eb346f5ae29762e518e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RSrWHD5ous.bat
Filesize
229B

MD5
0fbf3e7c28acd3567141f601bc68feeb

SHA1
af37194b595069f9b1e3dd33423d260dc35a2c07

SHA256
22513c74e6c5095cd026a3fe75ec7d6dc1be73560c691a93a57ff9f566e0ffed

SHA512
521bd0ea93714c1424fd115da5a135b2d50158c01d31215bc8c31e588ea1c9d99e50120c9dc200037f81b2113b2405f3df5b30a5cc797e8dd8e449b2dacaff88

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iuszou4a.fu1.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe
Filesize
1.6MB

MD5
0ea53df77445bfbde349bd4eed09dae1

SHA1
b4df1111097fbfb9a9ea3ad86ac130716fea12d0

SHA256
83f1a1d7936de3a686abf664e40790ab48bc2043cee630a7f96954935886f335

SHA512
4396c5815c3e2613083e4866d60a363f7cc6a38647abcacfcc7500d2b1654da4821b0c597368c490325196607c40ad80f19b12f87e8594c1e88f2a02a7a73357

Download Submit
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe
Filesize
1.6MB

MD5
0ea53df77445bfbde349bd4eed09dae1

SHA1
b4df1111097fbfb9a9ea3ad86ac130716fea12d0

SHA256
83f1a1d7936de3a686abf664e40790ab48bc2043cee630a7f96954935886f335

SHA512
4396c5815c3e2613083e4866d60a363f7cc6a38647abcacfcc7500d2b1654da4821b0c597368c490325196607c40ad80f19b12f87e8594c1e88f2a02a7a73357

Download Submit
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe
Filesize
1.6MB

MD5
0ea53df77445bfbde349bd4eed09dae1

SHA1
b4df1111097fbfb9a9ea3ad86ac130716fea12d0

SHA256
83f1a1d7936de3a686abf664e40790ab48bc2043cee630a7f96954935886f335

SHA512
4396c5815c3e2613083e4866d60a363f7cc6a38647abcacfcc7500d2b1654da4821b0c597368c490325196607c40ad80f19b12f87e8594c1e88f2a02a7a73357

Download Submit
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe
Filesize
1.6MB

MD5
0ea53df77445bfbde349bd4eed09dae1

SHA1
b4df1111097fbfb9a9ea3ad86ac130716fea12d0

SHA256
83f1a1d7936de3a686abf664e40790ab48bc2043cee630a7f96954935886f335

SHA512
4396c5815c3e2613083e4866d60a363f7cc6a38647abcacfcc7500d2b1654da4821b0c597368c490325196607c40ad80f19b12f87e8594c1e88f2a02a7a73357

Download Submit
C:\Users\Admin\AppData\Roaming\conhost_8.exe
Filesize
2.0MB

MD5
b521b2a220a99d820b688d4ad5db8067

SHA1
08e97a2e4871b789d3388fd51479710626b69a92

SHA256
55371f430ea0369bf4e079f39558a4c6c5462b19ddc9f16f064286288f50a12b

SHA512
2e4d9b8d556a609abae4dfedf18136618fb1bb8f77d3a596c97bffc2edde9dec147456dcf586c00de9a438b789599fe288de8117109b6b04db9045279b3caca1

Download Submit
C:\Users\Admin\AppData\Roaming\conhost_8.exe
Filesize
2.0MB

MD5
b521b2a220a99d820b688d4ad5db8067

SHA1
08e97a2e4871b789d3388fd51479710626b69a92

SHA256
55371f430ea0369bf4e079f39558a4c6c5462b19ddc9f16f064286288f50a12b

SHA512
2e4d9b8d556a609abae4dfedf18136618fb1bb8f77d3a596c97bffc2edde9dec147456dcf586c00de9a438b789599fe288de8117109b6b04db9045279b3caca1

Download Submit
memory/1372-249-0x000002689ACA0000-0x000002689ACB0000-memory.dmp

Filesize
64KB

Download
memory/1372-248-0x000002689ACA0000-0x000002689ACB0000-memory.dmp

Filesize
64KB

Download
memory/2300-252-0x000000001B030000-0x000000001B040000-memory.dmp

Filesize
64KB

Download
memory/2300-256-0x000000001B030000-0x000000001B040000-memory.dmp

Filesize
64KB

Download
memory/2300-254-0x000000001B030000-0x000000001B040000-memory.dmp

Filesize
64KB

Download
memory/2300-253-0x000000001B030000-0x000000001B040000-memory.dmp

Filesize
64KB

Download
memory/2300-255-0x000000001B030000-0x000000001B040000-memory.dmp

Filesize
64KB

Download
memory/2572-246-0x000000001B530000-0x000000001B540000-memory.dmp

Filesize
64KB

Download
memory/2572-247-0x000000001B530000-0x000000001B540000-memory.dmp

Filesize
64KB

Download
memory/2572-209-0x000000001B530000-0x000000001B540000-memory.dmp

Filesize
64KB

Download
memory/2572-210-0x000000001B530000-0x000000001B540000-memory.dmp

Filesize
64KB

Download
memory/2572-211-0x000000001B530000-0x000000001B540000-memory.dmp

Filesize
64KB

Download
memory/3092-133-0x0000000000400000-0x00000000015D9000-memory.dmp

Filesize
17.8MB

Download
memory/3092-166-0x0000000000400000-0x00000000015D9000-memory.dmp

Filesize
17.8MB

Download
memory/3092-136-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/3092-134-0x0000000000400000-0x00000000015D9000-memory.dmp

Filesize
17.8MB

Download
memory/3772-167-0x000000001C950000-0x000000001C960000-memory.dmp

Filesize
64KB

Download
memory/3772-186-0x000000001C950000-0x000000001C960000-memory.dmp

Filesize
64KB

Download
memory/3772-195-0x000000001C950000-0x000000001C960000-memory.dmp

Filesize
64KB

Download
memory/3772-178-0x000000001C950000-0x000000001C960000-memory.dmp

Filesize
64KB

Download
memory/3772-179-0x000000001C950000-0x000000001C960000-memory.dmp

Filesize
64KB

Download
memory/3772-169-0x000000001D590000-0x000000001DAB8000-memory.dmp

Filesize
5.2MB

Download
memory/3772-168-0x000000001C630000-0x000000001C680000-memory.dmp

Filesize
320KB

Download
memory/3772-155-0x0000000000450000-0x00000000005FE000-memory.dmp

Filesize
1.7MB

Download
memory/4372-200-0x0000029889750000-0x0000029889760000-memory.dmp

Filesize
64KB

Download
memory/4372-192-0x00000298896C0000-0x00000298896E2000-memory.dmp

Filesize
136KB

Download
memory/4372-199-0x0000029889750000-0x0000029889760000-memory.dmp

Filesize
64KB

Download
memory/4444-204-0x00007FF772250000-0x00007FF772465000-memory.dmp

Filesize
2.1MB

Download