dcrat | c0bea0a11853ecbdd169b0d0ac30f0afcba308555752a0ead4de45895ec69ed2

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
04/07/2023, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0bea0a11853ecbdd169b0d0a.exe
Size

1.2MB
MD5

f20c74f02de55472d8b565868a19f4f5
SHA1

7be531a0a8ca1e686e6f7ff70fc3c2de963684fe
SHA256

c0bea0a11853ecbdd169b0d0ac30f0afcba308555752a0ead4de45895ec69ed2
SHA512

bd0664c6bb354ea240f942f8911daf494e62f97af6253ae77768b8d206e4c3245af655da94af410816917c1f7293123bc4dafa1ec8cc57fc1b5506fe5b3bebef
SSDEEP

24576:U2G/nvxW3Ww0t1Qo4QruJTrTn5mC8IasJ8lkf6LgH:UbA301n47rzrJfkY

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	288	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	528	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	524	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	288	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	908	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	1080	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	1080	schtasks.exe	30

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000a00000001269b-63.dat	dcrat
behavioral1/files/0x000a00000001269b-64.dat	dcrat
behavioral1/memory/740-65-0x0000000000240000-0x0000000000332000-memory.dmp	dcrat
behavioral1/files/0x000700000001337b-73.dat	dcrat
behavioral1/files/0x000600000001561e-107.dat	dcrat
behavioral1/files/0x000600000001561e-108.dat	dcrat
behavioral1/memory/1116-109-0x0000000000E50000-0x0000000000F42000-memory.dmp	dcrat
behavioral1/memory/1116-120-0x000000001ACC0000-0x000000001AD40000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

pid	Process
740	perfCrt.exe
1116	spoolsv.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\cc11b995f2a76d	perfCrt.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\services.exe	perfCrt.exe
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\Idle.exe	perfCrt.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\perfCrt.exe	perfCrt.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\cc11b995f2a76d	perfCrt.exe
File created	C:\Program Files (x86)\Windows Portable Devices\66992792adb75e	perfCrt.exe
File created	C:\Program Files\Uninstall Information\winlogon.exe	perfCrt.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\c5b4cb5e9653cc	perfCrt.exe
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\6ccacd8608530f	perfCrt.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\winlogon.exe	perfCrt.exe
File created	C:\Program Files (x86)\Windows Portable Devices\perfCrt.exe	perfCrt.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\it-IT\spoolsv.exe	perfCrt.exe
File created	C:\Windows\it-IT\f3b6ecef712a24	perfCrt.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_7114628	c0bea0a11853ecbdd169b0d0a.exe
File created	C:\Windows\xpdAC628S.bat	c0bea0a11853ecbdd169b0d0a.exe
File opened for modification	C:\Windows\es-ES\winlogon.exe	perfCrt.exe
File created	C:\Windows\8NQktCoAZviY5dhjarDv0yXqzR5kC.vbe	c0bea0a11853ecbdd169b0d0a.exe
File opened for modification	C:\Windows\8NQktCoAZviY5dhjarDv0yXqzR5kC.vbe	c0bea0a11853ecbdd169b0d0a.exe
File created	C:\Windows\es-ES\winlogon.exe	perfCrt.exe
File created	C:\Windows\es-ES\cc11b995f2a76d	perfCrt.exe
File created	C:\Windows\Prefetch\ReadyBoot\winlogon.exe	perfCrt.exe
File opened for modification	C:\Windows\xpdAC628S.bat	c0bea0a11853ecbdd169b0d0a.exe
File created	C:\Windows\perfCrt.exe	c0bea0a11853ecbdd169b0d0a.exe
File opened for modification	C:\Windows\perfCrt.exe	c0bea0a11853ecbdd169b0d0a.exe
File created	C:\Windows\Prefetch\ReadyBoot\cc11b995f2a76d	perfCrt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
908	schtasks.exe
1904	schtasks.exe
1144	schtasks.exe
1184	schtasks.exe
316	schtasks.exe
820	schtasks.exe
1912	schtasks.exe
288	schtasks.exe
1860	schtasks.exe
1872	schtasks.exe
888	schtasks.exe
1300	schtasks.exe
288	schtasks.exe
2040	schtasks.exe
1952	schtasks.exe
1236	schtasks.exe
1908	schtasks.exe
960	schtasks.exe
1244	schtasks.exe
1668	schtasks.exe
864	schtasks.exe
1900	schtasks.exe
2024	schtasks.exe
1844	schtasks.exe
1308	schtasks.exe
1900	schtasks.exe
1740	schtasks.exe
2032	schtasks.exe
1668	schtasks.exe
1148	schtasks.exe
1792	schtasks.exe
1788	schtasks.exe
2020	schtasks.exe
1744	schtasks.exe
1456	schtasks.exe
1608	schtasks.exe
1076	schtasks.exe
960	schtasks.exe
1536	schtasks.exe
1672	schtasks.exe
1508	schtasks.exe
524	schtasks.exe
884	schtasks.exe
1048	schtasks.exe
1604	schtasks.exe
1624	schtasks.exe
528	schtasks.exe
1612	schtasks.exe
1572	schtasks.exe
1864	schtasks.exe
816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
740	perfCrt.exe
740	perfCrt.exe
740	perfCrt.exe
1116	spoolsv.exe
1116	spoolsv.exe
1116	spoolsv.exe
1116	spoolsv.exe
1116	spoolsv.exe
1116	spoolsv.exe
1116	spoolsv.exe
1116	spoolsv.exe
1116	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	740	perfCrt.exe
Token: SeDebugPrivilege	1116	spoolsv.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1640	1572	c0bea0a11853ecbdd169b0d0a.exe	26
PID 1572 wrote to memory of 1640	1572	c0bea0a11853ecbdd169b0d0a.exe	26
PID 1572 wrote to memory of 1640	1572	c0bea0a11853ecbdd169b0d0a.exe	26
PID 1572 wrote to memory of 1640	1572	c0bea0a11853ecbdd169b0d0a.exe	26
PID 1640 wrote to memory of 1400	1640	WScript.exe	27
PID 1640 wrote to memory of 1400	1640	WScript.exe	27
PID 1640 wrote to memory of 1400	1640	WScript.exe	27
PID 1640 wrote to memory of 1400	1640	WScript.exe	27
PID 1400 wrote to memory of 740	1400	cmd.exe	29
PID 1400 wrote to memory of 740	1400	cmd.exe	29
PID 1400 wrote to memory of 740	1400	cmd.exe	29
PID 1400 wrote to memory of 740	1400	cmd.exe	29
PID 740 wrote to memory of 1116	740	perfCrt.exe	82
PID 740 wrote to memory of 1116	740	perfCrt.exe	82
PID 740 wrote to memory of 1116	740	perfCrt.exe	82
PID 1116 wrote to memory of 524	1116	spoolsv.exe	83
PID 1116 wrote to memory of 524	1116	spoolsv.exe	83
PID 1116 wrote to memory of 524	1116	spoolsv.exe	83
PID 1116 wrote to memory of 464	1116	spoolsv.exe	84
PID 1116 wrote to memory of 464	1116	spoolsv.exe	84
PID 1116 wrote to memory of 464	1116	spoolsv.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c0bea0a11853ecbdd169b0d0a.exe
"C:\Users\Admin\AppData\Local\Temp\c0bea0a11853ecbdd169b0d0a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\8NQktCoAZviY5dhjarDv0yXqzR5kC.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Windows\xpdAC628S.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Windows\perfCrt.exe
      "C:\Windows\perfCrt.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:740
    - - C:\Windows\it-IT\spoolsv.exe
        
        "C:\Windows\it-IT\spoolsv.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1116
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e95083a9-1529-48ce-8d33-3f1d7d0092b5.vbs"
        6⤵
        
        PID:524
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dea0d39f-db7b-4dc9-a5d4-f4936f40a5e3.vbs"
        6⤵
        
        PID:464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Windows\es-ES\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Recovery\34c99522-106a-11ee-b24d-849b5e38b5ed\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\34c99522-106a-11ee-b24d-849b5e38b5ed\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Recovery\34c99522-106a-11ee-b24d-849b5e38b5ed\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Recovery\34c99522-106a-11ee-b24d-849b5e38b5ed\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\34c99522-106a-11ee-b24d-849b5e38b5ed\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Recovery\34c99522-106a-11ee-b24d-849b5e38b5ed\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "perfCrtp" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\perfCrt.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "perfCrt" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\perfCrt.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "perfCrtp" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\perfCrt.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Recovery\34c99522-106a-11ee-b24d-849b5e38b5ed\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\34c99522-106a-11ee-b24d-849b5e38b5ed\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Recovery\34c99522-106a-11ee-b24d-849b5e38b5ed\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\SendTo\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\SendTo\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Recovery\34c99522-106a-11ee-b24d-849b5e38b5ed\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\34c99522-106a-11ee-b24d-849b5e38b5ed\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Recovery\34c99522-106a-11ee-b24d-849b5e38b5ed\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Windows\Prefetch\ReadyBoot\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\Prefetch\ReadyBoot\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\SpeechEngines\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\SpeechEngines\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\SpeechEngines\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Windows\it-IT\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Documents\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\All Users\Documents\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Documents\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsass.exe

Filesize
935KB

MD5
f553aaacd5d5d904ae5103a9f9d1d8e2

SHA1
29d46f0d7be8aaf8c9348d706395c5e5ad7095dd

SHA256
c1452a47310558c9a70b6fd3b9d68156aad8c1b07fd53455bff0ccd83b95ba8e

SHA512
d7c11971125864dd2b746b22b01a15377569582185973c2f2c5e0300158ac0ee356c0dfb857edf93a6f2737ba9642448425c4c8329de99eaa6a43e796143d31b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dea0d39f-db7b-4dc9-a5d4-f4936f40a5e3.vbs

Filesize
480B

MD5
d2214026a47cbc6f713b8ff27eee1d40

SHA1
e7e5956b71c9916d6a4f0395e958ded263499088

SHA256
de04ea8456cae36f6a6d91f72a69958621a91503b708a14c8c72055367ac8ef5

SHA512
804d9c3864a15968e35be35bb32a50c4e0812aff1fdad5f12912dba6f7028cea65b67f28de976af07187e1fdfe95b5cf0000b06dbd881ebd720f831f9a30f451

Download Submit
C:\Users\Admin\AppData\Local\Temp\e95083a9-1529-48ce-8d33-3f1d7d0092b5.vbs

Filesize
704B

MD5
7e9e99cc4b5675105e895898c814ef36

SHA1
2e2265bc6082c050456956e731cfa781ea71d204

SHA256
a6946a7688f5ecdb2ca33b7404c699c30d395806702987ed386345860c5e4104

SHA512
5bb523efcfc445418dc5771be2ce7844262f748efbc4adecb1c7cbc28f26c9644925431f88c0ed78d49ed4b25995da076fcb2bceb7d6098bb77630666015faaf

Download Submit
C:\Windows\8NQktCoAZviY5dhjarDv0yXqzR5kC.vbe

Filesize
204B

MD5
bda4c38d73a75f19a5b0db1e6e0b7754

SHA1
19d73217e43de79c98a853e7b67705013578e348

SHA256
bd0bffa96bb67d96b7015d60cbb3bfaf64a7d1d8191e49fa17f7352a44058d4a

SHA512
743f332733bbf8cd9be78fd4a2e8879e1fb895c1c329b71edb2fc6756e021cfd746dcaa38d86cc5f007a1b0f08cf2c6fbc1b695a5f5520c8c67aca5e08d812e5

Download Submit
C:\Windows\it-IT\spoolsv.exe

Filesize
935KB

MD5
f553aaacd5d5d904ae5103a9f9d1d8e2

SHA1
29d46f0d7be8aaf8c9348d706395c5e5ad7095dd

SHA256
c1452a47310558c9a70b6fd3b9d68156aad8c1b07fd53455bff0ccd83b95ba8e

SHA512
d7c11971125864dd2b746b22b01a15377569582185973c2f2c5e0300158ac0ee356c0dfb857edf93a6f2737ba9642448425c4c8329de99eaa6a43e796143d31b

Download Submit
C:\Windows\it-IT\spoolsv.exe

Filesize
935KB

MD5
f553aaacd5d5d904ae5103a9f9d1d8e2

SHA1
29d46f0d7be8aaf8c9348d706395c5e5ad7095dd

SHA256
c1452a47310558c9a70b6fd3b9d68156aad8c1b07fd53455bff0ccd83b95ba8e

SHA512
d7c11971125864dd2b746b22b01a15377569582185973c2f2c5e0300158ac0ee356c0dfb857edf93a6f2737ba9642448425c4c8329de99eaa6a43e796143d31b

Download Submit
C:\Windows\perfCrt.exe

Filesize
935KB

MD5
f553aaacd5d5d904ae5103a9f9d1d8e2

SHA1
29d46f0d7be8aaf8c9348d706395c5e5ad7095dd

SHA256
c1452a47310558c9a70b6fd3b9d68156aad8c1b07fd53455bff0ccd83b95ba8e

SHA512
d7c11971125864dd2b746b22b01a15377569582185973c2f2c5e0300158ac0ee356c0dfb857edf93a6f2737ba9642448425c4c8329de99eaa6a43e796143d31b

Download Submit
C:\Windows\perfCrt.exe

Filesize
935KB

MD5
f553aaacd5d5d904ae5103a9f9d1d8e2

SHA1
29d46f0d7be8aaf8c9348d706395c5e5ad7095dd

SHA256
c1452a47310558c9a70b6fd3b9d68156aad8c1b07fd53455bff0ccd83b95ba8e

SHA512
d7c11971125864dd2b746b22b01a15377569582185973c2f2c5e0300158ac0ee356c0dfb857edf93a6f2737ba9642448425c4c8329de99eaa6a43e796143d31b

Download Submit
C:\Windows\xpdAC628S.bat

Filesize
35B

MD5
7278c7ae6efbd4b50e3707c4dc4c608a

SHA1
c8e1db9b85f599c98b278571b147cf81fe2fbae4

SHA256
8f2fd99bb0dfa66ccca2c9173120318ea6702c64a5e112f63f9c2145ed9fe9dd

SHA512
d06d550b8eec81c4faa8aca795dea9aac748cf4ea8e4ce42bf73403f6f2be67616e2732ecdcf2eca390448c75a026b011aa2b8536a6fdcb4a07c12f71486049b

Download Submit
memory/740-65-0x0000000000240000-0x0000000000332000-memory.dmp

Filesize
968KB

Download
memory/740-68-0x00000000004C0000-0x00000000004CE000-memory.dmp

Filesize
56KB

Download
memory/740-67-0x00000000004B0000-0x00000000004BA000-memory.dmp

Filesize
40KB

Download
memory/740-66-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/1116-109-0x0000000000E50000-0x0000000000F42000-memory.dmp

Filesize
968KB

Download
memory/1116-110-0x000000001ACC0000-0x000000001AD40000-memory.dmp

Filesize
512KB

Download
memory/1116-120-0x000000001ACC0000-0x000000001AD40000-memory.dmp

Filesize
512KB

Download