dcrat | 07ef2eee7e56c2338327d52269e755e7dc2bc82e2fb8781de0c1ea7857003d49

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2024, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
08ef924d6dc6b7159cf34fb9db4cacac.exe
Size 1.1MB
Sample240205-cszzrsgdc2
SHA256 07ef2eee7e56c2338327d52269e755e7dc2bc82e2fb8781de0c1ea7857003d49
MD5 08ef924d6dc6b7159cf34fb9db4cacac
SHA1 ba2527b88a6b290c1c49649fa66aea144fffbe4d
SHA512 2e9952188a7215d71801785e119149d463238ee238d0327f13aa954ad3e3712583df1d0be2a6e4daa9271f522d6082ef3e45e30df919a387f7484ffe6779cf67
SSDEEP 24576:6T25fx6ZCxiXt5onpL1QkRdSAAS7HrU/:0kfbi0pb3pr2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3288	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5028	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4276	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3352	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	492	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3868	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3976	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	3580	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	3580	schtasks.exe	83

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2848-0-0x0000000000E60000-0x0000000000F86000-memory.dmp	dcrat
behavioral2/files/0x0006000000023241-27.dat	dcrat
behavioral2/files/0x0007000000023263-70.dat	dcrat
behavioral2/files/0x000f000000023262-168.dat	dcrat
behavioral2/files/0x000600000002325b-211.dat	dcrat
behavioral2/files/0x000600000002325b-212.dat	dcrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	08ef924d6dc6b7159cf34fb9db4cacac.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	wininit.exe

Executes dropped EXE 1 IoCs

pid	Process
4336	wininit.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\Registry.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\Registry.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\ee2ad38f3d4382	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\RCX88F5.tmp	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\RCX8905.tmp	08ef924d6dc6b7159cf34fb9db4cacac.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\fr-FR\upfc.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Windows\TAPI\winlogon.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Windows\TAPI\cc11b995f2a76d	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Windows\SystemResources\Microsoft.Windows.SecHealthUI\pris\Registry.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Windows\PLA\Rules\RCX9253.tmp	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Windows\TAPI\winlogon.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Windows\SystemResources\Microsoft.Windows.SecHealthUI\pris\RCX86C0.tmp	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Windows\fr-FR\ea1d8f6d871115	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Windows\SystemResources\Microsoft.Windows.SecHealthUI\pris\Registry.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Windows\PLA\Rules\69ddcba757bf72	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Windows\fr-FR\RCX817C.tmp	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Windows\fr-FR\RCX818D.tmp	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Windows\fr-FR\upfc.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Windows\SystemResources\Microsoft.Windows.SecHealthUI\pris\RCX86D1.tmp	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Windows\SystemResources\Microsoft.Windows.SecHealthUI\pris\ee2ad38f3d4382	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Windows\TAPI\RCX845E.tmp	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Windows\PLA\Rules\smss.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Windows\PLA\Rules\smss.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Windows\TAPI\RCX83A1.tmp	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Windows\PLA\Rules\RCX92A2.tmp	08ef924d6dc6b7159cf34fb9db4cacac.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4528	schtasks.exe
4840	schtasks.exe
1296	schtasks.exe
3884	schtasks.exe
2064	schtasks.exe
1648	schtasks.exe
940	schtasks.exe
3692	schtasks.exe
1756	schtasks.exe
2292	schtasks.exe
4424	schtasks.exe
4488	schtasks.exe
1928	schtasks.exe
3976	schtasks.exe
3368	schtasks.exe
948	schtasks.exe
4756	schtasks.exe
3868	schtasks.exe
4408	schtasks.exe
1464	schtasks.exe
4276	schtasks.exe
3164	schtasks.exe
4880	schtasks.exe
4552	schtasks.exe
4416	schtasks.exe
5012	schtasks.exe
3464	schtasks.exe
4432	schtasks.exe
3232	schtasks.exe
548	schtasks.exe
4372	schtasks.exe
3288	schtasks.exe
5096	schtasks.exe
3352	schtasks.exe
492	schtasks.exe
452	schtasks.exe
4572	schtasks.exe
5028	schtasks.exe
4852	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings	08ef924d6dc6b7159cf34fb9db4cacac.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings	wininit.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
4336	wininit.exe
4336	wininit.exe
4336	wininit.exe
4336	wininit.exe
4336	wininit.exe
4336	wininit.exe
4336	wininit.exe
4336	wininit.exe
4336	wininit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4336	wininit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	08ef924d6dc6b7159cf34fb9db4cacac.exe
Token: SeDebugPrivilege	4336	wininit.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 704	2848	08ef924d6dc6b7159cf34fb9db4cacac.exe	127
PID 2848 wrote to memory of 704	2848	08ef924d6dc6b7159cf34fb9db4cacac.exe	127
PID 704 wrote to memory of 4464	704	cmd.exe	129
PID 704 wrote to memory of 4464	704	cmd.exe	129
PID 704 wrote to memory of 4336	704	cmd.exe	132
PID 704 wrote to memory of 4336	704	cmd.exe	132
PID 4336 wrote to memory of 1292	4336	wininit.exe	133
PID 4336 wrote to memory of 1292	4336	wininit.exe	133
PID 4336 wrote to memory of 3976	4336	wininit.exe	134
PID 4336 wrote to memory of 3976	4336	wininit.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\08ef924d6dc6b7159cf34fb9db4cacac.exe
"C:\Users\Admin\AppData\Local\Temp\08ef924d6dc6b7159cf34fb9db4cacac.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cQG8Pfyund.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4464
- - C:\Users\Public\Libraries\wininit.exe
    "C:\Users\Public\Libraries\wininit.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\556caab6-1016-45ef-a69f-cb3d89bb7c8d.vbs"
      4⤵
      PID:1292
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c37a94b-afc3-417e-9f61-6992cbcf3bce.vbs"
      4⤵
      PID:3976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Downloads\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Downloads\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default\Downloads\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\odt\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\odt\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\fr-FR\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Windows\fr-FR\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\TAPI\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Windows\TAPI\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Windows\SystemResources\Microsoft.Windows.SecHealthUI\pris\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Windows\SystemResources\Microsoft.Windows.SecHealthUI\pris\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\odt\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "08ef924d6dc6b7159cf34fb9db4cacac0" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\08ef924d6dc6b7159cf34fb9db4cacac.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "08ef924d6dc6b7159cf34fb9db4cacac0" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\08ef924d6dc6b7159cf34fb9db4cacac.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\PLA\Rules\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\PLA\Rules\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\odt\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\PLA\Rules\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Libraries\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Libraries\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\odt\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\odt\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "08ef924d6dc6b7159cf34fb9db4cacac" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\08ef924d6dc6b7159cf34fb9db4cacac.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\SystemResources\Microsoft.Windows.SecHealthUI\pris\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\TAPI\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Windows\fr-FR\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\odt\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\odt\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

08ef924d6dc6b7159cf34fb9db4cacac.exe

Path C:\Recovery\WindowsRE\08ef924d6dc6b7159cf34fb9db4cacac.exe
Size 1.1MB
SHA256 7c046d3de84d8cff37187be71e0b9cf30b46d23cdfb1da8a3d381af5e3468a84
MD5 7b6b09323dbce294b1c13104be6cd551
SHA1 cba6adda1f088979842fa7cae73a815075926fe3
SHA512 2f2761be6c70ced9e100d900ebd092a0fa68e272759dd521603b9e0af0b2a1cef3b2e3987ce28b5c38bfbf0300a3f66f3caa1d26930a1fd2b792e589e18c14b3
SSDEEP 24576:CT25fx6ZCxiXt5onpL1QkRdSAAS7HrU/:skfbi0pb3pr2
MD5 SHA1 SHA512 SSDEEP

Submit Download

0c37a94b-afc3-417e-9f61-6992cbcf3bce.vbs

Path C:\Users\Admin\AppData\Local\Temp\0c37a94b-afc3-417e-9f61-6992cbcf3bce.vbs
Size 489B
SHA256 f110bf73112929233176139afc94921b7e399a088bb59523bb2ae2c3eb265808
MD5 86348e029f5a56b9e8b600f4a2a44253
SHA1 2c664e7f02f292737cb8198ec73d9e77cf3dc431
SHA512 c7b493ca18df7c5437c6b8a830d88101948a5d832fc7b99a747705750d8df90ace4592b7033847e4111ab5833897823b2981e47e12a658400aaf92dfae37ebfb
MD5 SHA1 SHA512

Submit Download

556caab6-1016-45ef-a69f-cb3d89bb7c8d.vbs

Path C:\Users\Admin\AppData\Local\Temp\556caab6-1016-45ef-a69f-cb3d89bb7c8d.vbs
Size 713B
SHA256 c1ab9419d856682a71d55f0267f69a1f7a32de269be33744a67a9358aabe8115
MD5 78e6730f12b5f894f7baffae6428804a
SHA1 19188f6d463aeaad2da95e8f447c8788999f153c
SHA512 9598ae9be6ca6210d9f8a2451d95d63f844065474d82aff1a277c6c9b866cfad737d8bc865c1efe4e4bedd120e914de01abd70f9fca4d2e452563e58dc91bd7b
MD5 SHA1 SHA512

Submit Download

cQG8Pfyund.bat

Path C:\Users\Admin\AppData\Local\Temp\cQG8Pfyund.bat
Size 202B
SHA256 7efe101b6119930e381470582ae88670c6d1b48dc27e5c838afda28b4ca454b2
MD5 e1129e2a65a18e0d4f2da1afc1d12396
SHA1 51d7b2b655cc970fd6e64e46b8375fec1448ba3a
SHA512 7932958a51fee6792d8377bbc06046f493dbd7b439fcf2a3bc6c439edc524e350e6197d03c0c97f1144c20bb23c4c2555f62430419c41565ec516cf41cfe9515
MD5 SHA1 SHA512

Submit Download

RCX7CD6.tmp

Path C:\Users\Default\Downloads\RCX7CD6.tmp
Size 1.1MB
SHA256 a68d5d689ccc020d9638b482469f50d6e187615def2f75cdab1aef8f2bad379e
MD5 93827ff3805836fc40ac730860538748
SHA1 e7b0f7903651910174c5a903b19d3b1d12c6c4f7
SHA512 63108ead6a7f6510cb8f163d8c2e1499b6eda6c13e3cf0e31daea3374ecf7748cb40ee0fd4be4a5af2d7e1b25e7ddecada02068a3f577b4a3ee30a26d94f42a0
SSDEEP 24576:6T25fx6ZCxiXt5onpL1QkRdSAAS7HrU/:0kfbi0pb3pr2
MD5 SHA1 SHA512 SSDEEP

Submit Download

wininit.exe

Path C:\Users\Public\Libraries\wininit.exe
Size 450KB
SHA256 14e8d121363469edf2f334f3807f05a772e8a81ec1d59db26faefddf3443b84c
MD5 6379bd7ddfff2ad9b8ffdbdbd96c95ba
SHA1 0cf67dbdac8f4931416121bee7eb62372872ace8
SHA512 8b5f6b3a008f4ddde7aa1d72734a712d6ca3454eec0d808ba723045e8e76bd7dd5ecfdd6af6d1b8a75991c4c4c37edbb6e3369792d0b15ec7299061d5023f43b
SSDEEP 12288:6T2N78W8u1tF6RdHB8dxM0gbmCtlQ7bGj:6T25fx6ZCxiXt5j
MD5 SHA1 SHA512 SSDEEP

Submit Download

wininit.exe

Path C:\Users\Public\Libraries\wininit.exe
Size 982KB
SHA256 8bf28eccabc0dfb83b53e1cb9ad6b3985b6b1469f4df40f94f1a39a804719519
MD5 fe20d9082c5e6b6c2e63f8c9bb07f6ec
SHA1 9fbd77079015fb3628ada90c1d9067713338cc6d
SHA512 53fb7cf0dd1ea7239d3c9464935d684cdda720e64bea279de1c5e2d354ded2ee496073c0683a0958e1634f8952591cf5a1fd93d0aacc1fab24b57ad0ac43c76f
SSDEEP 12288:6T2N78W8u1tF6RdHB8dxM0gbmCtlQ7bG9/3VYVdc/YaNpPga1uhLFU9sQkQF0ddB:6T25fx6ZCxiXt5onpL1QkRdSAAS7H3
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Windows\TAPI\winlogon.exe
Size 1.1MB
SHA256 07ef2eee7e56c2338327d52269e755e7dc2bc82e2fb8781de0c1ea7857003d49
MD5 08ef924d6dc6b7159cf34fb9db4cacac
SHA1 ba2527b88a6b290c1c49649fa66aea144fffbe4d
SHA512 2e9952188a7215d71801785e119149d463238ee238d0327f13aa954ad3e3712583df1d0be2a6e4daa9271f522d6082ef3e45e30df919a387f7484ffe6779cf67
SSDEEP 24576:6T25fx6ZCxiXt5onpL1QkRdSAAS7HrU/:0kfbi0pb3pr2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2848-10-0x000000001C120000-0x000000001C12C000-memory.dmp

Download

memory/2848-14-0x000000001C1C0000-0x000000001C1C8000-memory.dmp

Download

memory/2848-18-0x000000001C200000-0x000000001C20C000-memory.dmp

Download

memory/2848-17-0x000000001C1F0000-0x000000001C1FE000-memory.dmp

Download

memory/2848-16-0x000000001C1E0000-0x000000001C1EA000-memory.dmp

Download

memory/2848-15-0x000000001C1D0000-0x000000001C1D8000-memory.dmp

Download

memory/2848-4-0x000000001C150000-0x000000001C1A0000-memory.dmp

Download

memory/2848-13-0x000000001C140000-0x000000001C14C000-memory.dmp

Download

memory/2848-0-0x0000000000E60000-0x0000000000F86000-memory.dmp

Download

memory/2848-6-0x00000000032F0000-0x0000000003300000-memory.dmp

Download

memory/2848-12-0x000000001C8F0000-0x000000001CE18000-memory.dmp

Download

memory/2848-5-0x00000000032E0000-0x00000000032E8000-memory.dmp

Download

memory/2848-7-0x000000001C100000-0x000000001C116000-memory.dmp

Download

memory/2848-11-0x000000001C130000-0x000000001C142000-memory.dmp

Download

memory/2848-208-0x00007FFCBEFE0000-0x00007FFCBFAA1000-memory.dmp

Download

memory/2848-9-0x000000001BBE0000-0x000000001BBE8000-memory.dmp

Download

memory/2848-8-0x0000000003300000-0x000000000330C000-memory.dmp

Download

memory/2848-3-0x0000000001950000-0x000000000196C000-memory.dmp

Download

memory/2848-1-0x00007FFCBEFE0000-0x00007FFCBFAA1000-memory.dmp

Download

memory/2848-2-0x00000000032D0000-0x00000000032E0000-memory.dmp

Download

memory/4336-214-0x000000001B1F0000-0x000000001B200000-memory.dmp

Download

memory/4336-213-0x00007FFCBEFE0000-0x00007FFCBFAA1000-memory.dmp

Download

memory/4336-224-0x00007FFCBEFE0000-0x00007FFCBFAA1000-memory.dmp

Download

memory/4336-225-0x000000001B1F0000-0x000000001B200000-memory.dmp

Download