dcrat | 0ba951d1a97c8f4e8d64870f98ef777b11d3f49a1cd195482e3575361dd7346d

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-09-2023 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a301f1d7fe80574cc4888e1477cf5a22.exe
Size

1.7MB
MD5

a301f1d7fe80574cc4888e1477cf5a22
SHA1

a2b43366cb4cb30a4d2c5bc4cc29dafecb42455c
SHA256

0ba951d1a97c8f4e8d64870f98ef777b11d3f49a1cd195482e3575361dd7346d
SHA512

2c5577687029660af4e70a064f93ae6ac7af074ba0f04c8783fa1797eb1801aeda1d6c711f8a3929f5d30d49df07850fb31b1db4b4cf233bb9a2b80905e25832
SSDEEP

24576:P2G/nvxW3Wz0XaV306S/0M/W5DyaCwvvTYdydYsXb30FTMsDQqE6jLGPbEYbF:PbA3dX83lS/Ve5D5vkrMb30DD7GP3

Score

10^/10

dcrat evasion infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Resources\\Ease of Access Themes\\wininit.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Resources\\Ease of Access Themes\\wininit.exe\", \"C:\\sessionRuntime\\sppsvc.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\taskhost.exe\", \"C:\\sessionRuntime\\wininit.exe\", \"C:\\MSOCache\\All Users\\explorer.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Resources\\Ease of Access Themes\\wininit.exe\", \"C:\\sessionRuntime\\sppsvc.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\taskhost.exe\", \"C:\\sessionRuntime\\wininit.exe\", \"C:\\MSOCache\\All Users\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\lsass.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Resources\\Ease of Access Themes\\wininit.exe\", \"C:\\sessionRuntime\\sppsvc.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\taskhost.exe\", \"C:\\sessionRuntime\\wininit.exe\", \"C:\\MSOCache\\All Users\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\lsass.exe\", \"C:\\Users\\Default User\\audiodg.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Resources\\Ease of Access Themes\\wininit.exe\", \"C:\\sessionRuntime\\sppsvc.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\taskhost.exe\", \"C:\\sessionRuntime\\wininit.exe\", \"C:\\MSOCache\\All Users\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\lsass.exe\", \"C:\\Users\\Default User\\audiodg.exe\", \"C:\\Recovery\\4a649302-488a-11ee-87ae-f7238ff672e7\\dwm.exe\", \"C:\\Recovery\\4a649302-488a-11ee-87ae-f7238ff672e7\\services.exe\", \"C:\\Users\\Default User\\wininit.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Resources\\Ease of Access Themes\\wininit.exe\", \"C:\\sessionRuntime\\sppsvc.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\taskhost.exe\", \"C:\\sessionRuntime\\wininit.exe\", \"C:\\MSOCache\\All Users\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\lsass.exe\", \"C:\\Users\\Default User\\audiodg.exe\", \"C:\\Recovery\\4a649302-488a-11ee-87ae-f7238ff672e7\\dwm.exe\", \"C:\\Recovery\\4a649302-488a-11ee-87ae-f7238ff672e7\\services.exe\", \"C:\\Users\\Default User\\wininit.exe\", \"C:\\Recovery\\4a649302-488a-11ee-87ae-f7238ff672e7\\explorer.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Resources\\Ease of Access Themes\\wininit.exe\", \"C:\\sessionRuntime\\sppsvc.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\taskhost.exe\", \"C:\\sessionRuntime\\wininit.exe\", \"C:\\MSOCache\\All Users\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\lsass.exe\", \"C:\\Users\\Default User\\audiodg.exe\", \"C:\\Recovery\\4a649302-488a-11ee-87ae-f7238ff672e7\\dwm.exe\", \"C:\\Recovery\\4a649302-488a-11ee-87ae-f7238ff672e7\\services.exe\", \"C:\\Users\\Default User\\wininit.exe\", \"C:\\Recovery\\4a649302-488a-11ee-87ae-f7238ff672e7\\explorer.exe\", \"C:\\Program Files\\Windows Portable Devices\\conhost.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Resources\\Ease of Access Themes\\wininit.exe\", \"C:\\sessionRuntime\\sppsvc.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Resources\\Ease of Access Themes\\wininit.exe\", \"C:\\sessionRuntime\\sppsvc.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\taskhost.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Resources\\Ease of Access Themes\\wininit.exe\", \"C:\\sessionRuntime\\sppsvc.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\taskhost.exe\", \"C:\\sessionRuntime\\wininit.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Resources\\Ease of Access Themes\\wininit.exe\", \"C:\\sessionRuntime\\sppsvc.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\taskhost.exe\", \"C:\\sessionRuntime\\wininit.exe\", \"C:\\MSOCache\\All Users\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\lsass.exe\", \"C:\\Users\\Default User\\audiodg.exe\", \"C:\\Recovery\\4a649302-488a-11ee-87ae-f7238ff672e7\\dwm.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Resources\\Ease of Access Themes\\wininit.exe\", \"C:\\sessionRuntime\\sppsvc.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Offline\\taskhost.exe\", \"C:\\sessionRuntime\\wininit.exe\", \"C:\\MSOCache\\All Users\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\lsass.exe\", \"C:\\Users\\Default User\\audiodg.exe\", \"C:\\Recovery\\4a649302-488a-11ee-87ae-f7238ff672e7\\dwm.exe\", \"C:\\Recovery\\4a649302-488a-11ee-87ae-f7238ff672e7\\services.exe\""	Websvc.exe

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	276	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	792	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	576	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	2936	schtasks.exe	35

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000016cac-26.dat	dcrat
behavioral1/files/0x0007000000016cac-27.dat	dcrat
behavioral1/files/0x0007000000016cac-25.dat	dcrat
behavioral1/files/0x0007000000016cac-28.dat	dcrat
behavioral1/memory/2852-29-0x00000000008F0000-0x0000000000A58000-memory.dmp	dcrat
behavioral1/files/0x0006000000016d63-44.dat	dcrat
behavioral1/files/0x0007000000016e61-78.dat	dcrat
behavioral1/files/0x000a000000016e61-226.dat	dcrat
behavioral1/files/0x000a000000016e61-227.dat	dcrat
behavioral1/memory/2204-238-0x00000000003A0000-0x0000000000508000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
2852	Websvc.exe
2204	explorer.exe

Loads dropped DLL 2 IoCs

pid	Process
2712	cmd.exe
2712	cmd.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\MSOCache\\All Users\\explorer.exe\""	Websvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\lsass.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\lsass.exe\""	Websvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Users\\Default User\\audiodg.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Users\\Default User\\audiodg.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Resources\\Ease of Access Themes\\wininit.exe\""	Websvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\sessionRuntime\\sppsvc.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files (x86)\\Google\\Update\\Offline\\taskhost.exe\""	Websvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\4a649302-488a-11ee-87ae-f7238ff672e7\\dwm.exe\""	Websvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\4a649302-488a-11ee-87ae-f7238ff672e7\\explorer.exe\""	Websvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Windows Portable Devices\\conhost.exe\""	Websvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default User\\wininit.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default User\\wininit.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\sessionRuntime\\sppsvc.exe\""	Websvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\sessionRuntime\\wininit.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\MSOCache\\All Users\\explorer.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\4a649302-488a-11ee-87ae-f7238ff672e7\\services.exe\""	Websvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Resources\\Ease of Access Themes\\wininit.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\sessionRuntime\\wininit.exe\""	Websvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\4a649302-488a-11ee-87ae-f7238ff672e7\\services.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Windows Portable Devices\\conhost.exe\""	Websvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files (x86)\\Google\\Update\\Offline\\taskhost.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\4a649302-488a-11ee-87ae-f7238ff672e7\\dwm.exe\""	Websvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\4a649302-488a-11ee-87ae-f7238ff672e7\\explorer.exe\""	Websvc.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\088424020bedd6	Websvc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Offline\RCXB426.tmp	Websvc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Offline\taskhost.exe	Websvc.exe
File opened for modification	C:\Program Files\Windows Portable Devices\RCXC8D7.tmp	Websvc.exe
File opened for modification	C:\Program Files\Windows Portable Devices\conhost.exe	Websvc.exe
File created	C:\Program Files (x86)\Google\Update\Offline\taskhost.exe	Websvc.exe
File created	C:\Program Files (x86)\Google\Update\Offline\b75386f1303e64	Websvc.exe
File created	C:\Program Files\Windows Portable Devices\conhost.exe	Websvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Resources\Ease of Access Themes\56085415360792	Websvc.exe
File opened for modification	C:\Windows\Resources\Ease of Access Themes\RCXB00E.tmp	Websvc.exe
File created	C:\Windows\Resources\Ease of Access Themes\wininit.exe	Websvc.exe
File opened for modification	C:\Windows\Resources\Ease of Access Themes\wininit.exe	Websvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
568	schtasks.exe
276	schtasks.exe
1792	schtasks.exe
2136	schtasks.exe
1296	schtasks.exe
2880	schtasks.exe
2784	schtasks.exe
1868	schtasks.exe
1040	schtasks.exe
2128	schtasks.exe
2312	schtasks.exe
1612	schtasks.exe
1728	schtasks.exe
1736	schtasks.exe
2472	schtasks.exe
952	schtasks.exe
1308	schtasks.exe
1348	schtasks.exe
2528	schtasks.exe
2832	schtasks.exe
2152	schtasks.exe
2876	schtasks.exe
792	schtasks.exe
2204	schtasks.exe
1060	schtasks.exe
1752	schtasks.exe
432	schtasks.exe
2364	schtasks.exe
1812	schtasks.exe
576	schtasks.exe
1624	schtasks.exe
1784	schtasks.exe
1936	schtasks.exe
1048	schtasks.exe
1656	schtasks.exe
1652	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1808	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2852	Websvc.exe
2628	powershell.exe
2168	powershell.exe
2612	powershell.exe
1484	powershell.exe
1824	powershell.exe
2732	powershell.exe
2760	powershell.exe
2804	powershell.exe
1852	powershell.exe
2740	powershell.exe
2772	powershell.exe
3068	powershell.exe
2016	powershell.exe
2204	explorer.exe
2204	explorer.exe
2204	explorer.exe
2204	explorer.exe
2204	explorer.exe
2204	explorer.exe
2204	explorer.exe
2204	explorer.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	Websvc.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	2204	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2428	1288	a301f1d7fe80574cc4888e1477cf5a22.exe	28
PID 1288 wrote to memory of 2428	1288	a301f1d7fe80574cc4888e1477cf5a22.exe	28
PID 1288 wrote to memory of 2428	1288	a301f1d7fe80574cc4888e1477cf5a22.exe	28
PID 1288 wrote to memory of 2428	1288	a301f1d7fe80574cc4888e1477cf5a22.exe	28
PID 1288 wrote to memory of 2636	1288	a301f1d7fe80574cc4888e1477cf5a22.exe	29
PID 1288 wrote to memory of 2636	1288	a301f1d7fe80574cc4888e1477cf5a22.exe	29
PID 1288 wrote to memory of 2636	1288	a301f1d7fe80574cc4888e1477cf5a22.exe	29
PID 1288 wrote to memory of 2636	1288	a301f1d7fe80574cc4888e1477cf5a22.exe	29
PID 2636 wrote to memory of 2716	2636	cmd.exe	31
PID 2636 wrote to memory of 2716	2636	cmd.exe	31
PID 2636 wrote to memory of 2716	2636	cmd.exe	31
PID 2636 wrote to memory of 2716	2636	cmd.exe	31
PID 2428 wrote to memory of 2712	2428	WScript.exe	32
PID 2428 wrote to memory of 2712	2428	WScript.exe	32
PID 2428 wrote to memory of 2712	2428	WScript.exe	32
PID 2428 wrote to memory of 2712	2428	WScript.exe	32
PID 2712 wrote to memory of 2852	2712	cmd.exe	34
PID 2712 wrote to memory of 2852	2712	cmd.exe	34
PID 2712 wrote to memory of 2852	2712	cmd.exe	34
PID 2712 wrote to memory of 2852	2712	cmd.exe	34
PID 2852 wrote to memory of 3068	2852	Websvc.exe	72
PID 2852 wrote to memory of 3068	2852	Websvc.exe	72
PID 2852 wrote to memory of 3068	2852	Websvc.exe	72
PID 2852 wrote to memory of 2628	2852	Websvc.exe	74
PID 2852 wrote to memory of 2628	2852	Websvc.exe	74
PID 2852 wrote to memory of 2628	2852	Websvc.exe	74
PID 2852 wrote to memory of 2016	2852	Websvc.exe	73
PID 2852 wrote to memory of 2016	2852	Websvc.exe	73
PID 2852 wrote to memory of 2016	2852	Websvc.exe	73
PID 2852 wrote to memory of 2760	2852	Websvc.exe	76
PID 2852 wrote to memory of 2760	2852	Websvc.exe	76
PID 2852 wrote to memory of 2760	2852	Websvc.exe	76
PID 2852 wrote to memory of 2732	2852	Websvc.exe	77
PID 2852 wrote to memory of 2732	2852	Websvc.exe	77
PID 2852 wrote to memory of 2732	2852	Websvc.exe	77
PID 2852 wrote to memory of 2740	2852	Websvc.exe	78
PID 2852 wrote to memory of 2740	2852	Websvc.exe	78
PID 2852 wrote to memory of 2740	2852	Websvc.exe	78
PID 2852 wrote to memory of 2168	2852	Websvc.exe	79
PID 2852 wrote to memory of 2168	2852	Websvc.exe	79
PID 2852 wrote to memory of 2168	2852	Websvc.exe	79
PID 2852 wrote to memory of 2804	2852	Websvc.exe	80
PID 2852 wrote to memory of 2804	2852	Websvc.exe	80
PID 2852 wrote to memory of 2804	2852	Websvc.exe	80
PID 2852 wrote to memory of 1484	2852	Websvc.exe	81
PID 2852 wrote to memory of 1484	2852	Websvc.exe	81
PID 2852 wrote to memory of 1484	2852	Websvc.exe	81
PID 2852 wrote to memory of 2612	2852	Websvc.exe	85
PID 2852 wrote to memory of 2612	2852	Websvc.exe	85
PID 2852 wrote to memory of 2612	2852	Websvc.exe	85
PID 2852 wrote to memory of 2772	2852	Websvc.exe	86
PID 2852 wrote to memory of 2772	2852	Websvc.exe	86
PID 2852 wrote to memory of 2772	2852	Websvc.exe	86
PID 2852 wrote to memory of 1824	2852	Websvc.exe	87
PID 2852 wrote to memory of 1824	2852	Websvc.exe	87
PID 2852 wrote to memory of 1824	2852	Websvc.exe	87
PID 2852 wrote to memory of 1852	2852	Websvc.exe	88
PID 2852 wrote to memory of 1852	2852	Websvc.exe	88
PID 2852 wrote to memory of 1852	2852	Websvc.exe	88
PID 2852 wrote to memory of 2004	2852	Websvc.exe	98
PID 2852 wrote to memory of 2004	2852	Websvc.exe	98
PID 2852 wrote to memory of 2004	2852	Websvc.exe	98
PID 2004 wrote to memory of 1232	2004	cmd.exe	100
PID 2004 wrote to memory of 1232	2004	cmd.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a301f1d7fe80574cc4888e1477cf5a22.exe
"C:\Users\Admin\AppData\Local\Temp\a301f1d7fe80574cc4888e1477cf5a22.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\sessionRuntime\5HeHBeYSAA2CwTO9pvGy.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\sessionRuntime\msYPHmdUXWt2ls0BqRd56CbLzyri7.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\sessionRuntime\Websvc.exe
      "C:\sessionRuntime\Websvc.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\sessionRuntime\Websvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\sessionRuntime\sppsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Ease of Access Themes\wininit.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\Offline\taskhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\sessionRuntime\wininit.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsass.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\audiodg.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\4a649302-488a-11ee-87ae-f7238ff672e7\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\4a649302-488a-11ee-87ae-f7238ff672e7\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\wininit.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\4a649302-488a-11ee-87ae-f7238ff672e7\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1824
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pqvfmrp4IJ.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2004
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1232
      - C:\MSOCache\All Users\explorer.exe
        
        "C:\MSOCache\All Users\explorer.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\sessionRuntime\BQZonx42o2dgTPHko0W.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "╤é╨╛╨▒╨╕ ╨┐╨╕╨╖╨┤╨░"
    3⤵
    PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Windows\Resources\Ease of Access Themes\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Windows\Resources\Ease of Access Themes\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\sessionRuntime\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\sessionRuntime\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\sessionRuntime\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Update\Offline\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Offline\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\Update\Offline\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\sessionRuntime\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\sessionRuntime\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\sessionRuntime\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Default User\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Recovery\4a649302-488a-11ee-87ae-f7238ff672e7\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\4a649302-488a-11ee-87ae-f7238ff672e7\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\4a649302-488a-11ee-87ae-f7238ff672e7\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\4a649302-488a-11ee-87ae-f7238ff672e7\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\4a649302-488a-11ee-87ae-f7238ff672e7\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\4a649302-488a-11ee-87ae-f7238ff672e7\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Recovery\4a649302-488a-11ee-87ae-f7238ff672e7\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\4a649302-488a-11ee-87ae-f7238ff672e7\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Recovery\4a649302-488a-11ee-87ae-f7238ff672e7\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\explorer.exe

Filesize
1.4MB

MD5
cafdb78d975adefbd81776d57d1cef8e

SHA1
330c73cb127dfed99cbef7f14c766d73e2c4cfb4

SHA256
3bc0b6156f5c3f6127f8f8b926c646cc76e1f6c8542ee2f4b6874e6a9f5e223d

SHA512
1a1e51d84db1c6994f4e032b07f9e745e369373ab3d972516ac039e9f8ed2d592d53a66ade159cbce24b0ca9456d2a169f55f5d6d75ea0a2ac5624ec8aa349bc

Download Submit
C:\MSOCache\All Users\explorer.exe

Filesize
1.4MB

MD5
cafdb78d975adefbd81776d57d1cef8e

SHA1
330c73cb127dfed99cbef7f14c766d73e2c4cfb4

SHA256
3bc0b6156f5c3f6127f8f8b926c646cc76e1f6c8542ee2f4b6874e6a9f5e223d

SHA512
1a1e51d84db1c6994f4e032b07f9e745e369373ab3d972516ac039e9f8ed2d592d53a66ade159cbce24b0ca9456d2a169f55f5d6d75ea0a2ac5624ec8aa349bc

Download Submit
C:\Program Files (x86)\Google\Update\Offline\taskhost.exe

Filesize
1.4MB

MD5
2c035a0669daa9ba4a648d22867d1bb1

SHA1
37ef3e654a6a0daa1f3d7004866e3cf68592eb78

SHA256
5125afbb5f95e7c1cc73ffac2ef90bf975899af758280aea89b0aa3351fc68b7

SHA512
8556a8a791a8d1c6e99e4f81f19a86c2b7a929bc7034a0513265c648b5ef32d59c4bb756da68fc0b2d7b2523a866f42ee5c003f15dbdac3a2af8e69311eb8f8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\pqvfmrp4IJ.bat

Filesize
199B

MD5
ed0099d823baf91626a098334e0bb356

SHA1
294eb022cecf950bb1b99b2fa9567697d1d68756

SHA256
bc37a7164fc0db954010952cb8187f74d6119b5da390a01ecf8149d56394ed28

SHA512
1df9079ff812fed75afa2729c621e7d8140122647790e86da3bc2df2ad36abb7e41002789ba73c8935b761579c1bee5ee3977328b099cdc3db4f0a9b0203e9ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6071b73c89211bd5051250bead7a8658

SHA1
9c91dd35e70af4e89c6cf6b0bf0e4d4db3d10e1f

SHA256
e6e495477f7572b06eaf329f63f36d812382a216f6de7cb2770abd941aa75ca0

SHA512
97a2835cdd837038ba532e995c69fd1da116b7fee12088df840e917b341864e28ec83cf272a97c09d4802e00a504ad6d36003c056489dba91c9030c3e76c4a46

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6071b73c89211bd5051250bead7a8658

SHA1
9c91dd35e70af4e89c6cf6b0bf0e4d4db3d10e1f

SHA256
e6e495477f7572b06eaf329f63f36d812382a216f6de7cb2770abd941aa75ca0

SHA512
97a2835cdd837038ba532e995c69fd1da116b7fee12088df840e917b341864e28ec83cf272a97c09d4802e00a504ad6d36003c056489dba91c9030c3e76c4a46

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6071b73c89211bd5051250bead7a8658

SHA1
9c91dd35e70af4e89c6cf6b0bf0e4d4db3d10e1f

SHA256
e6e495477f7572b06eaf329f63f36d812382a216f6de7cb2770abd941aa75ca0

SHA512
97a2835cdd837038ba532e995c69fd1da116b7fee12088df840e917b341864e28ec83cf272a97c09d4802e00a504ad6d36003c056489dba91c9030c3e76c4a46

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6071b73c89211bd5051250bead7a8658

SHA1
9c91dd35e70af4e89c6cf6b0bf0e4d4db3d10e1f

SHA256
e6e495477f7572b06eaf329f63f36d812382a216f6de7cb2770abd941aa75ca0

SHA512
97a2835cdd837038ba532e995c69fd1da116b7fee12088df840e917b341864e28ec83cf272a97c09d4802e00a504ad6d36003c056489dba91c9030c3e76c4a46

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6071b73c89211bd5051250bead7a8658

SHA1
9c91dd35e70af4e89c6cf6b0bf0e4d4db3d10e1f

SHA256
e6e495477f7572b06eaf329f63f36d812382a216f6de7cb2770abd941aa75ca0

SHA512
97a2835cdd837038ba532e995c69fd1da116b7fee12088df840e917b341864e28ec83cf272a97c09d4802e00a504ad6d36003c056489dba91c9030c3e76c4a46

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6071b73c89211bd5051250bead7a8658

SHA1
9c91dd35e70af4e89c6cf6b0bf0e4d4db3d10e1f

SHA256
e6e495477f7572b06eaf329f63f36d812382a216f6de7cb2770abd941aa75ca0

SHA512
97a2835cdd837038ba532e995c69fd1da116b7fee12088df840e917b341864e28ec83cf272a97c09d4802e00a504ad6d36003c056489dba91c9030c3e76c4a46

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6071b73c89211bd5051250bead7a8658

SHA1
9c91dd35e70af4e89c6cf6b0bf0e4d4db3d10e1f

SHA256
e6e495477f7572b06eaf329f63f36d812382a216f6de7cb2770abd941aa75ca0

SHA512
97a2835cdd837038ba532e995c69fd1da116b7fee12088df840e917b341864e28ec83cf272a97c09d4802e00a504ad6d36003c056489dba91c9030c3e76c4a46

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RQX6WJWSCQQDZLU2EXMC.temp

Filesize
7KB

MD5
6071b73c89211bd5051250bead7a8658

SHA1
9c91dd35e70af4e89c6cf6b0bf0e4d4db3d10e1f

SHA256
e6e495477f7572b06eaf329f63f36d812382a216f6de7cb2770abd941aa75ca0

SHA512
97a2835cdd837038ba532e995c69fd1da116b7fee12088df840e917b341864e28ec83cf272a97c09d4802e00a504ad6d36003c056489dba91c9030c3e76c4a46

Download Submit
C:\sessionRuntime\5HeHBeYSAA2CwTO9pvGy.vbe

Filesize
220B

MD5
c5731936cad56493d1d02f81f33724d4

SHA1
91044fca73dd8327cc2fe42e2d904d40524e14d4

SHA256
2c8956b517395972468ebcc7aa3c5a33a99868293d3f04e00e23999671a10343

SHA512
2a40260900972926d9335228281054a6cb9de9af7db34cbe8d323b9dc7fe3deea9ae87d94cdd3de9caa3276f83af58c16acd3e897d84243dfa5ae0e6f713f786

Download Submit
C:\sessionRuntime\BQZonx42o2dgTPHko0W.bat

Filesize
31B

MD5
e424622e9d093d49d2a65931aaa9f989

SHA1
57db399d0ba4ce1f5e44bd15d002253104c189f9

SHA256
5d57c98d2ef4f4217d1c3175ec98c83d77b95d002c207dfbf39636720f8f5f5b

SHA512
435d0210d7067e3fa5c27060a71614e83d7578128df8b2938f723a0e3699272991bdc0f605bb177838a3783631f17feb2b592adfa27460775ae2f634cd3f53b6

Download Submit
C:\sessionRuntime\BQZonx42o2dgTPHko0W.bat

Filesize
31B

MD5
e424622e9d093d49d2a65931aaa9f989

SHA1
57db399d0ba4ce1f5e44bd15d002253104c189f9

SHA256
5d57c98d2ef4f4217d1c3175ec98c83d77b95d002c207dfbf39636720f8f5f5b

SHA512
435d0210d7067e3fa5c27060a71614e83d7578128df8b2938f723a0e3699272991bdc0f605bb177838a3783631f17feb2b592adfa27460775ae2f634cd3f53b6

Download Submit
C:\sessionRuntime\RCXB222.tmp

Filesize
1.4MB

MD5
cafdb78d975adefbd81776d57d1cef8e

SHA1
330c73cb127dfed99cbef7f14c766d73e2c4cfb4

SHA256
3bc0b6156f5c3f6127f8f8b926c646cc76e1f6c8542ee2f4b6874e6a9f5e223d

SHA512
1a1e51d84db1c6994f4e032b07f9e745e369373ab3d972516ac039e9f8ed2d592d53a66ade159cbce24b0ca9456d2a169f55f5d6d75ea0a2ac5624ec8aa349bc

Download Submit
C:\sessionRuntime\Websvc.exe

Filesize
1.4MB

MD5
2c035a0669daa9ba4a648d22867d1bb1

SHA1
37ef3e654a6a0daa1f3d7004866e3cf68592eb78

SHA256
5125afbb5f95e7c1cc73ffac2ef90bf975899af758280aea89b0aa3351fc68b7

SHA512
8556a8a791a8d1c6e99e4f81f19a86c2b7a929bc7034a0513265c648b5ef32d59c4bb756da68fc0b2d7b2523a866f42ee5c003f15dbdac3a2af8e69311eb8f8f

Download Submit
C:\sessionRuntime\Websvc.exe

Filesize
1.4MB

MD5
2c035a0669daa9ba4a648d22867d1bb1

SHA1
37ef3e654a6a0daa1f3d7004866e3cf68592eb78

SHA256
5125afbb5f95e7c1cc73ffac2ef90bf975899af758280aea89b0aa3351fc68b7

SHA512
8556a8a791a8d1c6e99e4f81f19a86c2b7a929bc7034a0513265c648b5ef32d59c4bb756da68fc0b2d7b2523a866f42ee5c003f15dbdac3a2af8e69311eb8f8f

Download Submit
C:\sessionRuntime\msYPHmdUXWt2ls0BqRd56CbLzyri7.bat

Filesize
142B

MD5
a598c33e007b3e2c9e42d1f515cf7ce9

SHA1
1c088d813a118ea682cd4fa8ace7e7c48dd5fef6

SHA256
95a3a16e7224db7dcfdc56988faec4f9da7d69c6cd1eec9c10d8ad9da285cb50

SHA512
baac20aba78da47e5505c9d5feefdf95a5f03ce6a0ed4b67690dbdd0de115361ce913bec4659569b52b5002aa731d5a3f89b3fc25b4a27a840143cb93441944f

Download Submit
\sessionRuntime\Websvc.exe

Filesize
1.4MB

MD5
2c035a0669daa9ba4a648d22867d1bb1

SHA1
37ef3e654a6a0daa1f3d7004866e3cf68592eb78

SHA256
5125afbb5f95e7c1cc73ffac2ef90bf975899af758280aea89b0aa3351fc68b7

SHA512
8556a8a791a8d1c6e99e4f81f19a86c2b7a929bc7034a0513265c648b5ef32d59c4bb756da68fc0b2d7b2523a866f42ee5c003f15dbdac3a2af8e69311eb8f8f

Download Submit
\sessionRuntime\Websvc.exe

Filesize
1.4MB

MD5
2c035a0669daa9ba4a648d22867d1bb1

SHA1
37ef3e654a6a0daa1f3d7004866e3cf68592eb78

SHA256
5125afbb5f95e7c1cc73ffac2ef90bf975899af758280aea89b0aa3351fc68b7

SHA512
8556a8a791a8d1c6e99e4f81f19a86c2b7a929bc7034a0513265c648b5ef32d59c4bb756da68fc0b2d7b2523a866f42ee5c003f15dbdac3a2af8e69311eb8f8f

Download Submit
memory/1484-217-0x000007FEED2D0000-0x000007FEEDC6D000-memory.dmp

Filesize
9.6MB

Download
memory/1484-218-0x00000000026D0000-0x0000000002750000-memory.dmp

Filesize
512KB

Download
memory/1484-219-0x000007FEED2D0000-0x000007FEEDC6D000-memory.dmp

Filesize
9.6MB

Download
memory/1484-220-0x00000000026D0000-0x0000000002750000-memory.dmp

Filesize
512KB

Download
memory/1484-222-0x00000000026D0000-0x0000000002750000-memory.dmp

Filesize
512KB

Download
memory/1484-233-0x00000000026DB000-0x0000000002742000-memory.dmp

Filesize
412KB

Download
memory/1484-236-0x000007FEED2D0000-0x000007FEEDC6D000-memory.dmp

Filesize
9.6MB

Download
memory/1824-221-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/1824-223-0x000007FEED2D0000-0x000007FEEDC6D000-memory.dmp

Filesize
9.6MB

Download
memory/1824-224-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/1824-235-0x000007FEED2D0000-0x000007FEEDC6D000-memory.dmp

Filesize
9.6MB

Download
memory/1824-230-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/1824-225-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/2168-212-0x0000000002590000-0x0000000002610000-memory.dmp

Filesize
512KB

Download
memory/2168-210-0x000007FEED2D0000-0x000007FEEDC6D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-208-0x0000000002594000-0x0000000002597000-memory.dmp

Filesize
12KB

Download
memory/2168-206-0x000000000259B000-0x0000000002602000-memory.dmp

Filesize
412KB

Download
memory/2204-238-0x00000000003A0000-0x0000000000508000-memory.dmp

Filesize
1.4MB

Download
memory/2612-181-0x000000001B3C0000-0x000000001B6A2000-memory.dmp

Filesize
2.9MB

Download
memory/2612-216-0x0000000002524000-0x0000000002527000-memory.dmp

Filesize
12KB

Download
memory/2612-211-0x000007FEED2D0000-0x000007FEEDC6D000-memory.dmp

Filesize
9.6MB

Download
memory/2612-209-0x000000000252B000-0x0000000002592000-memory.dmp

Filesize
412KB

Download
memory/2628-215-0x00000000024D0000-0x0000000002550000-memory.dmp

Filesize
512KB

Download
memory/2628-213-0x00000000024D0000-0x0000000002550000-memory.dmp

Filesize
512KB

Download
memory/2628-205-0x00000000024D4000-0x00000000024D7000-memory.dmp

Filesize
12KB

Download
memory/2628-187-0x0000000001EB0000-0x0000000001EB8000-memory.dmp

Filesize
32KB

Download
memory/2628-207-0x00000000024DB000-0x0000000002542000-memory.dmp

Filesize
412KB

Download
memory/2628-214-0x000007FEED2D0000-0x000007FEEDC6D000-memory.dmp

Filesize
9.6MB

Download
memory/2732-229-0x0000000001E40000-0x0000000001EC0000-memory.dmp

Filesize
512KB

Download
memory/2732-228-0x000007FEED2D0000-0x000007FEEDC6D000-memory.dmp

Filesize
9.6MB

Download
memory/2732-231-0x0000000001E40000-0x0000000001EC0000-memory.dmp

Filesize
512KB

Download
memory/2732-232-0x0000000001E40000-0x0000000001EC0000-memory.dmp

Filesize
512KB

Download
memory/2732-237-0x0000000001E4B000-0x0000000001EB2000-memory.dmp

Filesize
412KB

Download
memory/2760-243-0x000007FEED2D0000-0x000007FEEDC6D000-memory.dmp

Filesize
9.6MB

Download
memory/2760-240-0x000000000279B000-0x0000000002802000-memory.dmp

Filesize
412KB

Download
memory/2760-241-0x0000000002790000-0x0000000002810000-memory.dmp

Filesize
512KB

Download
memory/2760-234-0x0000000002790000-0x0000000002810000-memory.dmp

Filesize
512KB

Download
memory/2760-239-0x000007FEED2D0000-0x000007FEEDC6D000-memory.dmp

Filesize
9.6MB

Download
memory/2804-242-0x000007FEED2D0000-0x000007FEEDC6D000-memory.dmp

Filesize
9.6MB

Download
memory/2852-96-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download
memory/2852-109-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download
memory/2852-34-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download
memory/2852-33-0x0000000000460000-0x000000000047C000-memory.dmp

Filesize
112KB

Download
memory/2852-39-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download
memory/2852-108-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download
memory/2852-151-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download
memory/2852-32-0x0000000000330000-0x0000000000338000-memory.dmp

Filesize
32KB

Download
memory/2852-36-0x00000000004A0000-0x00000000004AC000-memory.dmp

Filesize
48KB

Download
memory/2852-31-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download
memory/2852-37-0x00000000004D0000-0x00000000004DE000-memory.dmp

Filesize
56KB

Download
memory/2852-145-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download
memory/2852-38-0x00000000004B0000-0x00000000004BC000-memory.dmp

Filesize
48KB

Download
memory/2852-35-0x0000000000480000-0x0000000000496000-memory.dmp

Filesize
88KB

Download
memory/2852-30-0x000007FEF5330000-0x000007FEF5D1C000-memory.dmp

Filesize
9.9MB

Download
memory/2852-83-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download
memory/2852-144-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download
memory/2852-82-0x000007FEF5330000-0x000007FEF5D1C000-memory.dmp

Filesize
9.9MB

Download
memory/2852-29-0x00000000008F0000-0x0000000000A58000-memory.dmp

Filesize
1.4MB

Download
memory/2852-70-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download
memory/2852-126-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download
memory/2852-66-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download
memory/2852-55-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download
memory/2852-50-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download
memory/2852-194-0x000007FEF5330000-0x000007FEF5D1C000-memory.dmp

Filesize
9.9MB

Download