dcrat | 24ff6bf5d0db45669b7167ffc8106a0d2f4d87f52885163d91c3e42d66aea434

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2023, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3cb976f6c38245b11a73fab6ad925275.exe
Size

2.5MB
MD5

3cb976f6c38245b11a73fab6ad925275
SHA1

70a9bd4b2b1c59ea18723e21bf9e8e04fa475ddd
SHA256

24ff6bf5d0db45669b7167ffc8106a0d2f4d87f52885163d91c3e42d66aea434
SHA512

d884fd8026d382b2d91b0c3f92a51171da70a5071425ee4fb2de79025d01198ba7469a6a6c8801d80ddc52655c7b307093b9b3b5b4527063ab4f8a16849b9207
SSDEEP

49152:/bA38/3Vwmr+P0nqCUalvFgvehzVUHxI43Gm1EOsuUadDa1x:/bHBr+P0qCLpFgve9VURI4F7Rrdm1x

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3284	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3844	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3436	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	100	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4196	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1212	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4292	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	232	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3240	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	1676	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	420	1676	schtasks.exe	88

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x00060000000230b4-143.dat	dcrat
behavioral2/files/0x00060000000230b4-144.dat	dcrat
behavioral2/memory/3316-145-0x0000000000920000-0x0000000000B5C000-memory.dmp	dcrat
behavioral2/files/0x00060000000230b8-151.dat	dcrat
behavioral2/files/0x00060000000230cf-187.dat	dcrat
behavioral2/files/0x00060000000230cf-188.dat	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	3cb976f6c38245b11a73fab6ad925275.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	providerserver.exe

Executes dropped EXE 2 IoCs

pid	Process
3316	providerserver.exe
2400	RuntimeBroker.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\TableTextService\dllhost.exe	providerserver.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\5940a34987c991	providerserver.exe
File created	C:\Program Files\MSBuild\winlogon.exe	providerserver.exe
File created	C:\Program Files\MSBuild\cc11b995f2a76d	providerserver.exe
File created	C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe	providerserver.exe
File created	C:\Program Files (x86)\Windows Mail\9e8d7a4ca61bd9	providerserver.exe
File created	C:\Program Files\Common Files\Services\conhost.exe	providerserver.exe
File created	C:\Program Files\Common Files\Services\088424020bedd6	providerserver.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\diagnostics\scheduled\Maintenance\sihost.exe	providerserver.exe
File created	C:\Windows\appcompat\encapsulation\Registry.exe	providerserver.exe
File created	C:\Windows\appcompat\encapsulation\ee2ad38f3d4382	providerserver.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Idle.exe	providerserver.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\6ccacd8608530f	providerserver.exe
File created	C:\Windows\Vss\Writers\Application\providerserver.exe	providerserver.exe
File created	C:\Windows\Vss\Writers\Application\45830ce3ac6c98	providerserver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1600	schtasks.exe
232	schtasks.exe
3284	schtasks.exe
2896	schtasks.exe
4036	schtasks.exe
1076	schtasks.exe
2420	schtasks.exe
1456	schtasks.exe
3020	schtasks.exe
2332	schtasks.exe
3552	schtasks.exe
4944	schtasks.exe
3268	schtasks.exe
4200	schtasks.exe
4496	schtasks.exe
3844	schtasks.exe
4196	schtasks.exe
1552	schtasks.exe
1640	schtasks.exe
3988	schtasks.exe
1176	schtasks.exe
4920	schtasks.exe
1756	schtasks.exe
3436	schtasks.exe
860	schtasks.exe
2372	schtasks.exe
1752	schtasks.exe
4616	schtasks.exe
3716	schtasks.exe
2296	schtasks.exe
3364	schtasks.exe
2044	schtasks.exe
4528	schtasks.exe
3484	schtasks.exe
1072	schtasks.exe
4580	schtasks.exe
4292	schtasks.exe
420	schtasks.exe
2312	schtasks.exe
100	schtasks.exe
1212	schtasks.exe
3240	schtasks.exe
380	schtasks.exe
2416	schtasks.exe
4372	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	3cb976f6c38245b11a73fab6ad925275.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3316	providerserver.exe
3316	providerserver.exe
3316	providerserver.exe
2400	RuntimeBroker.exe
2400	RuntimeBroker.exe
2400	RuntimeBroker.exe
2400	RuntimeBroker.exe
2400	RuntimeBroker.exe
2400	RuntimeBroker.exe
2400	RuntimeBroker.exe
2400	RuntimeBroker.exe
2400	RuntimeBroker.exe
2400	RuntimeBroker.exe
2400	RuntimeBroker.exe
2400	RuntimeBroker.exe
2400	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3316	providerserver.exe
Token: SeDebugPrivilege	2400	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 1560	4740	3cb976f6c38245b11a73fab6ad925275.exe	84
PID 4740 wrote to memory of 1560	4740	3cb976f6c38245b11a73fab6ad925275.exe	84
PID 4740 wrote to memory of 1560	4740	3cb976f6c38245b11a73fab6ad925275.exe	84
PID 1560 wrote to memory of 3244	1560	WScript.exe	85
PID 1560 wrote to memory of 3244	1560	WScript.exe	85
PID 1560 wrote to memory of 3244	1560	WScript.exe	85
PID 3244 wrote to memory of 3316	3244	cmd.exe	87
PID 3244 wrote to memory of 3316	3244	cmd.exe	87
PID 3316 wrote to memory of 2400	3316	providerserver.exe	134
PID 3316 wrote to memory of 2400	3316	providerserver.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3cb976f6c38245b11a73fab6ad925275.exe
"C:\Users\Admin\AppData\Local\Temp\3cb976f6c38245b11a73fab6ad925275.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\surrogatehost\IlNNWvtPQ9iwZkPAPFFioOSV9.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\surrogatehost\kVQkV.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\surrogatehost\providerserver.exe
      "C:\surrogatehost\providerserver.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3316
    - - C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\surrogatehost\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\surrogatehost\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\surrogatehost\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Application Data\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Application Data\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\odt\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\odt\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Windows\appcompat\encapsulation\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\appcompat\encapsulation\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Windows\appcompat\encapsulation\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\MSBuild\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\MSBuild\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Downloads\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default\Downloads\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Downloads\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\odt\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\Services\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\Services\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\Services\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "providerserverp" /sc MINUTE /mo 9 /tr "'C:\Windows\Vss\Writers\Application\providerserver.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "providerserver" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\Application\providerserver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "providerserverp" /sc MINUTE /mo 12 /tr "'C:\Windows\Vss\Writers\Application\providerserver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe

Filesize
2.2MB

MD5
e3565d7e4a7567d4bbe478e6305c7d98

SHA1
8c25ca7228708a05597dba5c8cc93f19cda920ba

SHA256
71e2512f0ead2fa2dd4efd744c16d545fdb8ef758f29e661b18d545a8311d18d

SHA512
08c91e6bab62deb15c5c94ae7a9d2021da75a84675eaba7c885b454a04540f75eb1d36df8be6cb6886d925eafbc17ca24f36d83b337ba99bc60e4d84eace0daa

Download Submit
C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe

Filesize
2.2MB

MD5
e3565d7e4a7567d4bbe478e6305c7d98

SHA1
8c25ca7228708a05597dba5c8cc93f19cda920ba

SHA256
71e2512f0ead2fa2dd4efd744c16d545fdb8ef758f29e661b18d545a8311d18d

SHA512
08c91e6bab62deb15c5c94ae7a9d2021da75a84675eaba7c885b454a04540f75eb1d36df8be6cb6886d925eafbc17ca24f36d83b337ba99bc60e4d84eace0daa

Download Submit
C:\ProgramData\OfficeClickToRun.exe

Filesize
2.2MB

MD5
e3565d7e4a7567d4bbe478e6305c7d98

SHA1
8c25ca7228708a05597dba5c8cc93f19cda920ba

SHA256
71e2512f0ead2fa2dd4efd744c16d545fdb8ef758f29e661b18d545a8311d18d

SHA512
08c91e6bab62deb15c5c94ae7a9d2021da75a84675eaba7c885b454a04540f75eb1d36df8be6cb6886d925eafbc17ca24f36d83b337ba99bc60e4d84eace0daa

Download Submit
C:\surrogatehost\IlNNWvtPQ9iwZkPAPFFioOSV9.vbe

Filesize
195B

MD5
8b177c17b62fee2e1c4325253235633b

SHA1
db41bedbe8f733560a737e89594186f2e86abcdd

SHA256
7a71222e4489bf0b3520de454af4a4166928263cbf03a65eea20ab270673c0f9

SHA512
5dc508daf415e1f3865263a4813a0e83d8dea02a9f26b33eb61a62c74565bc113a02decaf3e966beeae3cefe8f9865c1b75fcef7fcea0fb0fa2f8e8ce04732f2

Download Submit
C:\surrogatehost\kVQkV.bat

Filesize
37B

MD5
7eb9d88ab13d8b68f667e6a6acf8e8b6

SHA1
04665956be72cec55b64896f43ac7807c8fe31b8

SHA256
f11b553a599c1ad690e4854cd12260eed342e3cc461a0b9c0b97763e749e8827

SHA512
9f6fde84bb19573f7e4497f727c121838bd3cfb0506294ae4980cc325f3032965be9f5beb680bc038f7448a697a15cf651d875fea746bb2cf0af30264362795c

Download Submit
C:\surrogatehost\providerserver.exe

Filesize
2.2MB

MD5
e3565d7e4a7567d4bbe478e6305c7d98

SHA1
8c25ca7228708a05597dba5c8cc93f19cda920ba

SHA256
71e2512f0ead2fa2dd4efd744c16d545fdb8ef758f29e661b18d545a8311d18d

SHA512
08c91e6bab62deb15c5c94ae7a9d2021da75a84675eaba7c885b454a04540f75eb1d36df8be6cb6886d925eafbc17ca24f36d83b337ba99bc60e4d84eace0daa

Download Submit
C:\surrogatehost\providerserver.exe

Filesize
2.2MB

MD5
e3565d7e4a7567d4bbe478e6305c7d98

SHA1
8c25ca7228708a05597dba5c8cc93f19cda920ba

SHA256
71e2512f0ead2fa2dd4efd744c16d545fdb8ef758f29e661b18d545a8311d18d

SHA512
08c91e6bab62deb15c5c94ae7a9d2021da75a84675eaba7c885b454a04540f75eb1d36df8be6cb6886d925eafbc17ca24f36d83b337ba99bc60e4d84eace0daa

Download Submit
memory/3316-145-0x0000000000920000-0x0000000000B5C000-memory.dmp

Filesize
2.2MB

Download
memory/3316-146-0x000000001B850000-0x000000001B860000-memory.dmp

Filesize
64KB

Download
memory/3316-147-0x00000000013E0000-0x0000000001430000-memory.dmp

Filesize
320KB

Download
memory/3316-148-0x000000001C490000-0x000000001C9B8000-memory.dmp

Filesize
5.2MB

Download