dcrat | bb00399cf42ca87f984e2cfce9ffeeb514c66f24036a305989ecddca7857cf62

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2023, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1bfc612d584aa106f9784450c67dd4b7.exe
Size 1.4MB
Sample230331-we54eade6s
SHA256 bb00399cf42ca87f984e2cfce9ffeeb514c66f24036a305989ecddca7857cf62
MD5 1bfc612d584aa106f9784450c67dd4b7
SHA1 75edc8a7f8826ba38184b991a06f06c736358b74
SHA512 ae13f63cda3eb141b41749092b390451e4e353197e711172a07701f77d0c58596d69c5d222bb125f806e37ad4f8e588e35f12f6655c916ddd274b4b3af418242
SSDEEP 24576:DWPT5MjX0kvAwQwWdsWC1/Owi6Tn503L9CajagUG:DoTOjJvAXxC12wVT50bcrv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\debug\\RuntimeBroker.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\debug\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Windows\\en-US\\unsecapp.exe\", \"C:\\Users\\Default User\\csrss.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\debug\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Windows\\en-US\\unsecapp.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SearchApp.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\debug\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Windows\\en-US\\unsecapp.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\SppExtComObj.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Program Files\\Internet Explorer\\SIGNUP\\sysmon.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\debug\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Windows\\en-US\\unsecapp.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\SppExtComObj.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Program Files\\Internet Explorer\\SIGNUP\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Users\\Default User\\OfficeClickToRun.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\debug\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Windows\\en-US\\unsecapp.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\SppExtComObj.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Program Files\\Internet Explorer\\SIGNUP\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\debug\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\debug\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Windows\\en-US\\unsecapp.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\debug\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Windows\\en-US\\unsecapp.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\SppExtComObj.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\debug\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Windows\\en-US\\unsecapp.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\SppExtComObj.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\debug\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Windows\\en-US\\unsecapp.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SearchApp.exe\", \"C:\\Windows\\PolicyDefinitions\\SppExtComObj.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Program Files\\Internet Explorer\\SIGNUP\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	244	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4268	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	3436	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	3436	schtasks.exe	18

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3160-133-0x0000000000610000-0x0000000000778000-memory.dmp	dcrat
behavioral2/files/0x000600000002315c-144.dat	dcrat
behavioral2/files/0x000200000002186c-170.dat	dcrat
behavioral2/files/0x000200000002186c-168.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	1bfc612d584aa106f9784450c67dd4b7.exe

Executes dropped EXE 1 IoCs

pid	Process
2700	WmiPrvSE.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\debug\\RuntimeBroker.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\en-US\\unsecapp.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default User\\csrss.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files\\Internet Explorer\\SIGNUP\\sysmon.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default User\\RuntimeBroker.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\odt\\System.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\odt\\System.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\debug\\RuntimeBroker.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\odt\\WmiPrvSE.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SearchApp.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SearchApp.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\PolicyDefinitions\\SppExtComObj.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default User\\RuntimeBroker.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Users\\Default User\\OfficeClickToRun.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Users\\Default User\\OfficeClickToRun.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\odt\\WmiPrvSE.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\en-US\\unsecapp.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default User\\csrss.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\PolicyDefinitions\\SppExtComObj.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files\\Internet Explorer\\SIGNUP\\sysmon.exe\""	1bfc612d584aa106f9784450c67dd4b7.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	ipinfo.io
17	ipinfo.io

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\SIGNUP\121e5b5079f7c0	1bfc612d584aa106f9784450c67dd4b7.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SearchApp.exe	1bfc612d584aa106f9784450c67dd4b7.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\38384e6a620884	1bfc612d584aa106f9784450c67dd4b7.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\sysmon.exe	1bfc612d584aa106f9784450c67dd4b7.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\debug\RuntimeBroker.exe	1bfc612d584aa106f9784450c67dd4b7.exe
File created	C:\Windows\debug\9e8d7a4ca61bd9	1bfc612d584aa106f9784450c67dd4b7.exe
File created	C:\Windows\en-US\unsecapp.exe	1bfc612d584aa106f9784450c67dd4b7.exe
File created	C:\Windows\en-US\29c1c3cc0f7685	1bfc612d584aa106f9784450c67dd4b7.exe
File created	C:\Windows\PolicyDefinitions\SppExtComObj.exe	1bfc612d584aa106f9784450c67dd4b7.exe
File created	C:\Windows\PolicyDefinitions\e1ef82546f0b02	1bfc612d584aa106f9784450c67dd4b7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1112	schtasks.exe
4268	schtasks.exe
1372	schtasks.exe
4696	schtasks.exe
4816	schtasks.exe
3536	schtasks.exe
984	schtasks.exe
4012	schtasks.exe
1292	schtasks.exe
1128	schtasks.exe
4800	schtasks.exe
4300	schtasks.exe
4348	schtasks.exe
2304	schtasks.exe
4836	schtasks.exe
2220	schtasks.exe
2636	schtasks.exe
5040	schtasks.exe
244	schtasks.exe
4592	schtasks.exe
4432	schtasks.exe
4620	schtasks.exe
4576	schtasks.exe
3596	schtasks.exe
2308	schtasks.exe
4852	schtasks.exe
212	schtasks.exe
2104	schtasks.exe
2432	schtasks.exe
2832	schtasks.exe
4308	schtasks.exe
4748	schtasks.exe
4752	schtasks.exe
3292	schtasks.exe
1160	schtasks.exe
4228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3160	1bfc612d584aa106f9784450c67dd4b7.exe
3160	1bfc612d584aa106f9784450c67dd4b7.exe
3160	1bfc612d584aa106f9784450c67dd4b7.exe
3160	1bfc612d584aa106f9784450c67dd4b7.exe
3160	1bfc612d584aa106f9784450c67dd4b7.exe
3160	1bfc612d584aa106f9784450c67dd4b7.exe
3160	1bfc612d584aa106f9784450c67dd4b7.exe
3160	1bfc612d584aa106f9784450c67dd4b7.exe
3160	1bfc612d584aa106f9784450c67dd4b7.exe
3160	1bfc612d584aa106f9784450c67dd4b7.exe
3160	1bfc612d584aa106f9784450c67dd4b7.exe
3160	1bfc612d584aa106f9784450c67dd4b7.exe
3160	1bfc612d584aa106f9784450c67dd4b7.exe
3160	1bfc612d584aa106f9784450c67dd4b7.exe
3160	1bfc612d584aa106f9784450c67dd4b7.exe
3160	1bfc612d584aa106f9784450c67dd4b7.exe
3160	1bfc612d584aa106f9784450c67dd4b7.exe
2700	WmiPrvSE.exe
2700	WmiPrvSE.exe
2700	WmiPrvSE.exe
2700	WmiPrvSE.exe
2700	WmiPrvSE.exe
2700	WmiPrvSE.exe
2700	WmiPrvSE.exe
2700	WmiPrvSE.exe
2700	WmiPrvSE.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2700	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3160	1bfc612d584aa106f9784450c67dd4b7.exe
Token: SeDebugPrivilege	2700	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 2700	3160	1bfc612d584aa106f9784450c67dd4b7.exe	120
PID 3160 wrote to memory of 2700	3160	1bfc612d584aa106f9784450c67dd4b7.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1bfc612d584aa106f9784450c67dd4b7.exe
"C:\Users\Admin\AppData\Local\Temp\1bfc612d584aa106f9784450c67dd4b7.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160
- C:\odt\WmiPrvSE.exe
  "C:\odt\WmiPrvSE.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\odt\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\debug\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\debug\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\debug\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\odt\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Windows\en-US\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\en-US\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Windows\en-US\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Windows\PolicyDefinitions\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Windows\PolicyDefinitions\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\SIGNUP\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\SIGNUP\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\SIGNUP\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

csrss.exe

Path C:\Users\Default\csrss.exe
Size 1.4MB
SHA256 bb00399cf42ca87f984e2cfce9ffeeb514c66f24036a305989ecddca7857cf62
MD5 1bfc612d584aa106f9784450c67dd4b7
SHA1 75edc8a7f8826ba38184b991a06f06c736358b74
SHA512 ae13f63cda3eb141b41749092b390451e4e353197e711172a07701f77d0c58596d69c5d222bb125f806e37ad4f8e588e35f12f6655c916ddd274b4b3af418242
SSDEEP 24576:DWPT5MjX0kvAwQwWdsWC1/Owi6Tn503L9CajagUG:DoTOjJvAXxC12wVT50bcrv
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiPrvSE.exe

Path C:\odt\WmiPrvSE.exe
Size 1.4MB
SHA256 bb00399cf42ca87f984e2cfce9ffeeb514c66f24036a305989ecddca7857cf62
MD5 1bfc612d584aa106f9784450c67dd4b7
SHA1 75edc8a7f8826ba38184b991a06f06c736358b74
SHA512 ae13f63cda3eb141b41749092b390451e4e353197e711172a07701f77d0c58596d69c5d222bb125f806e37ad4f8e588e35f12f6655c916ddd274b4b3af418242
SSDEEP 24576:DWPT5MjX0kvAwQwWdsWC1/Owi6Tn503L9CajagUG:DoTOjJvAXxC12wVT50bcrv
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiPrvSE.exe

Path C:\odt\WmiPrvSE.exe
Size 1.4MB
SHA256 bb00399cf42ca87f984e2cfce9ffeeb514c66f24036a305989ecddca7857cf62
MD5 1bfc612d584aa106f9784450c67dd4b7
SHA1 75edc8a7f8826ba38184b991a06f06c736358b74
SHA512 ae13f63cda3eb141b41749092b390451e4e353197e711172a07701f77d0c58596d69c5d222bb125f806e37ad4f8e588e35f12f6655c916ddd274b4b3af418242
SSDEEP 24576:DWPT5MjX0kvAwQwWdsWC1/Owi6Tn503L9CajagUG:DoTOjJvAXxC12wVT50bcrv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2700-172-0x0000000003120000-0x0000000003130000-memory.dmp

Download

memory/2700-173-0x000000001D360000-0x000000001D4AE000-memory.dmp

Download

memory/2700-174-0x0000000003120000-0x0000000003130000-memory.dmp

Download

memory/3160-133-0x0000000000610000-0x0000000000778000-memory.dmp

Download

memory/3160-134-0x000000001C9F0000-0x000000001CA00000-memory.dmp

Download

memory/3160-135-0x000000001D000000-0x000000001D050000-memory.dmp

Download

memory/3160-171-0x000000001C830000-0x000000001C97E000-memory.dmp

Download