Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
10-06-2023 01:14
Behavioral task
behavioral1
Sample
2f476997ecdb5116621e72532460d7149299a6b058bee5b58501484da80d523b.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2f476997ecdb5116621e72532460d7149299a6b058bee5b58501484da80d523b.exe
Resource
win10v2004-20230220-en
General
-
Target
2f476997ecdb5116621e72532460d7149299a6b058bee5b58501484da80d523b.exe
-
Size
1.6MB
-
MD5
2baa6f19fa7f4ef5941e92335aa2c06d
-
SHA1
68c4872eba868d9e8b640e0e76cb1a4a00331d8e
-
SHA256
2f476997ecdb5116621e72532460d7149299a6b058bee5b58501484da80d523b
-
SHA512
ee875b4c223bba5864aa1d5ca165d798625442a8ef0a35ec16dc4283ad404d7656bfeeb262ef2ebdc8d3fe954416c019a210c59e2caba6507ae89f13d12d2d27
-
SSDEEP
24576:e2G/nvxW3WXeGxRoXGkxVsAjtxWCu2RdBaYwqf36eYmMyXxRlRYSZF083SFN:ebA3V6aXGkzFaPmUzyXnlqSZE
Malware Config
Signatures
-
DcRat 62 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Processes:
providerDriver.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription ioc process File created C:\Program Files\Windows Defender\it-IT\89b2ff246e3c18 providerDriver.exe 1636 schtasks.exe 964 schtasks.exe 1484 schtasks.exe 1140 schtasks.exe 1720 schtasks.exe 1764 schtasks.exe 1700 schtasks.exe File created C:\Windows\Media\Landscape\0a1fd5f707cd16 providerDriver.exe 1320 schtasks.exe 1548 schtasks.exe 752 schtasks.exe 1776 schtasks.exe 1980 schtasks.exe 2016 schtasks.exe 1508 schtasks.exe 864 schtasks.exe 1816 schtasks.exe 848 schtasks.exe 1704 schtasks.exe 1696 schtasks.exe 756 schtasks.exe 584 schtasks.exe 584 schtasks.exe 1664 schtasks.exe 1392 schtasks.exe 1608 schtasks.exe 1116 schtasks.exe 1912 schtasks.exe 1924 schtasks.exe 1936 schtasks.exe 1392 schtasks.exe 1508 schtasks.exe 1320 schtasks.exe 1480 schtasks.exe 1652 schtasks.exe 856 schtasks.exe 1316 schtasks.exe 1612 schtasks.exe 1616 schtasks.exe 1892 schtasks.exe 1728 schtasks.exe 864 schtasks.exe 1872 schtasks.exe 588 schtasks.exe 1984 schtasks.exe 1824 schtasks.exe 1212 schtasks.exe 1880 schtasks.exe 1236 schtasks.exe 756 schtasks.exe 944 schtasks.exe 1192 schtasks.exe 1136 schtasks.exe 1912 schtasks.exe 1896 schtasks.exe 1500 schtasks.exe 1268 schtasks.exe 1916 schtasks.exe 1996 schtasks.exe 1668 schtasks.exe 1956 schtasks.exe -
Process spawned unexpected child process 60 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1316 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 584 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1664 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1484 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 752 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1392 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 756 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1896 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1912 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1880 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1140 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 864 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1996 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1612 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1608 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1500 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1320 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1816 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1636 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 848 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1924 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1776 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 584 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1236 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1704 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1872 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1936 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1696 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 944 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1980 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1508 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1616 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 756 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1548 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1480 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1720 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1652 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1824 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 964 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1892 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1320 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1668 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1192 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 856 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1212 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 588 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1984 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1956 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1392 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1116 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1268 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1136 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1764 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1728 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2016 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1916 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1700 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1508 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 864 1424 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1912 1424 schtasks.exe -
Processes:
resource yara_rule \providercomponentbrowsersessionnet\providerDriver.exe dcrat C:\providercomponentbrowsersessionnet\providerDriver.exe dcrat \providercomponentbrowsersessionnet\providerDriver.exe dcrat C:\providercomponentbrowsersessionnet\providerDriver.exe dcrat behavioral1/memory/668-67-0x00000000012F0000-0x000000000144E000-memory.dmp dcrat C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\smss.exe dcrat C:\providercomponentbrowsersessionnet\providerDriver.exe dcrat behavioral1/memory/2000-86-0x00000000003D0000-0x0000000000450000-memory.dmp dcrat C:\Program Files\Windows Media Player\Visualizations\smss.exe dcrat C:\Program Files\Windows Media Player\Visualizations\smss.exe dcrat behavioral1/memory/2024-124-0x0000000001100000-0x000000000125E000-memory.dmp dcrat behavioral1/memory/2024-125-0x000000001B280000-0x000000001B300000-memory.dmp dcrat behavioral1/memory/2024-155-0x000000001B280000-0x000000001B300000-memory.dmp dcrat -
Executes dropped EXE 3 IoCs
Processes:
providerDriver.exeproviderDriver.exesmss.exepid process 668 providerDriver.exe 2000 providerDriver.exe 2024 smss.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1508 cmd.exe 1508 cmd.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 ipinfo.io 8 ipinfo.io -
Drops file in Program Files directory 10 IoCs
Processes:
providerDriver.exeproviderDriver.exedescription ioc process File created C:\Program Files\Windows Defender\it-IT\providerDriver.exe providerDriver.exe File created C:\Program Files (x86)\Microsoft Office\Office14\3082\lsm.exe providerDriver.exe File created C:\Program Files (x86)\Microsoft Office\Office14\3082\101b941d020240 providerDriver.exe File created C:\Program Files\Windows Media Player\Visualizations\smss.exe providerDriver.exe File created C:\Program Files\Windows Media Player\Visualizations\69ddcba757bf72 providerDriver.exe File created C:\Program Files\Windows Defender\it-IT\89b2ff246e3c18 providerDriver.exe File created C:\Program Files\Windows Journal\Templates\WmiPrvSE.exe providerDriver.exe File created C:\Program Files\Windows Journal\Templates\24dbde2999530e providerDriver.exe File created C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe providerDriver.exe File created C:\Program Files\Windows NT\TableTextService\en-US\886983d96e3d3e providerDriver.exe -
Drops file in Windows directory 4 IoCs
Processes:
providerDriver.exeproviderDriver.exedescription ioc process File created C:\Windows\Media\Landscape\0a1fd5f707cd16 providerDriver.exe File created C:\Windows\winsxs\lsass.exe providerDriver.exe File created C:\Windows\Speech\Common\de-DE\dwm.exe providerDriver.exe File created C:\Windows\Media\Landscape\sppsvc.exe providerDriver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 60 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1664 schtasks.exe 864 schtasks.exe 1816 schtasks.exe 1872 schtasks.exe 1320 schtasks.exe 964 schtasks.exe 1508 schtasks.exe 756 schtasks.exe 848 schtasks.exe 1764 schtasks.exe 1912 schtasks.exe 1896 schtasks.exe 1548 schtasks.exe 856 schtasks.exe 2016 schtasks.exe 1916 schtasks.exe 1924 schtasks.exe 1776 schtasks.exe 1236 schtasks.exe 1936 schtasks.exe 1824 schtasks.exe 1956 schtasks.exe 1116 schtasks.exe 864 schtasks.exe 1500 schtasks.exe 1320 schtasks.exe 756 schtasks.exe 1728 schtasks.exe 1140 schtasks.exe 944 schtasks.exe 1480 schtasks.exe 1984 schtasks.exe 584 schtasks.exe 1880 schtasks.exe 1268 schtasks.exe 1636 schtasks.exe 1892 schtasks.exe 1720 schtasks.exe 588 schtasks.exe 1136 schtasks.exe 1484 schtasks.exe 1912 schtasks.exe 1612 schtasks.exe 1608 schtasks.exe 1704 schtasks.exe 1980 schtasks.exe 1392 schtasks.exe 1700 schtasks.exe 1392 schtasks.exe 1616 schtasks.exe 1652 schtasks.exe 1668 schtasks.exe 1192 schtasks.exe 1212 schtasks.exe 1316 schtasks.exe 752 schtasks.exe 1996 schtasks.exe 1696 schtasks.exe 584 schtasks.exe 1508 schtasks.exe -
Processes:
smss.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 smss.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 smss.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 smss.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 smss.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 smss.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
providerDriver.exeproviderDriver.exesmss.exepid process 668 providerDriver.exe 668 providerDriver.exe 668 providerDriver.exe 668 providerDriver.exe 668 providerDriver.exe 2000 providerDriver.exe 2000 providerDriver.exe 2000 providerDriver.exe 2000 providerDriver.exe 2000 providerDriver.exe 2000 providerDriver.exe 2000 providerDriver.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe 2024 smss.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
providerDriver.exeproviderDriver.exesmss.exedescription pid process Token: SeDebugPrivilege 668 providerDriver.exe Token: SeDebugPrivilege 2000 providerDriver.exe Token: SeDebugPrivilege 2024 smss.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
2f476997ecdb5116621e72532460d7149299a6b058bee5b58501484da80d523b.exeWScript.execmd.exeproviderDriver.exeproviderDriver.exedescription pid process target process PID 2000 wrote to memory of 1964 2000 2f476997ecdb5116621e72532460d7149299a6b058bee5b58501484da80d523b.exe WScript.exe PID 2000 wrote to memory of 1964 2000 2f476997ecdb5116621e72532460d7149299a6b058bee5b58501484da80d523b.exe WScript.exe PID 2000 wrote to memory of 1964 2000 2f476997ecdb5116621e72532460d7149299a6b058bee5b58501484da80d523b.exe WScript.exe PID 2000 wrote to memory of 1964 2000 2f476997ecdb5116621e72532460d7149299a6b058bee5b58501484da80d523b.exe WScript.exe PID 1964 wrote to memory of 1508 1964 WScript.exe cmd.exe PID 1964 wrote to memory of 1508 1964 WScript.exe cmd.exe PID 1964 wrote to memory of 1508 1964 WScript.exe cmd.exe PID 1964 wrote to memory of 1508 1964 WScript.exe cmd.exe PID 1508 wrote to memory of 668 1508 cmd.exe providerDriver.exe PID 1508 wrote to memory of 668 1508 cmd.exe providerDriver.exe PID 1508 wrote to memory of 668 1508 cmd.exe providerDriver.exe PID 1508 wrote to memory of 668 1508 cmd.exe providerDriver.exe PID 668 wrote to memory of 2000 668 providerDriver.exe providerDriver.exe PID 668 wrote to memory of 2000 668 providerDriver.exe providerDriver.exe PID 668 wrote to memory of 2000 668 providerDriver.exe providerDriver.exe PID 2000 wrote to memory of 2024 2000 providerDriver.exe smss.exe PID 2000 wrote to memory of 2024 2000 providerDriver.exe smss.exe PID 2000 wrote to memory of 2024 2000 providerDriver.exe smss.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f476997ecdb5116621e72532460d7149299a6b058bee5b58501484da80d523b.exe"C:\Users\Admin\AppData\Local\Temp\2f476997ecdb5116621e72532460d7149299a6b058bee5b58501484da80d523b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercomponentbrowsersessionnet\RMsUvdXKMQWO2B.vbe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\providercomponentbrowsersessionnet\VeZgJ.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\providercomponentbrowsersessionnet\providerDriver.exe"C:\providercomponentbrowsersessionnet\providerDriver.exe"4⤵
- DcRat
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\providercomponentbrowsersessionnet\providerDriver.exe"C:\providercomponentbrowsersessionnet\providerDriver.exe"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Windows Media Player\Visualizations\smss.exe"C:\Program Files\Windows Media Player\Visualizations\smss.exe"6⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\providercomponentbrowsersessionnet\wininit.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercomponentbrowsersessionnet\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\providercomponentbrowsersessionnet\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "providerDriverp" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\it-IT\providerDriver.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "providerDriver" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\it-IT\providerDriver.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "providerDriverp" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\it-IT\providerDriver.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\smss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Searches\smss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Admin\Searches\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Searches\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Windows\Media\Landscape\sppsvc.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Media\Landscape\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Windows\Media\Landscape\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\WmiPrvSE.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\spoolsv.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\spoolsv.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\spoolsv.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Recorded TV\Sample Media\Idle.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\Recorded TV\Sample Media\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Recorded TV\Sample Media\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Default\PrintHood\smss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Default\PrintHood\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Journal\Templates\WmiPrvSE.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\Templates\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Journal\Templates\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\winlogon.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Office\Office14\3082\lsm.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Office14\3082\lsm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Office\Office14\3082\lsm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\Visualizations\smss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Visualizations\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\Visualizations\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\providercomponentbrowsersessionnet\dwm.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercomponentbrowsersessionnet\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\providercomponentbrowsersessionnet\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\services.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\winlogon.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\wininit.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\WmiPrvSE.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Windows Media Player\Visualizations\smss.exeFilesize
1.3MB
MD5859a819f981ca77301ff688f574fdcb1
SHA1a071e3d67c5e92caf3d417005bd5311e9012fae7
SHA256406c06dd07479d167bd2cc4d482811c4497b5b766eb185b6d7987af1048fee0a
SHA51229dfd1101a3798efea8d2d5ebf16b089e3cbe19f81c830dbf924b3e61b63062f1eed183c40bee8fea5d63d8ee6b634215c568129999182b341bfbd3e73437179
-
C:\Program Files\Windows Media Player\Visualizations\smss.exeFilesize
1.3MB
MD5859a819f981ca77301ff688f574fdcb1
SHA1a071e3d67c5e92caf3d417005bd5311e9012fae7
SHA256406c06dd07479d167bd2cc4d482811c4497b5b766eb185b6d7987af1048fee0a
SHA51229dfd1101a3798efea8d2d5ebf16b089e3cbe19f81c830dbf924b3e61b63062f1eed183c40bee8fea5d63d8ee6b634215c568129999182b341bfbd3e73437179
-
C:\Recovery\27d94b62-b1ad-11ed-92fd-88b2a2eec794\smss.exeFilesize
1.3MB
MD5859a819f981ca77301ff688f574fdcb1
SHA1a071e3d67c5e92caf3d417005bd5311e9012fae7
SHA256406c06dd07479d167bd2cc4d482811c4497b5b766eb185b6d7987af1048fee0a
SHA51229dfd1101a3798efea8d2d5ebf16b089e3cbe19f81c830dbf924b3e61b63062f1eed183c40bee8fea5d63d8ee6b634215c568129999182b341bfbd3e73437179
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD56b0274a7406c84552fd7d3aef7641a36
SHA1d87df670c03a22822c1e8f4a2d78da5d4b1c4d76
SHA2560b57ce35ed9caec2b5f9e2092bcb39e635a068c624fdcb63e062eed1b9f14d0e
SHA512322f871f7817ea11df260a68b7e753206abe30a11b7f895c37d63d98d6c7a5c1eaecf476a611fb0a158a1baee689a34a846396f237b19daac8d6844659929a1f
-
C:\Users\Admin\AppData\Local\Temp\CabAE5C.tmpFilesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\Local\Temp\TarAF8B.tmpFilesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
C:\providercomponentbrowsersessionnet\RMsUvdXKMQWO2B.vbeFilesize
216B
MD55def842da05330520251c8387fad9324
SHA1280555ffb06b6140968c4e283ccf626600bd76d5
SHA2568c848ba2be36eac17d91fde15420454ba880b08fabc0d5f6a8b5a1a7490d9bcb
SHA512aca06163bf5d80c5a7f7d1be66da2553dc438303143e3813b334dbe528278893e20722d30668b4be639a9a799acb546c2cd481d086b963357b903f65b6eb83ca
-
C:\providercomponentbrowsersessionnet\VeZgJ.batFilesize
58B
MD5936487934c40b7b6efbede5d4665bfe5
SHA1f5119e4128c38bf607c07a100f670be4b033c4ea
SHA2567734b8c67c13c61d236a9f437875a85ae13450720be7e4ce398a4e197136395d
SHA5121bda0aaab8f4988924525c264e6e05a2b16aae2834cd3863474dd31f2581ddb16458bb6fea1cc8edfaec97901af2926be7e28f28f46dc96d039d59176761d2d3
-
C:\providercomponentbrowsersessionnet\providerDriver.exeFilesize
1.3MB
MD5859a819f981ca77301ff688f574fdcb1
SHA1a071e3d67c5e92caf3d417005bd5311e9012fae7
SHA256406c06dd07479d167bd2cc4d482811c4497b5b766eb185b6d7987af1048fee0a
SHA51229dfd1101a3798efea8d2d5ebf16b089e3cbe19f81c830dbf924b3e61b63062f1eed183c40bee8fea5d63d8ee6b634215c568129999182b341bfbd3e73437179
-
C:\providercomponentbrowsersessionnet\providerDriver.exeFilesize
1.3MB
MD5859a819f981ca77301ff688f574fdcb1
SHA1a071e3d67c5e92caf3d417005bd5311e9012fae7
SHA256406c06dd07479d167bd2cc4d482811c4497b5b766eb185b6d7987af1048fee0a
SHA51229dfd1101a3798efea8d2d5ebf16b089e3cbe19f81c830dbf924b3e61b63062f1eed183c40bee8fea5d63d8ee6b634215c568129999182b341bfbd3e73437179
-
C:\providercomponentbrowsersessionnet\providerDriver.exeFilesize
1.3MB
MD5859a819f981ca77301ff688f574fdcb1
SHA1a071e3d67c5e92caf3d417005bd5311e9012fae7
SHA256406c06dd07479d167bd2cc4d482811c4497b5b766eb185b6d7987af1048fee0a
SHA51229dfd1101a3798efea8d2d5ebf16b089e3cbe19f81c830dbf924b3e61b63062f1eed183c40bee8fea5d63d8ee6b634215c568129999182b341bfbd3e73437179
-
\providercomponentbrowsersessionnet\providerDriver.exeFilesize
1.3MB
MD5859a819f981ca77301ff688f574fdcb1
SHA1a071e3d67c5e92caf3d417005bd5311e9012fae7
SHA256406c06dd07479d167bd2cc4d482811c4497b5b766eb185b6d7987af1048fee0a
SHA51229dfd1101a3798efea8d2d5ebf16b089e3cbe19f81c830dbf924b3e61b63062f1eed183c40bee8fea5d63d8ee6b634215c568129999182b341bfbd3e73437179
-
\providercomponentbrowsersessionnet\providerDriver.exeFilesize
1.3MB
MD5859a819f981ca77301ff688f574fdcb1
SHA1a071e3d67c5e92caf3d417005bd5311e9012fae7
SHA256406c06dd07479d167bd2cc4d482811c4497b5b766eb185b6d7987af1048fee0a
SHA51229dfd1101a3798efea8d2d5ebf16b089e3cbe19f81c830dbf924b3e61b63062f1eed183c40bee8fea5d63d8ee6b634215c568129999182b341bfbd3e73437179
-
memory/668-68-0x0000000000240000-0x000000000024E000-memory.dmpFilesize
56KB
-
memory/668-70-0x0000000000270000-0x0000000000280000-memory.dmpFilesize
64KB
-
memory/668-73-0x0000000000560000-0x000000000056E000-memory.dmpFilesize
56KB
-
memory/668-72-0x0000000000550000-0x000000000055C000-memory.dmpFilesize
48KB
-
memory/668-67-0x00000000012F0000-0x000000000144E000-memory.dmpFilesize
1.4MB
-
memory/668-76-0x000000001A8A0000-0x000000001A920000-memory.dmpFilesize
512KB
-
memory/668-69-0x0000000000250000-0x000000000026C000-memory.dmpFilesize
112KB
-
memory/668-71-0x0000000000390000-0x00000000003A2000-memory.dmpFilesize
72KB
-
memory/2000-86-0x00000000003D0000-0x0000000000450000-memory.dmpFilesize
512KB
-
memory/2000-87-0x0000000000330000-0x0000000000342000-memory.dmpFilesize
72KB
-
memory/2024-126-0x0000000000900000-0x0000000000912000-memory.dmpFilesize
72KB
-
memory/2024-155-0x000000001B280000-0x000000001B300000-memory.dmpFilesize
512KB
-
memory/2024-125-0x000000001B280000-0x000000001B300000-memory.dmpFilesize
512KB
-
memory/2024-124-0x0000000001100000-0x000000000125E000-memory.dmpFilesize
1.4MB