dcrat | 23f2af12d94f4f4ad3809c443a3d1bb286bfd47b2a10c7efe682c5222bae7fc2

Analysis

max time kernel
24s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 03:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06f13a65bc1f66c683df0d1fb6dab168.exe
Size 1.1MB
Sample240106-dy66psfgdn
SHA256 23f2af12d94f4f4ad3809c443a3d1bb286bfd47b2a10c7efe682c5222bae7fc2
MD5 06f13a65bc1f66c683df0d1fb6dab168
SHA1 887ca78d582ecceec295be0afd5a0a6597dc9a03
SHA512 65e536015f098f4bb5d3fb1d095c556a712bc112ab87ca14bc3bb540d931a71f3154c36a1d8049273dfaabe0b7f1cc5e0ee3d2595f21eca29946bef2471e80f8
SSDEEP 24576:4C8we8+2KPxHzGlolF+drctw9x20h4YuVSIPDGP:4JY1x2iuwIPD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3920	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	496	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4084	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3696	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3792	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3380	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4716	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4032	5028	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	5028	schtasks.exe	90

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	06f13a65bc1f66c683df0d1fb6dab168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	06f13a65bc1f66c683df0d1fb6dab168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	06f13a65bc1f66c683df0d1fb6dab168.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4312-0-0x0000000000970000-0x0000000000A90000-memory.dmp	dcrat
behavioral2/files/0x000600000002320d-17.dat	dcrat
behavioral2/files/0x000600000002321f-50.dat	dcrat
behavioral2/files/0x000600000002321f-49.dat	dcrat
behavioral2/files/0x000600000002321f-63.dat	dcrat

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	06f13a65bc1f66c683df0d1fb6dab168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	06f13a65bc1f66c683df0d1fb6dab168.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\sr-Latn-RS\services.exe	06f13a65bc1f66c683df0d1fb6dab168.exe
File created	C:\Windows\System32\sr-Latn-RS\c5b4cb5e9653cc	06f13a65bc1f66c683df0d1fb6dab168.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\explorer.exe	06f13a65bc1f66c683df0d1fb6dab168.exe
File created	C:\Program Files\Common Files\System\it-IT\24dbde2999530e	06f13a65bc1f66c683df0d1fb6dab168.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\unsecapp.exe	06f13a65bc1f66c683df0d1fb6dab168.exe
File created	C:\Program Files\WindowsPowerShell\Modules\886983d96e3d3e	06f13a65bc1f66c683df0d1fb6dab168.exe
File created	C:\Program Files\Windows NT\Accessories\en-US\WmiPrvSE.exe	06f13a65bc1f66c683df0d1fb6dab168.exe
File created	C:\Program Files\Windows NT\Accessories\en-US\24dbde2999530e	06f13a65bc1f66c683df0d1fb6dab168.exe
File created	C:\Program Files\Uninstall Information\explorer.exe	06f13a65bc1f66c683df0d1fb6dab168.exe
File created	C:\Program Files\Uninstall Information\7a0fd90576e088	06f13a65bc1f66c683df0d1fb6dab168.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\7a0fd90576e088	06f13a65bc1f66c683df0d1fb6dab168.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\ee2ad38f3d4382	06f13a65bc1f66c683df0d1fb6dab168.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\unsecapp.exe	06f13a65bc1f66c683df0d1fb6dab168.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\29c1c3cc0f7685	06f13a65bc1f66c683df0d1fb6dab168.exe
File created	C:\Program Files\WindowsPowerShell\Modules\csrss.exe	06f13a65bc1f66c683df0d1fb6dab168.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\Registry.exe	06f13a65bc1f66c683df0d1fb6dab168.exe
File created	C:\Program Files\Common Files\System\it-IT\WmiPrvSE.exe	06f13a65bc1f66c683df0d1fb6dab168.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Globalization\ICU\MusNotification.exe	06f13a65bc1f66c683df0d1fb6dab168.exe
File created	C:\Windows\Globalization\ICU\aa97147c4c782d	06f13a65bc1f66c683df0d1fb6dab168.exe

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3920	schtasks.exe
496	schtasks.exe
3188	schtasks.exe
4032	schtasks.exe
2352	schtasks.exe
4084	schtasks.exe
3916	schtasks.exe
2392	schtasks.exe
2800	schtasks.exe
4232	schtasks.exe
4984	schtasks.exe
4460	schtasks.exe
4300	schtasks.exe
1972	schtasks.exe
5080	schtasks.exe
4052	schtasks.exe
4716	schtasks.exe
2524	schtasks.exe
2448	schtasks.exe
888	schtasks.exe
2392	schtasks.exe
1960	schtasks.exe
2248	schtasks.exe
448	schtasks.exe
3228	schtasks.exe
1964	schtasks.exe
1932	schtasks.exe
1944	schtasks.exe
3492	schtasks.exe
4568	schtasks.exe
3716	schtasks.exe
1396	schtasks.exe
4804	schtasks.exe
3640	schtasks.exe
2556	schtasks.exe
4544	schtasks.exe
3060	schtasks.exe
3696	schtasks.exe
3792	schtasks.exe
1932	schtasks.exe
2532	schtasks.exe
3044	schtasks.exe
432	schtasks.exe
3052	schtasks.exe
3380	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4312	06f13a65bc1f66c683df0d1fb6dab168.exe
4312	06f13a65bc1f66c683df0d1fb6dab168.exe
4312	06f13a65bc1f66c683df0d1fb6dab168.exe
4312	06f13a65bc1f66c683df0d1fb6dab168.exe
4312	06f13a65bc1f66c683df0d1fb6dab168.exe
4312	06f13a65bc1f66c683df0d1fb6dab168.exe
4312	06f13a65bc1f66c683df0d1fb6dab168.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	06f13a65bc1f66c683df0d1fb6dab168.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	06f13a65bc1f66c683df0d1fb6dab168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	06f13a65bc1f66c683df0d1fb6dab168.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	06f13a65bc1f66c683df0d1fb6dab168.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\06f13a65bc1f66c683df0d1fb6dab168.exe
"C:\Users\Admin\AppData\Local\Temp\06f13a65bc1f66c683df0d1fb6dab168.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\I2t5VTet71.bat"
  2⤵
  PID:3272
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:232
- - C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe
    "C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe"
    3⤵
    PID:2928
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e8efaca5-c8b8-4a03-866a-1b5a92a6798c.vbs"
      4⤵
      PID:3548
    - - C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe"
        5⤵
        
        PID:1492
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a6066c18-6a34-4152-991b-7d25d73bf6de.vbs"
      4⤵
      PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\Modules\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\WindowsPowerShell\Modules\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\System32\sr-Latn-RS\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\sr-Latn-RS\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\System32\sr-Latn-RS\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\System\it-IT\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\System\it-IT\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Common Files\System\it-IT\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\Accessories\en-US\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-US\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\Accessories\en-US\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 8 /tr "'C:\Windows\Globalization\ICU\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Windows\Globalization\ICU\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 11 /tr "'C:\Windows\Globalization\ICU\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\it-IT\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\it-IT\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\it-IT\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Links\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Links\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\Links\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Installer\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\Installer\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Windows\Installer\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe
Size 274KB
SHA256 045b6ec9cef8d941ccacdf3b5cbeccf16f64bf6b8bb2228769844ff86c5beeb6
MD5 53824fa5c3aadb299835371eec80839e
SHA1 ec8b967d09c10610816bde70d54d2924cba785bf
SHA512 828b97392b405bb849c931996d834d0e5c3e7a7b9a9e0e25e464538104c450d548893727bfb4cf97bd5c2481f6b2a105175a90aaa4dcf3c7f2773a4e98fe61f1
SSDEEP 3072:vmBaJNEllB+TE7E08w0a888Eu3lkk67rhqCzM:dHq7RLR03lkkolzM
MD5 SHA1 SHA512 SSDEEP

Submit Download

RuntimeBroker.exe

Path C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe
Size 365KB
SHA256 72f3923bac3ee19ed2d580ad4e50fbb03ea8b702b0c6ebc7188121246a652dcc
MD5 fe4e235d9de09e2e681f186ee6641cd2
SHA1 42cf628d72f6f757c818e2abc5544a9771f55838
SHA512 240c4f7af3adee9c551f66763d2a2956bd68350ac73da2b4a0cac763308175db45e3b28978251d4f572472b5cd9bb4dc305414c5a41c40db6c00d8941ba0c2b2
SSDEEP 3072:vmBaJNEllB+TE7E08w0a888Eu3lkk67rhqCza18w0fORIQRdqVa3CGLuYxO6RNU4:dHq7RLR03lkkolza18wHRIcqVOo4
MD5 SHA1 SHA512 SSDEEP

Submit Download

RuntimeBroker.exe

Path C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe
Size 144KB
SHA256 aa2c35457e319c9ac5dc30487d9fa2a1bb823ee73e778263db40b85b664ccdc0
MD5 79ab8aaeb42bff6f6e29fdb7d4f304d1
SHA1 fef5948465b18c93d0ca213a4b6445222846a37b
SHA512 bfd6d9ded976f7b1d49e45126f220fe4b21879dde9a70e210d3d46ad5d8563b572307dd265185df01529e21efbc21480a9710d73eca4db7354829d6ee6cb9b69
SSDEEP 1536:vw++82Zrm1paaN9i5bUEt7w5TP3cMMbY/0rU9JPxooKovZNHstuasr:vmBaJNEllB+TE7E08w0aQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

RuntimeBroker.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
Size 1KB
SHA256 34c15d8e79fef4bddec7e34f3426df3b68f8fc6deac29ea12d110f6c529fe3bb
MD5 5cb90c90e96a3b36461ed44d339d02e5
SHA1 5508281a22cca7757bc4fbdb0a8e885c9f596a04
SHA512 63735938c841c28824e3482559df18839930acc5ea8600b1074439b70a2f600a92f41593568e49991f25f079e7f7361b4f1678feadbf004f6e9e4d51d36598d4
MD5 SHA1 SHA512

Submit Download

I2t5VTet71.bat

Path C:\Users\Admin\AppData\Local\Temp\I2t5VTet71.bat
Size 226B
SHA256 b0ffa5b48bb7bf2d4221e28f3e0ba3d90a48c2c7d32e57a25ed304eba46f1632
MD5 5b7a10783cf45f2939de8de9831dbd3d
SHA1 53772b60141e8cd565d6081dd5a4a00c8988b282
SHA512 0f754dd28e80eff68d5dbd518af0d425c81e5cb449ca21c102180d4ae023e660989edaef6432c6ec7e869b538407432ba759b11229cba36855f8b62cadde3716
MD5 SHA1 SHA512

Submit Download

a6066c18-6a34-4152-991b-7d25d73bf6de.vbs

Path C:\Users\Admin\AppData\Local\Temp\a6066c18-6a34-4152-991b-7d25d73bf6de.vbs
Size 513B
SHA256 6d85cf695a39cbbeb12d2bec2fd25f8867a47f9189bb29e5c8bd91168655afc0
MD5 c8becdf0ce27f9d74589f22ee512f96b
SHA1 af8f15cb1b627e079631e1fb8ca04709bc14b1ae
SHA512 47f8c45426ade995c6be7b8c11ff16b1b2e62b9100af16da3f22c992b2fe835748177da1dcdf3743b34a9065d348abec116a63724a077f915527260470429fe7
MD5 SHA1 SHA512

Submit Download

e8efaca5-c8b8-4a03-866a-1b5a92a6798c.vbs

Path C:\Users\Admin\AppData\Local\Temp\e8efaca5-c8b8-4a03-866a-1b5a92a6798c.vbs
Size 737B
SHA256 4d5e2c05787249978f94abe5c7c456705225635fee960fa922d61020b5682aab
MD5 4b51440ef073ab564a3a3c852db843e4
SHA1 f71143f3b06a8ff490c3a2793f069db01afb0f90
SHA512 f6e1711874b27e8faae7bc9a3ca4122268c593359f65f899482793ff0ad3506f738ca2963aa992e2131d598174ce7189062055d52e6fe995423bb1043166ff11
MD5 SHA1 SHA512

Submit Download

services.exe

Path C:\Windows\System32\sr-Latn-RS\services.exe
Size 13KB
SHA256 8e29a60df852b730e34f6a2d724577f71f45e9e7b79d79d68165a101f023c125
MD5 784e52c4df42716192a7a75134f50d27
SHA1 b16a5356d056eb70d6cf53727c630d7ce5eb2edd
SHA512 60c91619c358250533f783ba9691a11e182dedf2cbac041b7d1bf4e3b04dc10ebd9d906ea167cc4b10adbe64a6f32b14e0ef8d4db669cf2b13eca4397092b8f4
SSDEEP 384:8RijdOLzyq4wQ3FMesgMKbq9ZNrCk/IjwcQ8:ai6b4FGNrwwc1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1492-65-0x00007FFDF7A90000-0x00007FFDF8551000-memory.dmp

Download

memory/1492-67-0x000000001D140000-0x000000001D242000-memory.dmp

Download

memory/1492-68-0x00007FFDF7A90000-0x00007FFDF8551000-memory.dmp

Download

memory/2928-62-0x00007FFDF7960000-0x00007FFDF8421000-memory.dmp

Download

memory/2928-51-0x00007FFDF7960000-0x00007FFDF8421000-memory.dmp

Download

memory/4312-5-0x000000001B5B0000-0x000000001B5B8000-memory.dmp

Download

memory/4312-46-0x00007FFDF7C60000-0x00007FFDF8721000-memory.dmp

Download

memory/4312-32-0x000000001B590000-0x000000001B5A0000-memory.dmp

Download

memory/4312-27-0x00007FFDF7C60000-0x00007FFDF8721000-memory.dmp

Download

memory/4312-8-0x000000001BD00000-0x000000001BD0C000-memory.dmp

Download

memory/4312-7-0x000000001BCE0000-0x000000001BCEA000-memory.dmp

Download

memory/4312-0-0x0000000000970000-0x0000000000A90000-memory.dmp

Download

memory/4312-6-0x000000001B5C0000-0x000000001B5CA000-memory.dmp

Download

memory/4312-4-0x000000001B5A0000-0x000000001B5AE000-memory.dmp

Download

memory/4312-3-0x000000001B580000-0x000000001B58E000-memory.dmp

Download

memory/4312-1-0x00007FFDF7C60000-0x00007FFDF8721000-memory.dmp

Download

memory/4312-2-0x000000001B590000-0x000000001B5A0000-memory.dmp

Download