dcrat | b018f5a66001f1ccb3553465778d7a65d04d7a0925ac925b692bfbedcbc08295

Analysis

max time kernel
126s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2024 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b018f5a66001f1ccb3553465778d7a65d04d7a0925ac925b692bfbedcbc08295.exe
Size

1.8MB
MD5

2654cf7f87e8aa432528dc78fedb324f
SHA1

22c2770eea77b91b30e5bfc7199a321339ec92dc
SHA256

b018f5a66001f1ccb3553465778d7a65d04d7a0925ac925b692bfbedcbc08295
SHA512

6aecbe6aae20f2b2e484eaae9a4dfb64ca008c60e11c02de7c8c9559336804a721983b9522431c08979ae307d17e2d202e6e2d208c2ab1f9923bf161e94db890
SSDEEP

24576:u2G/nvxW3WieCfYiKFt+77kwwVomlSUXUkv1nKSW8W5xdf9w4/Zo2L9vU3gtTqUK:ubA3jfYilPmlB9NngLfSMouvKEiV

Score

10^/10

dcrat evasion infostealer rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3660	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	344	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	528	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3892	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	364	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3780	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	1484	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	1484	schtasks.exe	88

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Hyperbrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Hyperbrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Hyperbrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0006000000023210-10.dat	dcrat
behavioral2/files/0x0006000000023210-11.dat	dcrat
behavioral2/memory/5052-12-0x00000000009B0000-0x0000000000B3E000-memory.dmp	dcrat
behavioral2/files/0x0006000000023216-29.dat	dcrat
behavioral2/files/0x0006000000023239-131.dat	dcrat
behavioral2/files/0x0006000000023239-132.dat	dcrat

Detects executables packed with SmartAssembly 2 IoCs

resource	yara_rule
behavioral2/memory/5052-20-0x000000001BCA0000-0x000000001BCB0000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5052-22-0x000000001BCD0000-0x000000001BCDA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	b018f5a66001f1ccb3553465778d7a65d04d7a0925ac925b692bfbedcbc08295.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Hyperbrowser.exe

Executes dropped EXE 2 IoCs

pid	Process
5052	Hyperbrowser.exe
1724	spoolsv.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Hyperbrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Hyperbrowser.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\sppsvc.exe	Hyperbrowser.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\0a1fd5f707cd16	Hyperbrowser.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\sppsvc.exe	Hyperbrowser.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Cursors\24dbde2999530e	Hyperbrowser.exe
File created	C:\Windows\CbsTemp\dwm.exe	Hyperbrowser.exe
File created	C:\Windows\CbsTemp\6cb0b6c459d5d3	Hyperbrowser.exe
File opened for modification	C:\Windows\Cursors\WmiPrvSE.exe	Hyperbrowser.exe
File opened for modification	C:\Windows\CbsTemp\dwm.exe	Hyperbrowser.exe
File created	C:\Windows\Cursors\WmiPrvSE.exe	Hyperbrowser.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1668	schtasks.exe
4048	schtasks.exe
4408	schtasks.exe
3892	schtasks.exe
3132	schtasks.exe
364	schtasks.exe
3492	schtasks.exe
2172	schtasks.exe
5080	schtasks.exe
2004	schtasks.exe
528	schtasks.exe
2376	schtasks.exe
4092	schtasks.exe
2124	schtasks.exe
2676	schtasks.exe
3944	schtasks.exe
4004	schtasks.exe
2464	schtasks.exe
4776	schtasks.exe
2788	schtasks.exe
2828	schtasks.exe
556	schtasks.exe
4924	schtasks.exe
1332	schtasks.exe
216	schtasks.exe
2616	schtasks.exe
3780	schtasks.exe
2552	schtasks.exe
3840	schtasks.exe
3120	schtasks.exe
2480	schtasks.exe
1488	schtasks.exe
4752	schtasks.exe
452	schtasks.exe
2816	schtasks.exe
4592	schtasks.exe
5008	schtasks.exe
344	schtasks.exe
4744	schtasks.exe
2856	schtasks.exe
4380	schtasks.exe
3660	schtasks.exe
3736	schtasks.exe
1288	schtasks.exe
2528	schtasks.exe
3624	schtasks.exe
3584	schtasks.exe
3632	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000_Classes\Local Settings	b018f5a66001f1ccb3553465778d7a65d04d7a0925ac925b692bfbedcbc08295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Hyperbrowser.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5052	Hyperbrowser.exe
5052	Hyperbrowser.exe
5052	Hyperbrowser.exe
5052	Hyperbrowser.exe
5052	Hyperbrowser.exe
1724	spoolsv.exe
1724	spoolsv.exe
1724	spoolsv.exe
1724	spoolsv.exe
1724	spoolsv.exe
1724	spoolsv.exe
1724	spoolsv.exe
1724	spoolsv.exe
1724	spoolsv.exe
1724	spoolsv.exe
1724	spoolsv.exe
1724	spoolsv.exe
1724	spoolsv.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1724	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	Hyperbrowser.exe
Token: SeDebugPrivilege	1724	spoolsv.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 1396	3388	b018f5a66001f1ccb3553465778d7a65d04d7a0925ac925b692bfbedcbc08295.exe	84
PID 3388 wrote to memory of 1396	3388	b018f5a66001f1ccb3553465778d7a65d04d7a0925ac925b692bfbedcbc08295.exe	84
PID 3388 wrote to memory of 1396	3388	b018f5a66001f1ccb3553465778d7a65d04d7a0925ac925b692bfbedcbc08295.exe	84
PID 1396 wrote to memory of 960	1396	WScript.exe	85
PID 1396 wrote to memory of 960	1396	WScript.exe	85
PID 1396 wrote to memory of 960	1396	WScript.exe	85
PID 960 wrote to memory of 5052	960	cmd.exe	87
PID 960 wrote to memory of 5052	960	cmd.exe	87
PID 5052 wrote to memory of 1724	5052	Hyperbrowser.exe	139
PID 5052 wrote to memory of 1724	5052	Hyperbrowser.exe	139

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Hyperbrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Hyperbrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Hyperbrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b018f5a66001f1ccb3553465778d7a65d04d7a0925ac925b692bfbedcbc08295.exe
"C:\Users\Admin\AppData\Local\Temp\b018f5a66001f1ccb3553465778d7a65d04d7a0925ac925b692bfbedcbc08295.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\bridgeMs\IHDIGCFHaYb0yciijvrQ.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\bridgeMs\ADsVHR0er2fHwJeWUEwiEiTsFzbnax.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\bridgeMs\Hyperbrowser.exe
      "C:\bridgeMs\Hyperbrowser.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:5052
    - - C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\bridgeMs\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\bridgeMs\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\bridgeMs\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\bridgeMs\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\bridgeMs\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\bridgeMs\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\odt\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Local Settings\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default\Local Settings\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Local Settings\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Pictures\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Default\Pictures\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Pictures\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Windows\Cursors\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\Cursors\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Windows\Cursors\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\bridgeMs\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\bridgeMs\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\bridgeMs\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\odt\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\CbsTemp\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\CbsTemp\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Windows\CbsTemp\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\bridgeMs\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\bridgeMs\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\bridgeMs\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\bridgeMs\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\bridgeMs\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\bridgeMs\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\odt\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\bridgeMs\ADsVHR0er2fHwJeWUEwiEiTsFzbnax.bat

Filesize
30B

MD5
758f4fc5f5a2e79b34610ac4e3308fea

SHA1
7fc95ed1265c8d5ce999a509bb0fe08374ede651

SHA256
398efdc4c9fa37d28230039a479eb14d81227626fc620b7f2c765a2b70f77e5e

SHA512
3cdbb2fb8fc6e2f5bba6b687bef44896a15ad94b866a365172951aed0bb3de15065c030e06dd8acb9cc4730db7ab6b064b74a51aa104d28090fe3c3f2234e595

Download Submit
C:\bridgeMs\Hyperbrowser.exe

Filesize
1.5MB

MD5
e952625d7c8796ff83c9c4b5a4becf0c

SHA1
dd387d1e5bcd15a493e905a714fe2b83d3a55ea2

SHA256
a247f1a48a830f4d85144cbf8229b0bcd3867be7efd1a159cab77d91941dce55

SHA512
3555bdb512eab1a6cc6528be7ed9ee1f99d185837ed942b172675ee99b7fad10fb4316e5153e3db21132a23df9c607f6a2a41e43e336f23dfb89205d88435188

Download Submit
C:\bridgeMs\Hyperbrowser.exe

Filesize
711KB

MD5
5797261d4105b7bcc54f3f1cfb7d1920

SHA1
1703d6b690067e60f671452be5f72d53030d4fd7

SHA256
73ebac75a4be2da78d067df18864c5d111c5a0dcf8c9dc85cc720e4a44c5bb07

SHA512
f1e6e9b475be3edcff1aacfdacfaee3303a2a0e2ce68b548ddcfc9baff658c5eac3e3d679d9d0f05e8cfc8ac54426543f4d2b5204d1cd3199a1c0a0f4b5cac64

Download Submit
C:\bridgeMs\IHDIGCFHaYb0yciijvrQ.vbe

Filesize
215B

MD5
1f8ae1420ead8da4743bfc84f0b6e362

SHA1
889bbf5e24a92c7f999aece80209ec21edc4ef13

SHA256
26fd0ab73e02437a1bfe5ac8d151175a70dc0c0ece744610bca36aca8d680599

SHA512
229c18c42512b8f09932c828a434183605a5bcc8d436021b94f7427418ebf711f901be05433fd69c2afdc48842365ef688294a60ce6feaa5af48a4c24ad83ca5

Download Submit
C:\bridgeMs\Registry.exe

Filesize
1.5MB

MD5
cdef822478d1c077577a3688b840633b

SHA1
06be7518b45505d5c7745483019d6924921c8c46

SHA256
74c202254289c54784e8d08d6e42c90977fea9583c2bbc4f18d859336fb2b5d1

SHA512
45162cedbb07166cb2e6b2facb200c48dcc0a3655e2f656213cf4de818e371c8ff1d0d7f001a6291c80cbdeb703a4168d4954f9f1c31457d35a0237e4b5fa179

Download Submit
C:\odt\spoolsv.exe

Filesize
960KB

MD5
50faed9e5cf2bdaee878c377af7c29ca

SHA1
2b0845be25708009a4fbe3109aeafe00add019dd

SHA256
4f02c3685d9c11f45691c78f84d619f7639571a817a469c4182ca0a4cf51b55a

SHA512
a45288560e748db619f8a26f596c0ad150af674fc9aa790ca8d7cbfb3e5ef3c92157ad7b60ca054a60c1faaadbcbd152c5b166db09610c33dc95a6bce1006e6c

Download Submit
C:\odt\spoolsv.exe

Filesize
768KB

MD5
63795b1b28e3ef7dfe748e103a4e6f98

SHA1
0df608fc777e4c2ba956d10b430fe59105ab6cc0

SHA256
76183620c74c0f09599ff832a1f0706341bb74ea55bb4a1a93cb737c5627b437

SHA512
e218a78164c49060c27cae8a2fabe936d0bc7e9d4bab3d27d7da8c8f9933d63baf580a1802c448ffd438dd1e7dd5af1e3ba1abaae306cb86dd970b686a309533

Download Submit
memory/1724-177-0x000000001B000000-0x000000001B010000-memory.dmp

Filesize
64KB

Download
memory/1724-176-0x00007FFA8B380000-0x00007FFA8BE41000-memory.dmp

Filesize
10.8MB

Download
memory/1724-137-0x000000001AFC0000-0x000000001AFD2000-memory.dmp

Filesize
72KB

Download
memory/1724-136-0x000000001B000000-0x000000001B010000-memory.dmp

Filesize
64KB

Download
memory/1724-134-0x00007FFA8B380000-0x00007FFA8BE41000-memory.dmp

Filesize
10.8MB

Download
memory/5052-15-0x000000001B640000-0x000000001B64E000-memory.dmp

Filesize
56KB

Download
memory/5052-20-0x000000001BCA0000-0x000000001BCB0000-memory.dmp

Filesize
64KB

Download
memory/5052-22-0x000000001BCD0000-0x000000001BCDA000-memory.dmp

Filesize
40KB

Download
memory/5052-23-0x000000001BCE0000-0x000000001BCF2000-memory.dmp

Filesize
72KB

Download
memory/5052-24-0x000000001C420000-0x000000001C948000-memory.dmp

Filesize
5.2MB

Download
memory/5052-25-0x000000001BD60000-0x000000001BD68000-memory.dmp

Filesize
32KB

Download
memory/5052-26-0x000000001BD70000-0x000000001BD7C000-memory.dmp

Filesize
48KB

Download
memory/5052-21-0x000000001BCB0000-0x000000001BCC6000-memory.dmp

Filesize
88KB

Download
memory/5052-18-0x000000001BCF0000-0x000000001BD40000-memory.dmp

Filesize
320KB

Download
memory/5052-19-0x000000001B660000-0x000000001B668000-memory.dmp

Filesize
32KB

Download
memory/5052-135-0x00007FFA8B380000-0x00007FFA8BE41000-memory.dmp

Filesize
10.8MB

Download
memory/5052-17-0x000000001BC80000-0x000000001BC9C000-memory.dmp

Filesize
112KB

Download
memory/5052-16-0x000000001B650000-0x000000001B65E000-memory.dmp

Filesize
56KB

Download
memory/5052-14-0x000000001B5E0000-0x000000001B5F0000-memory.dmp

Filesize
64KB

Download
memory/5052-13-0x00007FFA8B380000-0x00007FFA8BE41000-memory.dmp

Filesize
10.8MB

Download
memory/5052-12-0x00000000009B0000-0x0000000000B3E000-memory.dmp

Filesize
1.6MB

Download