dcrat | 27915b065e4ce2a1a6e069838676313319a818da7e9ec5d685e24afcb3d412f3

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
16/01/2024, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
Size 828KB
Sample240116-ea8v3adeb4
SHA256 82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3
MD5 c6c27a53291cf019d8f1d7a646e016be
SHA1 0f30ed03cda824dac6af76058b82d0c791e9d7a8
SHA512 d1c10ffa9d5ce22ea96764436c07c2fe98a7a5249f4185b06e5d907aa83d933bc948d761b5089346361508fe0ec39580b875fea7c55b6853ef108a1b1d0f46c4
SSDEEP 12288:Xarbei3UC5OcmVNDcAVC6Jm23MF3Pq5vwUVUFLlnU+:diEC5AVNDcAVdE3yJn+ht
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1420	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	276	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	2764	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2764	schtasks.exe	28

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2136-0-0x0000000000240000-0x0000000000316000-memory.dmp	dcrat
behavioral1/files/0x0006000000014203-11.dat	dcrat
behavioral1/files/0x0006000000014ba6-41.dat	dcrat
behavioral1/memory/1600-43-0x0000000000300000-0x00000000003D6000-memory.dmp	dcrat
behavioral1/memory/1600-45-0x000000001AE50000-0x000000001AED0000-memory.dmp	dcrat
behavioral1/files/0x0006000000014ba6-42.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
1600	smss.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Uninstall Information\6203df4a6bafc7	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\cc11b995f2a76d	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\dllhost.exe	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
File created	C:\Program Files (x86)\Uninstall Information\lsass.exe	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\6ccacd8608530f	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\winlogon.exe	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\spoolsv.exe	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\f3b6ecef712a24	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\Idle.exe	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\IME\fr-FR\sppsvc.exe	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
File created	C:\Windows\IME\fr-FR\0a1fd5f707cd16	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
File created	C:\Windows\inf\82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
File created	C:\Windows\inf\75d2723ef1d23d	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1476	schtasks.exe
2320	schtasks.exe
1916	schtasks.exe
2872	schtasks.exe
2728	schtasks.exe
276	schtasks.exe
1580	schtasks.exe
2184	schtasks.exe
684	schtasks.exe
2104	schtasks.exe
2908	schtasks.exe
1488	schtasks.exe
2028	schtasks.exe
532	schtasks.exe
2416	schtasks.exe
1500	schtasks.exe
3024	schtasks.exe
2596	schtasks.exe
2876	schtasks.exe
2468	schtasks.exe
2168	schtasks.exe
2256	schtasks.exe
1960	schtasks.exe
1780	schtasks.exe
2216	schtasks.exe
2068	schtasks.exe
1220	schtasks.exe
1456	schtasks.exe
2832	schtasks.exe
2716	schtasks.exe
2016	schtasks.exe
848	schtasks.exe
2616	schtasks.exe
1420	schtasks.exe
968	schtasks.exe
2896	schtasks.exe
1680	schtasks.exe
1704	schtasks.exe
3032	schtasks.exe
2844	schtasks.exe
2644	schtasks.exe
1792	schtasks.exe
1768	schtasks.exe
1568	schtasks.exe
1008	schtasks.exe
812	schtasks.exe
2384	schtasks.exe
2680	schtasks.exe
1260	schtasks.exe
2460	schtasks.exe
1200	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2136	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
2136	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
2136	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
2136	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
2136	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
2136	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
2136	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
1600	smss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
Token: SeDebugPrivilege	1600	smss.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1600	2136	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe	72
PID 2136 wrote to memory of 1600	2136	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe	72
PID 2136 wrote to memory of 1600	2136	82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe	72

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe
"C:\Users\Admin\AppData\Local\Temp\82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136
- C:\MSOCache\All Users\smss.exe
  "C:\MSOCache\All Users\smss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Templates\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\All Users\Templates\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Templates\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Templates\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\Templates\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Uninstall Information\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Uninstall Information\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Templates\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf38" /sc MINUTE /mo 12 /tr "'C:\Windows\inf\82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3" /sc ONLOGON /tr "'C:\Windows\inf\82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf38" /sc MINUTE /mo 9 /tr "'C:\Windows\inf\82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\IME\fr-FR\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Windows\IME\fr-FR\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\IME\fr-FR\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf38" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf38" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

smss.exe

Path C:\MSOCache\All Users\smss.exe
Size 621KB
SHA256 c2bd9335ab27aa271b1115da1f2422d6b91bcab62e99b3e42938d9f679a7c074
MD5 79d402be0e01b22a6b139429835610b7
SHA1 3d04d29b41c765ba905577d9a4b2d9fbf48a1205
SHA512 29d670ba092fc872b249aa22db83c3cfb75b936edd4ccac01cab415b6ba9e48a317e82183a83acac58b5c99489d8930e138958319ca4b622b5af569595c78c85
SSDEEP 6144:yUTjtaFxrPei3UC58Tc3Oq6SDuvH6Yce16acyzVCMWZjLWNw8qI7W941/XPO2jzc:Xarbei3UC5OcmVNDcAVC6Jm23MF3Pq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

smss.exe

Path C:\MSOCache\All Users\smss.exe
Size 392KB
SHA256 41a14bb67452bfd5d3c4ac1bd591d17f67064811a6bb1bbdebba8b5c3d09da94
MD5 77e6061bb96ce711cc99a2229595a501
SHA1 258df56522c6adee973ef48562440ec84ec12439
SHA512 1e4ec447fd01775d25f7f9ba0724202a73a8ea536c97cbe99069747dfcade9bed3311f8e4d17a12d5a16470a71f4ec0c5544ee0febb16798cb8bed979c0ac9c4
SSDEEP 3072:6B5vgwuHwHcwTTVpoebmFzgrEuem+t8Ghs+Mxd+mPeU1D1n3HLVqC5W7kdCCGsZL:yUTjtaFxrPei3UC58Tc3Oq6Sv
MD5 SHA1 SHA512 SSDEEP

Submit Download

sppsvc.exe

Path C:\MSOCache\All Users\sppsvc.exe
Size 828KB
SHA256 82605b3e2083ba7ffaebc606fe6126c1e2b3fe56438b23e548dedd9b52a6fcf3
MD5 c6c27a53291cf019d8f1d7a646e016be
SHA1 0f30ed03cda824dac6af76058b82d0c791e9d7a8
SHA512 d1c10ffa9d5ce22ea96764436c07c2fe98a7a5249f4185b06e5d907aa83d933bc948d761b5089346361508fe0ec39580b875fea7c55b6853ef108a1b1d0f46c4
SSDEEP 12288:Xarbei3UC5OcmVNDcAVC6Jm23MF3Pq5vwUVUFLlnU+:diEC5AVNDcAVdE3yJn+ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1600-43-0x0000000000300000-0x00000000003D6000-memory.dmp

Download

memory/1600-44-0x000007FEF6220000-0x000007FEF6C0C000-memory.dmp

Download

memory/1600-45-0x000000001AE50000-0x000000001AED0000-memory.dmp

Download

memory/1600-46-0x000007FEF6220000-0x000007FEF6C0C000-memory.dmp

Download

memory/2136-0-0x0000000000240000-0x0000000000316000-memory.dmp

Download

memory/2136-1-0x000007FEF6220000-0x000007FEF6C0C000-memory.dmp

Download

memory/2136-2-0x000000001AFB0000-0x000000001B030000-memory.dmp

Download

memory/2136-47-0x000007FEF6220000-0x000007FEF6C0C000-memory.dmp

Download