dcrat | 7b1c20701d541771b5819005700826712f27970a335dda7cf150e2564802d515

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2023 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07132599.exe
Size

1.8MB
MD5

a2ea8c0f0b809338bc212b9dce4169c6
SHA1

2055d655fdc1da4d9090871b90a12a7d6f749d7d
SHA256

7b1c20701d541771b5819005700826712f27970a335dda7cf150e2564802d515
SHA512

e6fed299bc4590e94b9ec25c7ba16ee974b738961c8899ff670e7a5c6560361038ad5e970ddd207c90316455363d943a95b8afc5416b8dfcd755fc133f49e60e
SSDEEP

24576:26DZpO9y7b5UC4iSiLryeCB7sDmJEtQNUdvnCYjOjO45CT8xBVZHUnc9v8E99JG1:NDDHVHQNM1rcBUczNGHV

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 22 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

dllhost.exedllhost.exedllhost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\Idle.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\Idle.exe\", \"C:\\Program Files\\7-Zip\\Lang\\dwm.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\Idle.exe\", \"C:\\Program Files\\7-Zip\\Lang\\dwm.exe\", \"C:\\Users\\Admin\\Cookies\\spoolsv.exe\", \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\23\\RuntimeBroker.exe\", \"C:\\Windows\\Fonts\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\MSBuild\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\wininit.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\Idle.exe\", \"C:\\Program Files\\7-Zip\\Lang\\dwm.exe\", \"C:\\Users\\Admin\\Cookies\\spoolsv.exe\", \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\23\\RuntimeBroker.exe\", \"C:\\Windows\\Fonts\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\MSBuild\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\wininit.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\", \"C:\\odt\\wininit.exe\", \"C:\\Program Files (x86)\\Microsoft\\Temp\\StartMenuExperienceHost.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\Idle.exe\", \"C:\\Program Files\\7-Zip\\Lang\\dwm.exe\", \"C:\\Users\\Admin\\Cookies\\spoolsv.exe\", \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\23\\RuntimeBroker.exe\", \"C:\\Windows\\Fonts\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\MSBuild\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\wininit.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\", \"C:\\odt\\wininit.exe\", \"C:\\Program Files (x86)\\Microsoft\\Temp\\StartMenuExperienceHost.exe\", \"C:\\odt\\smss.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\Idle.exe\", \"C:\\Program Files\\7-Zip\\Lang\\dwm.exe\", \"C:\\Users\\Admin\\Cookies\\spoolsv.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\odt\\lsass.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\Idle.exe\", \"C:\\Program Files\\7-Zip\\Lang\\dwm.exe\", \"C:\\Users\\Admin\\Cookies\\spoolsv.exe\", \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\23\\RuntimeBroker.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\Idle.exe\", \"C:\\Program Files\\7-Zip\\Lang\\dwm.exe\", \"C:\\Users\\Admin\\Cookies\\spoolsv.exe\", \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\23\\RuntimeBroker.exe\", \"C:\\Windows\\Fonts\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\MSBuild\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\wininit.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\", \"C:\\odt\\wininit.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files\\Uninstall Information\\services.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\Idle.exe\", \"C:\\Program Files\\7-Zip\\Lang\\dwm.exe\", \"C:\\Users\\Admin\\Cookies\\spoolsv.exe\", \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\23\\RuntimeBroker.exe\", \"C:\\Windows\\Fonts\\SppExtComObj.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\Idle.exe\", \"C:\\Program Files\\7-Zip\\Lang\\dwm.exe\", \"C:\\Users\\Admin\\Cookies\\spoolsv.exe\", \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\23\\RuntimeBroker.exe\", \"C:\\Windows\\Fonts\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\MSBuild\\StartMenuExperienceHost.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\Idle.exe\", \"C:\\Program Files\\7-Zip\\Lang\\dwm.exe\", \"C:\\Users\\Admin\\Cookies\\spoolsv.exe\", \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\23\\RuntimeBroker.exe\", \"C:\\Windows\\Fonts\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\MSBuild\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\wininit.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\07132599.exe\", \"C:\\odt\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\Idle.exe\", \"C:\\Program Files\\7-Zip\\Lang\\dwm.exe\", \"C:\\Users\\Admin\\Cookies\\spoolsv.exe\", \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\23\\RuntimeBroker.exe\", \"C:\\Windows\\Fonts\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\MSBuild\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\wininit.exe\", \"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\", \"C:\\odt\\wininit.exe\", \"C:\\Program Files (x86)\\Microsoft\\Temp\\StartMenuExperienceHost.exe\", \"C:\\odt\\smss.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\apppatch\\sppsvc.exe\""	dllhost.exe

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	480	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3284	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4176	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	808	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3740	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4136	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	804	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	516	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3924	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4208	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3904	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	100	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	4436	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	4436	schtasks.exe

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Jjaxjjjbnfhspjlmroqdcratbuild (4).exe	dcrat
C:\Users\Admin\AppData\Local\Temp\Jjaxjjjbnfhspjlmroqdcratbuild (4).exe	dcrat
behavioral2/memory/320-146-0x0000000000400000-0x0000000000456000-memory.dmp	dcrat
C:\Users\Admin\AppData\Local\Temp\Jjaxjjjbnfhspjlmroqdcratbuild (4).exe	dcrat
C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe	dcrat
C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe	dcrat
behavioral2/memory/1928-165-0x0000000000550000-0x00000000005A6000-memory.dmp	dcrat
C:\Program Files\Uninstall Information\07132599.exe	dcrat
C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe	dcrat
C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe	dcrat
C:\Users\Admin\Templates\RuntimeBroker.exe	dcrat
C:\odt\smss.exe	dcrat
C:\odt\smss.exe	dcrat

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Jjaxjjjbnfhspjlmroqdcratbuild (4).exeWScript.exedllhost.exedllhost.exedllhost.exe07132599.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	07132599.exe

Executes dropped EXE 5 IoCs

Processes:

Jjaxjjjbnfhspjlmroqdcratbuild (4).exedllhost.exedllhost.exedllhost.exesmss.exe

pid process

2848 Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
1928 dllhost.exe
1920 dllhost.exe
4568 dllhost.exe
432 smss.exe

pid	process
2848	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
1928	dllhost.exe
1920	dllhost.exe
4568	dllhost.exe
432	smss.exe

Adds Run key to start application 2 TTPs 44 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dllhost.exedllhost.exedllhost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\odt\\wininit.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\odt\\lsass.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\23\\RuntimeBroker.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\MSBuild\\StartMenuExperienceHost.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\MSBuild\\StartMenuExperienceHost.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Multimedia Platform\\wininit.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Default User\\explorer.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\Idle.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\07132599 = "\"C:\\Program Files\\Uninstall Information\\07132599.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Recovery\\WindowsRE\\cmd.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Uninstall Information\\services.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\7-Zip\\Lang\\dwm.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\odt\\smss.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\odt\\taskhostw.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\Fonts\\SppExtComObj.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\odt\\wininit.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\Microsoft\\Temp\\StartMenuExperienceHost.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\odt\\smss.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Recovery\\WindowsRE\\cmd.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\Idle.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\7-Zip\\Lang\\dwm.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\apppatch\\sppsvc.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\apppatch\\sppsvc.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\07132599 = "\"C:\\Program Files\\Uninstall Information\\07132599.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\WindowsRE\\System.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Uninstall Information\\services.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Admin\\Cookies\\spoolsv.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\odt\\taskhostw.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Default User\\explorer.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\WindowsRE\\System.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\Microsoft\\Temp\\StartMenuExperienceHost.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\odt\\lsass.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\Templates\\RuntimeBroker.exe\""	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Admin\\Cookies\\spoolsv.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\23\\RuntimeBroker.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\Fonts\\SppExtComObj.exe\""	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Multimedia Platform\\wininit.exe\""	dllhost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

07132599.exe

description pid process target process

PID 1788 set thread context of 320 1788 07132599.exe 07132599.exe

description	pid	process	target process
PID 1788 set thread context of 320	1788	07132599.exe	07132599.exe

Drops file in Program Files directory 15 IoCs

Processes:

dllhost.exedllhost.exe

description	ioc	process
File created	C:\Program Files\Uninstall Information\services.exe	dllhost.exe
File created	C:\Program Files\Uninstall Information\801c65bd10dbde	dllhost.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\Idle.exe	dllhost.exe
File created	C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe	dllhost.exe
File created	C:\Program Files\Windows Multimedia Platform\wininit.exe	dllhost.exe
File created	C:\Program Files\Windows Multimedia Platform\56085415360792	dllhost.exe
File created	C:\Program Files\Uninstall Information\07132599.exe	dllhost.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\6ccacd8608530f	dllhost.exe
File created	C:\Program Files (x86)\Microsoft\Temp\StartMenuExperienceHost.exe	dllhost.exe
File created	C:\Program Files (x86)\Microsoft\Temp\55b276f4edf653	dllhost.exe
File created	C:\Program Files\Uninstall Information\c5b4cb5e9653cc	dllhost.exe
File created	C:\Program Files\7-Zip\Lang\dwm.exe	dllhost.exe
File created	C:\Program Files\7-Zip\Lang\6cb0b6c459d5d3	dllhost.exe
File created	C:\Program Files (x86)\MSBuild\55b276f4edf653	dllhost.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\Idle.exe	dllhost.exe

Drops file in Windows directory 7 IoCs

Processes:

dllhost.exedllhost.exe

description	ioc	process
File created	C:\Windows\apppatch\0a1fd5f707cd16	dllhost.exe
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\RuntimeBroker.exe	dllhost.exe
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\9e8d7a4ca61bd9	dllhost.exe
File created	C:\Windows\Fonts\SppExtComObj.exe	dllhost.exe
File created	C:\Windows\Fonts\e1ef82546f0b02	dllhost.exe
File created	C:\Windows\apppatch\sppsvc.exe	dllhost.exe
File opened for modification	C:\Windows\apppatch\sppsvc.exe	dllhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
4140	schtasks.exe
1292	schtasks.exe
4404	schtasks.exe
1644	schtasks.exe
1412	schtasks.exe
4016	schtasks.exe
4448	schtasks.exe
532	schtasks.exe
2908	schtasks.exe
1528	schtasks.exe
2848	schtasks.exe
924	schtasks.exe
3300	schtasks.exe
2668	schtasks.exe
2536	schtasks.exe
3088	schtasks.exe
3740	schtasks.exe
2344	schtasks.exe
480	schtasks.exe
976	schtasks.exe
2216	schtasks.exe
4416	schtasks.exe
1048	schtasks.exe
100	schtasks.exe
2960	schtasks.exe
4608	schtasks.exe
4928	schtasks.exe
4348	schtasks.exe
1984	schtasks.exe
4176	schtasks.exe
1748	schtasks.exe
5044	schtasks.exe
4880	schtasks.exe
3284	schtasks.exe
1972	schtasks.exe
1620	schtasks.exe
1584	schtasks.exe
4704	schtasks.exe
1752	schtasks.exe
4424	schtasks.exe
4272	schtasks.exe
1632	schtasks.exe
1792	schtasks.exe
3904	schtasks.exe
808	schtasks.exe
2156	schtasks.exe
3348	schtasks.exe
4136	schtasks.exe
2176	schtasks.exe
548	schtasks.exe
2312	schtasks.exe
5024	schtasks.exe
3924	schtasks.exe
2128	schtasks.exe
2340	schtasks.exe
516	schtasks.exe
2816	schtasks.exe
4520	schtasks.exe
3732	schtasks.exe
2408	schtasks.exe
4532	schtasks.exe
1744	schtasks.exe
2744	schtasks.exe
804	schtasks.exe

Modifies registry class 2 IoCs

Processes:

Jjaxjjjbnfhspjlmroqdcratbuild (4).exedllhost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	dllhost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

07132599.exedllhost.exedllhost.exedllhost.exesmss.exe

pid	process
320	07132599.exe
320	07132599.exe
320	07132599.exe
320	07132599.exe
320	07132599.exe
320	07132599.exe
320	07132599.exe
320	07132599.exe
320	07132599.exe
1928	dllhost.exe
1928	dllhost.exe
1928	dllhost.exe
1928	dllhost.exe
1928	dllhost.exe
1928	dllhost.exe
1928	dllhost.exe
1920	dllhost.exe
4568	dllhost.exe
4568	dllhost.exe
4568	dllhost.exe
4568	dllhost.exe
4568	dllhost.exe
4568	dllhost.exe
4568	dllhost.exe
4568	dllhost.exe
4568	dllhost.exe
4568	dllhost.exe
4568	dllhost.exe
432	smss.exe
432	smss.exe
432	smss.exe
432	smss.exe
432	smss.exe
432	smss.exe
432	smss.exe
432	smss.exe
432	smss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

07132599.exe

pid process

320 07132599.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

07132599.exe07132599.exedllhost.exedllhost.exedllhost.exesmss.exe

description	pid	process
Token: SeDebugPrivilege	1788	07132599.exe
Token: SeDebugPrivilege	320	07132599.exe
Token: SeDebugPrivilege	1928	dllhost.exe
Token: SeDebugPrivilege	1920	dllhost.exe
Token: SeDebugPrivilege	4568	dllhost.exe
Token: SeDebugPrivilege	432	smss.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

07132599.exeJjaxjjjbnfhspjlmroqdcratbuild (4).exeWScript.execmd.exedllhost.exedllhost.exedllhost.execmd.exe

description	pid	process	target process
PID 1788 wrote to memory of 2848	1788	07132599.exe	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
PID 1788 wrote to memory of 2848	1788	07132599.exe	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
PID 1788 wrote to memory of 2848	1788	07132599.exe	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
PID 1788 wrote to memory of 320	1788	07132599.exe	07132599.exe
PID 1788 wrote to memory of 320	1788	07132599.exe	07132599.exe
PID 1788 wrote to memory of 320	1788	07132599.exe	07132599.exe
PID 1788 wrote to memory of 320	1788	07132599.exe	07132599.exe
PID 1788 wrote to memory of 320	1788	07132599.exe	07132599.exe
PID 1788 wrote to memory of 320	1788	07132599.exe	07132599.exe
PID 1788 wrote to memory of 320	1788	07132599.exe	07132599.exe
PID 1788 wrote to memory of 320	1788	07132599.exe	07132599.exe
PID 2848 wrote to memory of 4084	2848	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe	WScript.exe
PID 2848 wrote to memory of 4084	2848	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe	WScript.exe
PID 2848 wrote to memory of 4084	2848	Jjaxjjjbnfhspjlmroqdcratbuild (4).exe	WScript.exe
PID 4084 wrote to memory of 2244	4084	WScript.exe	cmd.exe
PID 4084 wrote to memory of 2244	4084	WScript.exe	cmd.exe
PID 4084 wrote to memory of 2244	4084	WScript.exe	cmd.exe
PID 2244 wrote to memory of 1928	2244	cmd.exe	dllhost.exe
PID 2244 wrote to memory of 1928	2244	cmd.exe	dllhost.exe
PID 1928 wrote to memory of 1920	1928	dllhost.exe	dllhost.exe
PID 1928 wrote to memory of 1920	1928	dllhost.exe	dllhost.exe
PID 1920 wrote to memory of 4568	1920	dllhost.exe	dllhost.exe
PID 1920 wrote to memory of 4568	1920	dllhost.exe	dllhost.exe
PID 4568 wrote to memory of 4788	4568	dllhost.exe	cmd.exe
PID 4568 wrote to memory of 4788	4568	dllhost.exe	cmd.exe
PID 4788 wrote to memory of 3088	4788	cmd.exe	w32tm.exe
PID 4788 wrote to memory of 3088	4788	cmd.exe	w32tm.exe
PID 4788 wrote to memory of 432	4788	cmd.exe	smss.exe
PID 4788 wrote to memory of 432	4788	cmd.exe	smss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\07132599.exe
"C:\Users\Admin\AppData\Local\Temp\07132599.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788

C:\Users\Admin\AppData\Local\Temp\Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
"C:\Users\Admin\AppData\Local\Temp\Jjaxjjjbnfhspjlmroqdcratbuild (4).exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2848

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Adobe\52gkn9uQF.vbe"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4084

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Adobe\yejrXrInbKlCAF.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:2244

C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe
"C:\Users\Admin\AppData\Roaming\\Adobe\dllhost.exe"
5⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928

C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe
"C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe"
6⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920

C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe
"C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe"
7⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MbaYaw0i4q.bat"
8⤵
- Suspicious use of WriteProcessMemory
PID:4788

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
9⤵
PID:3088

C:\odt\smss.exe
"C:\odt\smss.exe"
9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432

C:\Users\Admin\AppData\Local\Temp\07132599.exe
C:\Users\Admin\AppData\Local\Temp\07132599.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Windows\apppatch\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\apppatch\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\apppatch\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "071325990" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\07132599.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "07132599" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\07132599.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "071325990" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\07132599.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\odt\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\odt\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\odt\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\odt\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Templates\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Templates\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Templates\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\Lang\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Cookies\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Cookies\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Windows\Fonts\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\Fonts\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Windows\Fonts\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Templates\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Templates\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Templates\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\odt\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\Temp\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Temp\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\Temp\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\odt\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2128

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Uninstall Information\07132599.exe
Filesize
315KB

MD5
3d4f1aeaa622ea7e8b48ee771fcdd7a8

SHA1
72fc8a599685a0c8c65cebd5082e8f430ca150f8

SHA256
8174f504f7182aadc73523cea6ecd0c3ad4710d3d42d5021d9bb6f0891886cb6

SHA512
b714e3b35d2e00de506ca0a37d00f20efd9ddce199f5824450e0f35b969432aa0b35f03873d0094dad286d38a5bffbd869e6f4e336ce7e04e06e2516c8f004b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log
Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\07132599.exe.log
Filesize
1KB

MD5
4f3fab3e5f44399e7f4162fd367eca2d

SHA1
adada0591db5f53bcc0565942047156de3464e6e

SHA256
5db52f2a6a0fbfaa29e27418a1b72b660298dfa58a12ac0f12897a06e557caef

SHA512
d8c3fe3a91e572627e31a44d88a71fc3072786b074d04484ff6aacfeab43e0d29ec88bf6ad2af2a5f8e70f0c0eea95dcea59a8159adf4c642e5f8fd5fc632db7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
Filesize
625KB

MD5
9d9b928d96d953d897a2188a966b80ff

SHA1
31a78db2671a87af5ead30b11229f62854189cd0

SHA256
04228c9adeaa607dd537c69a15e2a176c85b731856a0243ae92c0d70c35c00c1

SHA512
ae73d3345b626f0e48edf7a6a666bd16a6bd617a28c61acdb1e4a247084642462b5e393c26cbc7a2e009ecc1a85c46281051e4c6262f62fec0f5a81e1cfcdc65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
Filesize
625KB

MD5
9d9b928d96d953d897a2188a966b80ff

SHA1
31a78db2671a87af5ead30b11229f62854189cd0

SHA256
04228c9adeaa607dd537c69a15e2a176c85b731856a0243ae92c0d70c35c00c1

SHA512
ae73d3345b626f0e48edf7a6a666bd16a6bd617a28c61acdb1e4a247084642462b5e393c26cbc7a2e009ecc1a85c46281051e4c6262f62fec0f5a81e1cfcdc65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jjaxjjjbnfhspjlmroqdcratbuild (4).exe
Filesize
625KB

MD5
9d9b928d96d953d897a2188a966b80ff

SHA1
31a78db2671a87af5ead30b11229f62854189cd0

SHA256
04228c9adeaa607dd537c69a15e2a176c85b731856a0243ae92c0d70c35c00c1

SHA512
ae73d3345b626f0e48edf7a6a666bd16a6bd617a28c61acdb1e4a247084642462b5e393c26cbc7a2e009ecc1a85c46281051e4c6262f62fec0f5a81e1cfcdc65

Download Submit
C:\Users\Admin\AppData\Local\Temp\MbaYaw0i4q.bat
Filesize
180B

MD5
ca7712ed1ca308dbed93f7780bf482e3

SHA1
d34c88fa959333cdcd5bbabebb233d2077b82e1a

SHA256
12db0e292d622b181476fad9c32ed361cf17830f93e3acc3742345e7c3df6e71

SHA512
394eaf950bd76abe95a7d93c9a0f12cd94a05b5dffd2b585c69f3d0c146b5f5a8fadcbb9c27b629dcfc236be54d8737bb4397f8193c05fd1fc5f8615fb2120f6

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\52gkn9uQF.vbe
Filesize
205B

MD5
241811b50c4ce030ecd48ebd49cd4a98

SHA1
4187db39f29719cb76395fb6d9ea2db872ac21bd

SHA256
d8835725b67daf4d34a4f49d8cdf3e6f5ca091372a38044960d3117248bae032

SHA512
9d4db48d1b2c2cdb079cdcd618da3edbba85c984f25f23d8cfdf9be0091b945c29b0e895530f6b292fd825a6023bc357716ffbf9cabb62997a6709a1e6f2c707

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe
Filesize
315KB

MD5
3d4f1aeaa622ea7e8b48ee771fcdd7a8

SHA1
72fc8a599685a0c8c65cebd5082e8f430ca150f8

SHA256
8174f504f7182aadc73523cea6ecd0c3ad4710d3d42d5021d9bb6f0891886cb6

SHA512
b714e3b35d2e00de506ca0a37d00f20efd9ddce199f5824450e0f35b969432aa0b35f03873d0094dad286d38a5bffbd869e6f4e336ce7e04e06e2516c8f004b8

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe
Filesize
315KB

MD5
3d4f1aeaa622ea7e8b48ee771fcdd7a8

SHA1
72fc8a599685a0c8c65cebd5082e8f430ca150f8

SHA256
8174f504f7182aadc73523cea6ecd0c3ad4710d3d42d5021d9bb6f0891886cb6

SHA512
b714e3b35d2e00de506ca0a37d00f20efd9ddce199f5824450e0f35b969432aa0b35f03873d0094dad286d38a5bffbd869e6f4e336ce7e04e06e2516c8f004b8

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe
Filesize
315KB

MD5
3d4f1aeaa622ea7e8b48ee771fcdd7a8

SHA1
72fc8a599685a0c8c65cebd5082e8f430ca150f8

SHA256
8174f504f7182aadc73523cea6ecd0c3ad4710d3d42d5021d9bb6f0891886cb6

SHA512
b714e3b35d2e00de506ca0a37d00f20efd9ddce199f5824450e0f35b969432aa0b35f03873d0094dad286d38a5bffbd869e6f4e336ce7e04e06e2516c8f004b8

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\dllhost.exe
Filesize
315KB

MD5
3d4f1aeaa622ea7e8b48ee771fcdd7a8

SHA1
72fc8a599685a0c8c65cebd5082e8f430ca150f8

SHA256
8174f504f7182aadc73523cea6ecd0c3ad4710d3d42d5021d9bb6f0891886cb6

SHA512
b714e3b35d2e00de506ca0a37d00f20efd9ddce199f5824450e0f35b969432aa0b35f03873d0094dad286d38a5bffbd869e6f4e336ce7e04e06e2516c8f004b8

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\yejrXrInbKlCAF.bat
Filesize
30B

MD5
8a2510fd7b4b55da07578e53e62df857

SHA1
c2a3092371375e47e1d80531b09a5552faa9156c

SHA256
47eab317103b819eebe671607203c05d3bdf2531323515122a233f34099eb8f3

SHA512
573d8fed7c15abf74ada2c08f0a649167a1cdf57431e8d111de8ddb41eec88acee38cf869ef895dc9116bc49902b47815a4dde76935a5b02d67911470254a572

Download Submit
C:\Users\Admin\Templates\9e8d7a4ca61bd9
Filesize
381B

MD5
877f17fa31a0ecfc594c912f3e2b2c6b

SHA1
18f3b0f1ff1054eaf4bf2753dd14b2f54b6ea1aa

SHA256
4c72468d3268a5a8fc0e0fca91d3ce6ee9cad16e9717a837d935631ad8dd2f22

SHA512
01a60308ef64476db73179c94ccb33887368183b44f00455cf377eb3a27dec929124bf9461c0df6797dbb690ed10bb6cfe46e7ddc2bbff7a57643e9039e93a3b

Download Submit
C:\Users\Admin\Templates\RuntimeBroker.exe
Filesize
315KB

MD5
3d4f1aeaa622ea7e8b48ee771fcdd7a8

SHA1
72fc8a599685a0c8c65cebd5082e8f430ca150f8

SHA256
8174f504f7182aadc73523cea6ecd0c3ad4710d3d42d5021d9bb6f0891886cb6

SHA512
b714e3b35d2e00de506ca0a37d00f20efd9ddce199f5824450e0f35b969432aa0b35f03873d0094dad286d38a5bffbd869e6f4e336ce7e04e06e2516c8f004b8

Download Submit
C:\odt\smss.exe
Filesize
315KB

MD5
3d4f1aeaa622ea7e8b48ee771fcdd7a8

SHA1
72fc8a599685a0c8c65cebd5082e8f430ca150f8

SHA256
8174f504f7182aadc73523cea6ecd0c3ad4710d3d42d5021d9bb6f0891886cb6

SHA512
b714e3b35d2e00de506ca0a37d00f20efd9ddce199f5824450e0f35b969432aa0b35f03873d0094dad286d38a5bffbd869e6f4e336ce7e04e06e2516c8f004b8

Download Submit
C:\odt\smss.exe
Filesize
315KB

MD5
3d4f1aeaa622ea7e8b48ee771fcdd7a8

SHA1
72fc8a599685a0c8c65cebd5082e8f430ca150f8

SHA256
8174f504f7182aadc73523cea6ecd0c3ad4710d3d42d5021d9bb6f0891886cb6

SHA512
b714e3b35d2e00de506ca0a37d00f20efd9ddce199f5824450e0f35b969432aa0b35f03873d0094dad286d38a5bffbd869e6f4e336ce7e04e06e2516c8f004b8

Download Submit
memory/320-160-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download
memory/320-159-0x0000000007190000-0x00000000071F6000-memory.dmp

Filesize
408KB

Download
memory/320-156-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download
memory/320-146-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1788-137-0x0000000005350000-0x0000000005360000-memory.dmp

Filesize
64KB

Download
memory/1788-138-0x0000000006D70000-0x0000000006D92000-memory.dmp

Filesize
136KB

Download
memory/1788-135-0x00000000050A0000-0x0000000005132000-memory.dmp

Filesize
584KB

Download
memory/1788-134-0x0000000005730000-0x0000000005CD4000-memory.dmp

Filesize
5.6MB

Download
memory/1788-133-0x0000000000530000-0x00000000006FE000-memory.dmp

Filesize
1.8MB

Download
memory/1788-136-0x0000000005150000-0x000000000515A000-memory.dmp

Filesize
40KB

Download
memory/1928-165-0x0000000000550000-0x00000000005A6000-memory.dmp

Filesize
344KB

Download
memory/1928-166-0x000000001B250000-0x000000001B260000-memory.dmp

Filesize
64KB

Download
memory/4568-203-0x0000000002F60000-0x0000000002F70000-memory.dmp

Filesize
64KB

Download