dcrat | fc402b8bbe328bc15da197b4f57b67d6fb74530553eb7f6fb2d1aa3d1af64fb6

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230824-en
resource tags

arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
submitted
27/08/2023, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2b7f820ad4b5f7518071bd730ac2e655.exe
Size 2.5MB
Sample230827-x28cqaef71
SHA256 fc402b8bbe328bc15da197b4f57b67d6fb74530553eb7f6fb2d1aa3d1af64fb6
MD5 2b7f820ad4b5f7518071bd730ac2e655
SHA1 8ff9a5b37c8d8482666707b3f555e071b8298df2
SHA512 99623412cb32c2cffc63e8889089321841468cfe092eb73b02563a64efbf44df095efb98a9ba43b0f0320b784ac595ed2223e8addd578662f8be333ec52d8789
SSDEEP 24576:PFFok8gvLa+c8OFvHh6QaA3JnPN8NTx5cxWpQkQTd315EitgptuOkalH9MWTk8eo:dFzvo1Ta24dx5gWmxrEiC35dk0VjR61
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\services.exe\", \"C:\\Users\\All Users\\System.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\services.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Users\\Public\\Documents\\backgroundTaskHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\fontdrvhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\services.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Users\\Public\\Documents\\backgroundTaskHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\fontdrvhost.exe\", \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1041\\wininit.exe\", \"C:\\odt\\explorer.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\SppExtComObj.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\services.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Users\\Public\\Documents\\backgroundTaskHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\fontdrvhost.exe\", \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1041\\wininit.exe\", \"C:\\odt\\explorer.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\explorer.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\services.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\services.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Users\\Public\\Documents\\backgroundTaskHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\fontdrvhost.exe\", \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1041\\wininit.exe\", \"C:\\odt\\explorer.exe\", \"C:\\odt\\csrss.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\services.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Users\\Public\\Documents\\backgroundTaskHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\fontdrvhost.exe\", \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1041\\wininit.exe\", \"C:\\odt\\explorer.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\explorer.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\odt\\Idle.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\services.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Users\\Public\\Documents\\backgroundTaskHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\fontdrvhost.exe\", \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1041\\wininit.exe\", \"C:\\odt\\explorer.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\services.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\services.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\services.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\odt\\smss.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\services.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\sppsvc.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\services.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\services.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Users\\Public\\Documents\\backgroundTaskHost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\services.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Users\\Public\\Documents\\backgroundTaskHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\fontdrvhost.exe\", \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1041\\wininit.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\services.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Users\\Public\\Documents\\backgroundTaskHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\fontdrvhost.exe\", \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1041\\wininit.exe\", \"C:\\odt\\explorer.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\explorer.exe\", \"C:\\Users\\Public\\dllhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3856	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3880	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	368	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3764	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4208	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3600	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	488	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4156	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3932	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3344	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	2888	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	2888	schtasks.exe	84

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1408-0-0x0000000000F40000-0x00000000011BE000-memory.dmp	dcrat
behavioral2/files/0x000600000002300a-15.dat	dcrat
behavioral2/files/0x0006000000023017-51.dat	dcrat
behavioral2/files/0x0006000000023017-52.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2712	Idle.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Users\\Public\\Documents\\backgroundTaskHost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\odt\\explorer.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\odt\\Idle.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\odt\\Idle.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\odt\\smss.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\odt\\sppsvc.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\odt\\smss.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\odt\\sppsvc.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\explorer.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\dllhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\All Users\\System.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Recovery\\WindowsRE\\sysmon.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Mozilla Firefox\\uninstall\\fontdrvhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1041\\wininit.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\odt\\csrss.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\explorer.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\odt\\services.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Users\\Admin\\Start Menu\\SppExtComObj.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\dllhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\odt\\services.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\All Users\\System.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Users\\Public\\Documents\\backgroundTaskHost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Mozilla Firefox\\uninstall\\fontdrvhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1041\\wininit.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\odt\\explorer.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\odt\\csrss.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files\\Windows Media Player\\Skins\\unsecapp.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Recovery\\WindowsRE\\sysmon.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Users\\Admin\\Start Menu\\SppExtComObj.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\Boot\lsass.exe	2b7f820ad4b5f7518071bd730ac2e655.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\uninstall\fontdrvhost.exe	2b7f820ad4b5f7518071bd730ac2e655.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\7a0fd90576e088	2b7f820ad4b5f7518071bd730ac2e655.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\29c1c3cc0f7685	2b7f820ad4b5f7518071bd730ac2e655.exe
File opened for modification	C:\Program Files\Windows Media Player\Skins\unsecapp.exe	2b7f820ad4b5f7518071bd730ac2e655.exe
File created	C:\Program Files\Windows Media Player\Skins\29c1c3cc0f7685	2b7f820ad4b5f7518071bd730ac2e655.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe	2b7f820ad4b5f7518071bd730ac2e655.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\5b884080fd4f94	2b7f820ad4b5f7518071bd730ac2e655.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\explorer.exe	2b7f820ad4b5f7518071bd730ac2e655.exe
File created	C:\Program Files\Windows Media Player\Skins\unsecapp.exe	2b7f820ad4b5f7518071bd730ac2e655.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Globalization\ELS\SpellDictionaries\Fluency\lsass.exe	2b7f820ad4b5f7518071bd730ac2e655.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_42ec0e96ce977bdb\r\fontdrvhost.exe	2b7f820ad4b5f7518071bd730ac2e655.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\1041\wininit.exe	2b7f820ad4b5f7518071bd730ac2e655.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\1041\56085415360792	2b7f820ad4b5f7518071bd730ac2e655.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4208	schtasks.exe
1340	schtasks.exe
4512	schtasks.exe
4156	schtasks.exe
3492	schtasks.exe
3880	schtasks.exe
4436	schtasks.exe
5020	schtasks.exe
468	schtasks.exe
2688	schtasks.exe
3600	schtasks.exe
4888	schtasks.exe
548	schtasks.exe
3852	schtasks.exe
2280	schtasks.exe
3856	schtasks.exe
488	schtasks.exe
3840	schtasks.exe
3932	schtasks.exe
2348	schtasks.exe
2372	schtasks.exe
1968	schtasks.exe
2380	schtasks.exe
2948	schtasks.exe
3756	schtasks.exe
1612	schtasks.exe
4584	schtasks.exe
2560	schtasks.exe
368	schtasks.exe
3108	schtasks.exe
2404	schtasks.exe
3764	schtasks.exe
2720	schtasks.exe
4300	schtasks.exe
1224	schtasks.exe
1492	schtasks.exe
2188	schtasks.exe
5032	schtasks.exe
4724	schtasks.exe
4180	schtasks.exe
4132	schtasks.exe
1396	schtasks.exe
2032	schtasks.exe
3344	schtasks.exe
3672	schtasks.exe
4188	schtasks.exe
3112	schtasks.exe
2132	schtasks.exe
852	schtasks.exe
4980	schtasks.exe
1744	schtasks.exe
2924	schtasks.exe
3268	schtasks.exe
2236	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings	2b7f820ad4b5f7518071bd730ac2e655.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1408	2b7f820ad4b5f7518071bd730ac2e655.exe
1408	2b7f820ad4b5f7518071bd730ac2e655.exe
1408	2b7f820ad4b5f7518071bd730ac2e655.exe
1408	2b7f820ad4b5f7518071bd730ac2e655.exe
1408	2b7f820ad4b5f7518071bd730ac2e655.exe
1408	2b7f820ad4b5f7518071bd730ac2e655.exe
1408	2b7f820ad4b5f7518071bd730ac2e655.exe
1408	2b7f820ad4b5f7518071bd730ac2e655.exe
1408	2b7f820ad4b5f7518071bd730ac2e655.exe
1408	2b7f820ad4b5f7518071bd730ac2e655.exe
1408	2b7f820ad4b5f7518071bd730ac2e655.exe
2712	Idle.exe
2712	Idle.exe
2712	Idle.exe
2712	Idle.exe
2712	Idle.exe
2712	Idle.exe
2712	Idle.exe
2712	Idle.exe
2712	Idle.exe
2712	Idle.exe
2712	Idle.exe
2712	Idle.exe
2712	Idle.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	2b7f820ad4b5f7518071bd730ac2e655.exe
Token: SeDebugPrivilege	2712	Idle.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2428	1408	2b7f820ad4b5f7518071bd730ac2e655.exe	139
PID 1408 wrote to memory of 2428	1408	2b7f820ad4b5f7518071bd730ac2e655.exe	139
PID 2428 wrote to memory of 4920	2428	cmd.exe	141
PID 2428 wrote to memory of 4920	2428	cmd.exe	141
PID 2428 wrote to memory of 2712	2428	cmd.exe	143
PID 2428 wrote to memory of 2712	2428	cmd.exe	143

C:\Users\Admin\AppData\Local\Temp\2b7f820ad4b5f7518071bd730ac2e655.exe
"C:\Users\Admin\AppData\Local\Temp\2b7f820ad4b5f7518071bd730ac2e655.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VG4jhfdOLu.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4920
- - C:\Recovery\WindowsRE\Idle.exe
    "C:\Recovery\WindowsRE\Idle.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\Skins\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Skins\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\Skins\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\odt\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\odt\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\odt\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Documents\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Public\Documents\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Documents\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\uninstall\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\uninstall\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\Microsoft.NET\Framework\v4.0.30319\1041\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\Framework\v4.0.30319\1041\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\Microsoft.NET\Framework\v4.0.30319\1041\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\odt\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Start Menu\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Start Menu\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Public\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Public\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\odt\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Idle.exe

Path C:\Recovery\WindowsRE\Idle.exe
Size 2.5MB
SHA256 fc402b8bbe328bc15da197b4f57b67d6fb74530553eb7f6fb2d1aa3d1af64fb6
MD5 2b7f820ad4b5f7518071bd730ac2e655
SHA1 8ff9a5b37c8d8482666707b3f555e071b8298df2
SHA512 99623412cb32c2cffc63e8889089321841468cfe092eb73b02563a64efbf44df095efb98a9ba43b0f0320b784ac595ed2223e8addd578662f8be333ec52d8789
SSDEEP 24576:PFFok8gvLa+c8OFvHh6QaA3JnPN8NTx5cxWpQkQTd315EitgptuOkalH9MWTk8eo:dFzvo1Ta24dx5gWmxrEiC35dk0VjR61
MD5 SHA1 SHA512 SSDEEP

Submit Download

Idle.exe

Path C:\Recovery\WindowsRE\Idle.exe
Size 2.5MB
SHA256 fc402b8bbe328bc15da197b4f57b67d6fb74530553eb7f6fb2d1aa3d1af64fb6
MD5 2b7f820ad4b5f7518071bd730ac2e655
SHA1 8ff9a5b37c8d8482666707b3f555e071b8298df2
SHA512 99623412cb32c2cffc63e8889089321841468cfe092eb73b02563a64efbf44df095efb98a9ba43b0f0320b784ac595ed2223e8addd578662f8be333ec52d8789
SSDEEP 24576:PFFok8gvLa+c8OFvHh6QaA3JnPN8NTx5cxWpQkQTd315EitgptuOkalH9MWTk8eo:dFzvo1Ta24dx5gWmxrEiC35dk0VjR61
MD5 SHA1 SHA512 SSDEEP

Submit Download

sysmon.exe

Path C:\Recovery\WindowsRE\sysmon.exe
Size 2.5MB
SHA256 fc402b8bbe328bc15da197b4f57b67d6fb74530553eb7f6fb2d1aa3d1af64fb6
MD5 2b7f820ad4b5f7518071bd730ac2e655
SHA1 8ff9a5b37c8d8482666707b3f555e071b8298df2
SHA512 99623412cb32c2cffc63e8889089321841468cfe092eb73b02563a64efbf44df095efb98a9ba43b0f0320b784ac595ed2223e8addd578662f8be333ec52d8789
SSDEEP 24576:PFFok8gvLa+c8OFvHh6QaA3JnPN8NTx5cxWpQkQTd315EitgptuOkalH9MWTk8eo:dFzvo1Ta24dx5gWmxrEiC35dk0VjR61
MD5 SHA1 SHA512 SSDEEP

Submit Download

VG4jhfdOLu.bat

Path C:\Users\Admin\AppData\Local\Temp\VG4jhfdOLu.bat
Size 195B
SHA256 c3d76f8dce47b6f5c46706926308da35fc90ecf6af156121f4bf599ffd1cfa76
MD5 df2e73d0bd69b5b9563f735a17491683
SHA1 e3dad0155a91f588c6a48116714a430c53a6b86b
SHA512 612a1e39900a952a50591a715ddcc17cb6cb6d0c166b6bd01012c04b169b4cffa6a632f5dcb7104e01c148c605d69df5ce012a8079feb5fe147269e633e20ba0
MD5 SHA1 SHA512

Submit Download

memory/1408-49-0x00007FFA7E870000-0x00007FFA7F331000-memory.dmp

Download

memory/1408-9-0x00007FFA7E870000-0x00007FFA7F331000-memory.dmp

Download

memory/1408-10-0x000000001BE90000-0x000000001BEA0000-memory.dmp

Download

memory/1408-4-0x000000001CA20000-0x000000001CF48000-memory.dmp

Download

memory/1408-0-0x0000000000F40000-0x00000000011BE000-memory.dmp

Download

memory/1408-3-0x000000001BE00000-0x000000001BE50000-memory.dmp

Download

memory/1408-2-0x000000001BE90000-0x000000001BEA0000-memory.dmp

Download

memory/1408-1-0x00007FFA7E870000-0x00007FFA7F331000-memory.dmp

Download

memory/2712-53-0x00007FFA7E870000-0x00007FFA7F331000-memory.dmp

Download

memory/2712-54-0x000000001B060000-0x000000001B070000-memory.dmp

Download

memory/2712-55-0x00007FFA7E870000-0x00007FFA7F331000-memory.dmp

Download

memory/2712-56-0x000000001C9C0000-0x000000001CB82000-memory.dmp

Download

memory/2712-57-0x000000001B060000-0x000000001B070000-memory.dmp

Download