dcrat | 7b1c20701d541771b5819005700826712f27970a335dda7cf150e2564802d515

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2023 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2ea8c0f0b809338bc212b9dce4169c6.exe
Size

1.8MB
MD5

a2ea8c0f0b809338bc212b9dce4169c6
SHA1

2055d655fdc1da4d9090871b90a12a7d6f749d7d
SHA256

7b1c20701d541771b5819005700826712f27970a335dda7cf150e2564802d515
SHA512

e6fed299bc4590e94b9ec25c7ba16ee974b738961c8899ff670e7a5c6560361038ad5e970ddd207c90316455363d943a95b8afc5416b8dfcd755fc133f49e60e
SSDEEP

24576:26DZpO9y7b5UC4iSiLryeCB7sDmJEtQNUdvnCYjOjO45CT8xBVZHUnc9v8E99JG1:NDDHVHQNM1rcBUczNGHV

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 13 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

dllhost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\dllhost.exe\", \"C:\\Users\\Public\\fontdrvhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\Users\\All Users\\Application Data\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\Registry.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\TrustedInstaller.exe\", \"C:\\Users\\Default User\\wininit.exe\", \"C:\\odt\\System.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\dllhost.exe\", \"C:\\Users\\Public\\fontdrvhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\Users\\All Users\\Application Data\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\Registry.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\TrustedInstaller.exe\", \"C:\\Users\\Default User\\wininit.exe\", \"C:\\odt\\System.exe\", \"C:\\Users\\Public\\AccountPictures\\lsass.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\dllhost.exe\", \"C:\\Users\\Public\\fontdrvhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\Users\\All Users\\Application Data\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\Registry.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\dllhost.exe\", \"C:\\Users\\Public\\fontdrvhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\Users\\All Users\\Application Data\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\Registry.exe\", \"C:\\odt\\Registry.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\dllhost.exe\", \"C:\\Users\\Public\\fontdrvhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\Users\\All Users\\Application Data\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\Registry.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\TrustedInstaller.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\dllhost.exe\", \"C:\\Users\\Public\\fontdrvhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\Users\\All Users\\Application Data\\explorer.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\dllhost.exe\", \"C:\\Users\\Public\\fontdrvhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\Users\\All Users\\Application Data\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\Registry.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\TrustedInstaller.exe\", \"C:\\Users\\Default User\\wininit.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\dllhost.exe\", \"C:\\Users\\Public\\fontdrvhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\Users\\All Users\\Application Data\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\Registry.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\TrustedInstaller.exe\", \"C:\\Users\\Default User\\wininit.exe\", \"C:\\odt\\System.exe\", \"C:\\Users\\Public\\AccountPictures\\lsass.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\fontdrvhost.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\dllhost.exe\", \"C:\\Users\\Public\\fontdrvhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\Users\\All Users\\Application Data\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\Registry.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\TrustedInstaller.exe\", \"C:\\Users\\Default User\\wininit.exe\", \"C:\\odt\\System.exe\", \"C:\\Users\\Public\\AccountPictures\\lsass.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\dllhost.exe\", \"C:\\Users\\Public\\fontdrvhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\Users\\All Users\\Application Data\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\Registry.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\TrustedInstaller.exe\", \"C:\\Users\\Default User\\wininit.exe\", \"C:\\odt\\System.exe\", \"C:\\Users\\Public\\AccountPictures\\lsass.exe\", \"C:\\Users\\All Users\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\dllhost.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\dllhost.exe\", \"C:\\Users\\Public\\fontdrvhost.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\dllhost.exe\", \"C:\\Users\\Public\\fontdrvhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\""	dllhost.exe

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3696	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	236	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	328	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	400	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3384	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	4936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	4936	schtasks.exe

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Jjaxjjjbnfhspjlmroqdcratbuild (4).exe	dcrat
C:\Users\Admin\AppData\Local\Temp\Jjaxjjjbnfhspjlmroqdcratbuild (4).exe	dcrat
C:\Users\Admin\AppData\Local\Temp\Jjaxjjjbnfhspjlmroqdcratbuild (4).exe	dcrat
behavioral2/memory/2372-147-0x0000000000400000-0x0000000000456000-memory.dmp	dcrat
C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe	dcrat
C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe	dcrat
behavioral2/memory/3948-165-0x0000000000D80000-0x0000000000DD6000-memory.dmp	dcrat
C:\Users\Public\fontdrvhost.exe	dcrat
C:\Recovery\WindowsRE\TrustedInstaller.exe	dcrat
C:\Recovery\WindowsRE\TrustedInstaller.exe	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a2ea8c0f0b809338bc212b9dce4169c6.exeJjaxjjjbnfhspjlmroqdcratbuild (4).exeWScript.exedllhost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	a2ea8c0f0b809338bc212b9dce4169c6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 3 IoCs

Processes:

Jjaxjjjbnfhspjlmroqdcratbuild (4).exedllhost.exeTrustedInstaller.exe

pid process

632 Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
3948 dllhost.exe
3316 TrustedInstaller.exe

pid	process
632	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
3948	dllhost.exe
3316	TrustedInstaller.exe

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dllhost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Public\\Pictures\\Registry.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\All Users\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\fontdrvhost.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\All Users\\Application Data\\explorer.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Public\\Pictures\\Registry.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\odt\\Registry.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\odt\\Registry.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\odt\\System.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\odt\\dllhost.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\All Users\\Application Data\\explorer.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Recovery\\WindowsRE\\TrustedInstaller.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Recovery\\WindowsRE\\TrustedInstaller.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default User\\wininit.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\odt\\System.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Public\\AccountPictures\\lsass.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\All Users\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\fontdrvhost.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\odt\\csrss.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\odt\\dllhost.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Public\\fontdrvhost.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Public\\fontdrvhost.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default User\\wininit.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Public\\AccountPictures\\lsass.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\odt\\csrss.exe\""	dllhost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a2ea8c0f0b809338bc212b9dce4169c6.exe

description pid process target process

PID 3040 set thread context of 2372 3040 a2ea8c0f0b809338bc212b9dce4169c6.exe a2ea8c0f0b809338bc212b9dce4169c6.exe

description	pid	process	target process
PID 3040 set thread context of 2372	3040	a2ea8c0f0b809338bc212b9dce4169c6.exe	a2ea8c0f0b809338bc212b9dce4169c6.exe

Drops file in Program Files directory 4 IoCs

Processes:

dllhost.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\Idle.exe	dllhost.exe
File created	C:\Program Files\7-Zip\Lang\6ccacd8608530f	dllhost.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe	dllhost.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\9e8d7a4ca61bd9	dllhost.exe

Drops file in Windows directory 2 IoCs

Processes:

dllhost.exe

description ioc process

File created C:\Windows\ServiceState\WinHttpAutoProxySvc\Data\csrss.exe dllhost.exe
File created C:\Windows\CSC\dwm.exe dllhost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\ServiceState\WinHttpAutoProxySvc\Data\csrss.exe	dllhost.exe
File created	C:\Windows\CSC\dwm.exe	dllhost.exe

Creates scheduled task(s) 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
1596	schtasks.exe
1760	schtasks.exe
4212	schtasks.exe
1356	schtasks.exe
4236	schtasks.exe
228	schtasks.exe
4524	schtasks.exe
1552	schtasks.exe
2488	schtasks.exe
1528	schtasks.exe
2728	schtasks.exe
2140	schtasks.exe
2744	schtasks.exe
2972	schtasks.exe
236	schtasks.exe
2612	schtasks.exe
4816	schtasks.exe
2896	schtasks.exe
3084	schtasks.exe
3384	schtasks.exe
1652	schtasks.exe
4620	schtasks.exe
2748	schtasks.exe
3696	schtasks.exe
3292	schtasks.exe
328	schtasks.exe
400	schtasks.exe
708	schtasks.exe
4612	schtasks.exe
3928	schtasks.exe
4604	schtasks.exe
2416	schtasks.exe
1876	schtasks.exe
1988	schtasks.exe
1056	schtasks.exe
640	schtasks.exe
4564	schtasks.exe
3912	schtasks.exe
2536	schtasks.exe

Modifies registry class 1 IoCs

Processes:

Jjaxjjjbnfhspjlmroqdcratbuild (4).exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

a2ea8c0f0b809338bc212b9dce4169c6.exea2ea8c0f0b809338bc212b9dce4169c6.exedllhost.exeTrustedInstaller.exe

pid	process
3040	a2ea8c0f0b809338bc212b9dce4169c6.exe
3040	a2ea8c0f0b809338bc212b9dce4169c6.exe
2372	a2ea8c0f0b809338bc212b9dce4169c6.exe
2372	a2ea8c0f0b809338bc212b9dce4169c6.exe
2372	a2ea8c0f0b809338bc212b9dce4169c6.exe
2372	a2ea8c0f0b809338bc212b9dce4169c6.exe
2372	a2ea8c0f0b809338bc212b9dce4169c6.exe
2372	a2ea8c0f0b809338bc212b9dce4169c6.exe
2372	a2ea8c0f0b809338bc212b9dce4169c6.exe
2372	a2ea8c0f0b809338bc212b9dce4169c6.exe
2372	a2ea8c0f0b809338bc212b9dce4169c6.exe
3948	dllhost.exe
3948	dllhost.exe
3948	dllhost.exe
3948	dllhost.exe
3948	dllhost.exe
3948	dllhost.exe
3948	dllhost.exe
3948	dllhost.exe
3948	dllhost.exe
3948	dllhost.exe
3948	dllhost.exe
3948	dllhost.exe
3948	dllhost.exe
3948	dllhost.exe
3948	dllhost.exe
3948	dllhost.exe
3948	dllhost.exe
3316	TrustedInstaller.exe
3316	TrustedInstaller.exe
3316	TrustedInstaller.exe
3316	TrustedInstaller.exe
3316	TrustedInstaller.exe
3316	TrustedInstaller.exe
3316	TrustedInstaller.exe
3316	TrustedInstaller.exe
3316	TrustedInstaller.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

a2ea8c0f0b809338bc212b9dce4169c6.exeTrustedInstaller.exe

pid process

2372 a2ea8c0f0b809338bc212b9dce4169c6.exe
3316 TrustedInstaller.exe

pid	process
2372	a2ea8c0f0b809338bc212b9dce4169c6.exe
3316	TrustedInstaller.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

a2ea8c0f0b809338bc212b9dce4169c6.exea2ea8c0f0b809338bc212b9dce4169c6.exedllhost.exeTrustedInstaller.exe

description	pid	process
Token: SeDebugPrivilege	3040	a2ea8c0f0b809338bc212b9dce4169c6.exe
Token: SeDebugPrivilege	2372	a2ea8c0f0b809338bc212b9dce4169c6.exe
Token: SeDebugPrivilege	3948	dllhost.exe
Token: SeDebugPrivilege	3316	TrustedInstaller.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

a2ea8c0f0b809338bc212b9dce4169c6.exeJjaxjjjbnfhspjlmroqdcratbuild (4).exeWScript.execmd.exedllhost.exe

description	pid	process	target process
PID 3040 wrote to memory of 632	3040	a2ea8c0f0b809338bc212b9dce4169c6.exe	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
PID 3040 wrote to memory of 632	3040	a2ea8c0f0b809338bc212b9dce4169c6.exe	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
PID 3040 wrote to memory of 632	3040	a2ea8c0f0b809338bc212b9dce4169c6.exe	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
PID 3040 wrote to memory of 2400	3040	a2ea8c0f0b809338bc212b9dce4169c6.exe	a2ea8c0f0b809338bc212b9dce4169c6.exe
PID 3040 wrote to memory of 2400	3040	a2ea8c0f0b809338bc212b9dce4169c6.exe	a2ea8c0f0b809338bc212b9dce4169c6.exe
PID 3040 wrote to memory of 2400	3040	a2ea8c0f0b809338bc212b9dce4169c6.exe	a2ea8c0f0b809338bc212b9dce4169c6.exe
PID 3040 wrote to memory of 2372	3040	a2ea8c0f0b809338bc212b9dce4169c6.exe	a2ea8c0f0b809338bc212b9dce4169c6.exe
PID 3040 wrote to memory of 2372	3040	a2ea8c0f0b809338bc212b9dce4169c6.exe	a2ea8c0f0b809338bc212b9dce4169c6.exe
PID 3040 wrote to memory of 2372	3040	a2ea8c0f0b809338bc212b9dce4169c6.exe	a2ea8c0f0b809338bc212b9dce4169c6.exe
PID 3040 wrote to memory of 2372	3040	a2ea8c0f0b809338bc212b9dce4169c6.exe	a2ea8c0f0b809338bc212b9dce4169c6.exe
PID 3040 wrote to memory of 2372	3040	a2ea8c0f0b809338bc212b9dce4169c6.exe	a2ea8c0f0b809338bc212b9dce4169c6.exe
PID 3040 wrote to memory of 2372	3040	a2ea8c0f0b809338bc212b9dce4169c6.exe	a2ea8c0f0b809338bc212b9dce4169c6.exe
PID 3040 wrote to memory of 2372	3040	a2ea8c0f0b809338bc212b9dce4169c6.exe	a2ea8c0f0b809338bc212b9dce4169c6.exe
PID 3040 wrote to memory of 2372	3040	a2ea8c0f0b809338bc212b9dce4169c6.exe	a2ea8c0f0b809338bc212b9dce4169c6.exe
PID 632 wrote to memory of 2836	632	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe	WScript.exe
PID 632 wrote to memory of 2836	632	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe	WScript.exe
PID 632 wrote to memory of 2836	632	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe	WScript.exe
PID 2836 wrote to memory of 4496	2836	WScript.exe	cmd.exe
PID 2836 wrote to memory of 4496	2836	WScript.exe	cmd.exe
PID 2836 wrote to memory of 4496	2836	WScript.exe	cmd.exe
PID 4496 wrote to memory of 3948	4496	cmd.exe	dllhost.exe
PID 4496 wrote to memory of 3948	4496	cmd.exe	dllhost.exe
PID 3948 wrote to memory of 3316	3948	dllhost.exe	TrustedInstaller.exe
PID 3948 wrote to memory of 3316	3948	dllhost.exe	TrustedInstaller.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a2ea8c0f0b809338bc212b9dce4169c6.exe
"C:\Users\Admin\AppData\Local\Temp\a2ea8c0f0b809338bc212b9dce4169c6.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040

C:\Users\Admin\AppData\Local\Temp\Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
"C:\Users\Admin\AppData\Local\Temp\Jjaxjjjbnfhspjlmroqdcratbuild (4).exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:632

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Adobe\52gkn9uQF.vbe"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2836

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Adobe\yejrXrInbKlCAF.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:4496

C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe
"C:\Users\Admin\AppData\Roaming\\Adobe\dllhost.exe"
5⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948

C:\Recovery\WindowsRE\TrustedInstaller.exe
"C:\Recovery\WindowsRE\TrustedInstaller.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Users\Admin\AppData\Local\Temp\a2ea8c0f0b809338bc212b9dce4169c6.exe
C:\Users\Admin\AppData\Local\Temp\a2ea8c0f0b809338bc212b9dce4169c6.exe
2⤵
PID:2400

C:\Users\Admin\AppData\Local\Temp\a2ea8c0f0b809338bc212b9dce4169c6.exe
C:\Users\Admin\AppData\Local\Temp\a2ea8c0f0b809338bc212b9dce4169c6.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Public\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Public\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Application Data\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Application Data\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Pictures\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Pictures\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\odt\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\odt\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\Public\AccountPictures\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Public\AccountPictures\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\TrustedInstaller.exe
Filesize
315KB

MD5
3d4f1aeaa622ea7e8b48ee771fcdd7a8

SHA1
72fc8a599685a0c8c65cebd5082e8f430ca150f8

SHA256
8174f504f7182aadc73523cea6ecd0c3ad4710d3d42d5021d9bb6f0891886cb6

SHA512
b714e3b35d2e00de506ca0a37d00f20efd9ddce199f5824450e0f35b969432aa0b35f03873d0094dad286d38a5bffbd869e6f4e336ce7e04e06e2516c8f004b8

Download Submit
C:\Recovery\WindowsRE\TrustedInstaller.exe
Filesize
315KB

MD5
3d4f1aeaa622ea7e8b48ee771fcdd7a8

SHA1
72fc8a599685a0c8c65cebd5082e8f430ca150f8

SHA256
8174f504f7182aadc73523cea6ecd0c3ad4710d3d42d5021d9bb6f0891886cb6

SHA512
b714e3b35d2e00de506ca0a37d00f20efd9ddce199f5824450e0f35b969432aa0b35f03873d0094dad286d38a5bffbd869e6f4e336ce7e04e06e2516c8f004b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\a2ea8c0f0b809338bc212b9dce4169c6.exe.log
Filesize
1KB

MD5
4f3fab3e5f44399e7f4162fd367eca2d

SHA1
adada0591db5f53bcc0565942047156de3464e6e

SHA256
5db52f2a6a0fbfaa29e27418a1b72b660298dfa58a12ac0f12897a06e557caef

SHA512
d8c3fe3a91e572627e31a44d88a71fc3072786b074d04484ff6aacfeab43e0d29ec88bf6ad2af2a5f8e70f0c0eea95dcea59a8159adf4c642e5f8fd5fc632db7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
Filesize
625KB

MD5
9d9b928d96d953d897a2188a966b80ff

SHA1
31a78db2671a87af5ead30b11229f62854189cd0

SHA256
04228c9adeaa607dd537c69a15e2a176c85b731856a0243ae92c0d70c35c00c1

SHA512
ae73d3345b626f0e48edf7a6a666bd16a6bd617a28c61acdb1e4a247084642462b5e393c26cbc7a2e009ecc1a85c46281051e4c6262f62fec0f5a81e1cfcdc65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
Filesize
625KB

MD5
9d9b928d96d953d897a2188a966b80ff

SHA1
31a78db2671a87af5ead30b11229f62854189cd0

SHA256
04228c9adeaa607dd537c69a15e2a176c85b731856a0243ae92c0d70c35c00c1

SHA512
ae73d3345b626f0e48edf7a6a666bd16a6bd617a28c61acdb1e4a247084642462b5e393c26cbc7a2e009ecc1a85c46281051e4c6262f62fec0f5a81e1cfcdc65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
Filesize
625KB

MD5
9d9b928d96d953d897a2188a966b80ff

SHA1
31a78db2671a87af5ead30b11229f62854189cd0

SHA256
04228c9adeaa607dd537c69a15e2a176c85b731856a0243ae92c0d70c35c00c1

SHA512
ae73d3345b626f0e48edf7a6a666bd16a6bd617a28c61acdb1e4a247084642462b5e393c26cbc7a2e009ecc1a85c46281051e4c6262f62fec0f5a81e1cfcdc65

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\52gkn9uQF.vbe
Filesize
205B

MD5
241811b50c4ce030ecd48ebd49cd4a98

SHA1
4187db39f29719cb76395fb6d9ea2db872ac21bd

SHA256
d8835725b67daf4d34a4f49d8cdf3e6f5ca091372a38044960d3117248bae032

SHA512
9d4db48d1b2c2cdb079cdcd618da3edbba85c984f25f23d8cfdf9be0091b945c29b0e895530f6b292fd825a6023bc357716ffbf9cabb62997a6709a1e6f2c707

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe
Filesize
315KB

MD5
3d4f1aeaa622ea7e8b48ee771fcdd7a8

SHA1
72fc8a599685a0c8c65cebd5082e8f430ca150f8

SHA256
8174f504f7182aadc73523cea6ecd0c3ad4710d3d42d5021d9bb6f0891886cb6

SHA512
b714e3b35d2e00de506ca0a37d00f20efd9ddce199f5824450e0f35b969432aa0b35f03873d0094dad286d38a5bffbd869e6f4e336ce7e04e06e2516c8f004b8

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe
Filesize
315KB

MD5
3d4f1aeaa622ea7e8b48ee771fcdd7a8

SHA1
72fc8a599685a0c8c65cebd5082e8f430ca150f8

SHA256
8174f504f7182aadc73523cea6ecd0c3ad4710d3d42d5021d9bb6f0891886cb6

SHA512
b714e3b35d2e00de506ca0a37d00f20efd9ddce199f5824450e0f35b969432aa0b35f03873d0094dad286d38a5bffbd869e6f4e336ce7e04e06e2516c8f004b8

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\yejrXrInbKlCAF.bat
Filesize
30B

MD5
8a2510fd7b4b55da07578e53e62df857

SHA1
c2a3092371375e47e1d80531b09a5552faa9156c

SHA256
47eab317103b819eebe671607203c05d3bdf2531323515122a233f34099eb8f3

SHA512
573d8fed7c15abf74ada2c08f0a649167a1cdf57431e8d111de8ddb41eec88acee38cf869ef895dc9116bc49902b47815a4dde76935a5b02d67911470254a572

Download Submit
C:\Users\Public\fontdrvhost.exe
Filesize
315KB

MD5
3d4f1aeaa622ea7e8b48ee771fcdd7a8

SHA1
72fc8a599685a0c8c65cebd5082e8f430ca150f8

SHA256
8174f504f7182aadc73523cea6ecd0c3ad4710d3d42d5021d9bb6f0891886cb6

SHA512
b714e3b35d2e00de506ca0a37d00f20efd9ddce199f5824450e0f35b969432aa0b35f03873d0094dad286d38a5bffbd869e6f4e336ce7e04e06e2516c8f004b8

Download Submit
memory/2372-147-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2372-156-0x0000000005870000-0x0000000005880000-memory.dmp

Filesize
64KB

Download
memory/2372-159-0x0000000006FD0000-0x0000000007036000-memory.dmp

Filesize
408KB

Download
memory/2372-160-0x0000000005870000-0x0000000005880000-memory.dmp

Filesize
64KB

Download
memory/3040-137-0x0000000005BB0000-0x0000000005BC0000-memory.dmp

Filesize
64KB

Download
memory/3040-136-0x0000000005B80000-0x0000000005B8A000-memory.dmp

Filesize
40KB

Download
memory/3040-133-0x0000000000E70000-0x000000000103E000-memory.dmp

Filesize
1.8MB

Download
memory/3040-138-0x00000000076A0000-0x00000000076C2000-memory.dmp

Filesize
136KB

Download
memory/3040-135-0x00000000059F0000-0x0000000005A82000-memory.dmp

Filesize
584KB

Download
memory/3040-134-0x0000000005F00000-0x00000000064A4000-memory.dmp

Filesize
5.6MB

Download
memory/3316-204-0x000000001B700000-0x000000001B710000-memory.dmp

Filesize
64KB

Download
memory/3316-205-0x000000001B700000-0x000000001B710000-memory.dmp

Filesize
64KB

Download
memory/3948-165-0x0000000000D80000-0x0000000000DD6000-memory.dmp

Filesize
344KB

Download
memory/3948-170-0x000000001B9C0000-0x000000001B9D0000-memory.dmp

Filesize
64KB

Download