Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 01:13
Behavioral task
behavioral1
Sample
410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe
Resource
win10v2004-20240412-en
General
-
Target
410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe
-
Size
828KB
-
MD5
38cae3e5ad321877f760a30170e1dbd8
-
SHA1
7ca4a891c40ce36a4533aabe32b4a7c70180f6f8
-
SHA256
410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a
-
SHA512
4c2299d27f435f3457c5047b8021b930a4a4d2b8be3dea5d23508499f497d2042b53b67cb071def371f5d6335b372078c362de27533865a09183c3e1fdd9c745
-
SSDEEP
12288:wzXIzsFQQP9ztnsyyjDO0l4yOaPFXs718A4FuG0tlW+Sro3TVuQ3:wNFQQP3sXDOuHOCFXs71KASroo2
Malware Config
Signatures
-
DcRat 47 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2404 schtasks.exe 2060 schtasks.exe 2396 schtasks.exe 912 schtasks.exe 2700 schtasks.exe 2428 schtasks.exe 1628 schtasks.exe 268 schtasks.exe 1944 schtasks.exe 2588 schtasks.exe 1212 schtasks.exe 2224 schtasks.exe 1228 schtasks.exe 968 schtasks.exe 2476 schtasks.exe 2184 schtasks.exe 1168 schtasks.exe 2744 schtasks.exe 840 schtasks.exe 2024 schtasks.exe 688 schtasks.exe 2360 schtasks.exe 320 schtasks.exe 1824 schtasks.exe 2856 schtasks.exe 2480 schtasks.exe 1640 schtasks.exe 1424 schtasks.exe 2244 schtasks.exe 636 schtasks.exe 492 schtasks.exe 1868 schtasks.exe 2680 schtasks.exe File created C:\Windows\Installer\0a1fd5f707cd16 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 2692 schtasks.exe 1200 schtasks.exe 2112 schtasks.exe 2412 schtasks.exe 2032 schtasks.exe 1724 schtasks.exe 1728 schtasks.exe 2376 schtasks.exe 1512 schtasks.exe 1140 schtasks.exe 2536 schtasks.exe File created C:\Windows\Installer\sppsvc.exe 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 2252 schtasks.exe -
Modifies WinLogon for persistence 2 TTPs 15 IoCs
Processes:
410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Installer\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\dwm.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Installer\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\dwm.exe\", \"C:\\Program Files\\Windows Sidebar\\es-ES\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Idle.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Installer\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Installer\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\dwm.exe\", \"C:\\Program Files\\Windows Sidebar\\es-ES\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Idle.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\winlogon.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\dwm.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Installer\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\dwm.exe\", \"C:\\Program Files\\Windows Sidebar\\es-ES\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Idle.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\winlogon.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\dwm.exe\", \"C:\\Users\\Admin\\Pictures\\schtasks.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\schtasks.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\schtasks.exe\", \"C:\\Users\\Admin\\Start Menu\\dllhost.exe\", \"C:\\Program Files\\Windows Media Player\\WmiPrvSE.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Installer\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\dwm.exe\", \"C:\\Program Files\\Windows Sidebar\\es-ES\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Idle.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\winlogon.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\dwm.exe\", \"C:\\Users\\Admin\\Pictures\\schtasks.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\schtasks.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\schtasks.exe\", \"C:\\Users\\Admin\\Start Menu\\dllhost.exe\", \"C:\\Program Files\\Windows Media Player\\WmiPrvSE.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\explorer.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Installer\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\dwm.exe\", \"C:\\Program Files\\Windows Sidebar\\es-ES\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Idle.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\winlogon.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\dwm.exe\", \"C:\\Users\\Admin\\Pictures\\schtasks.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\schtasks.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\schtasks.exe\", \"C:\\Users\\Admin\\Start Menu\\dllhost.exe\", \"C:\\Program Files\\Windows Media Player\\WmiPrvSE.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\explorer.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\winlogon.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Installer\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\dwm.exe\", \"C:\\Program Files\\Windows Sidebar\\es-ES\\lsm.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Installer\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\dwm.exe\", \"C:\\Program Files\\Windows Sidebar\\es-ES\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Idle.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\winlogon.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\dwm.exe\", \"C:\\Users\\Admin\\Pictures\\schtasks.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Installer\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\dwm.exe\", \"C:\\Program Files\\Windows Sidebar\\es-ES\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Idle.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\winlogon.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\dwm.exe\", \"C:\\Users\\Admin\\Pictures\\schtasks.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\schtasks.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\schtasks.exe\", \"C:\\Users\\Admin\\Start Menu\\dllhost.exe\", \"C:\\Program Files\\Windows Media Player\\WmiPrvSE.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\explorer.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\winlogon.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\WmiPrvSE.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Installer\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\dwm.exe\", \"C:\\Program Files\\Windows Sidebar\\es-ES\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Idle.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\winlogon.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Installer\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\dwm.exe\", \"C:\\Program Files\\Windows Sidebar\\es-ES\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Idle.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\winlogon.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\dwm.exe\", \"C:\\Users\\Admin\\Pictures\\schtasks.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\schtasks.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Installer\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\dwm.exe\", \"C:\\Program Files\\Windows Sidebar\\es-ES\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Idle.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\winlogon.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\dwm.exe\", \"C:\\Users\\Admin\\Pictures\\schtasks.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\schtasks.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\schtasks.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Installer\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\dwm.exe\", \"C:\\Program Files\\Windows Sidebar\\es-ES\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Idle.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\winlogon.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\dwm.exe\", \"C:\\Users\\Admin\\Pictures\\schtasks.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\schtasks.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\schtasks.exe\", \"C:\\Users\\Admin\\Start Menu\\dllhost.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Installer\\sppsvc.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe -
Process spawned unexpected child process 45 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2252 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2360 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2588 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2680 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2536 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2700 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2692 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2428 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2476 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2856 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2480 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2032 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1212 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 320 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2184 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1724 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1824 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1728 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1200 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1640 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1628 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2404 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2376 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1512 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1424 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2244 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2744 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2060 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1168 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2224 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1228 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 268 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2112 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1944 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 636 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 492 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2396 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 840 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2024 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 688 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2412 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1868 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1140 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 968 2908 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 912 2908 schtasks.exe -
Processes:
resource yara_rule behavioral1/memory/3048-0-0x0000000000D00000-0x0000000000DD6000-memory.dmp dcrat behavioral1/memory/2776-8-0x000000001AFA0000-0x000000001B020000-memory.dmp dcrat C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Idle.exe dcrat -
Executes dropped EXE 1 IoCs
Processes:
Idle.exepid process 2608 Idle.exe -
Adds Run key to start application 2 TTPs 28 IoCs
Processes:
410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\csrss.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files\\Windows Sidebar\\es-ES\\lsm.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\WmiPrvSE.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Installer\\sppsvc.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\csrss.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\winlogon.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\dwm.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\schtasks = "\"C:\\Users\\Admin\\Pictures\\schtasks.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\schtasks = "\"C:\\Users\\Public\\Pictures\\Sample Pictures\\schtasks.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Admin\\Start Menu\\dllhost.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\explorer.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Admin\\Start Menu\\dwm.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Idle.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\schtasks = "\"C:\\Users\\Admin\\Pictures\\schtasks.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\schtasks = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\schtasks.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Windows Media Player\\WmiPrvSE.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Windows Media Player\\WmiPrvSE.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\winlogon.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\schtasks = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\schtasks.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Idle.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\dwm.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\explorer.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Installer\\sppsvc.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Admin\\Start Menu\\dwm.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files\\Windows Sidebar\\es-ES\\lsm.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\WmiPrvSE.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\schtasks = "\"C:\\Users\\Public\\Pictures\\Sample Pictures\\schtasks.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Admin\\Start Menu\\dllhost.exe\"" 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe -
Drops file in Program Files directory 6 IoCs
Processes:
410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exedescription ioc process File created C:\Program Files\Windows Media Player\24dbde2999530e 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WmiPrvSE.exe 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\24dbde2999530e 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe File created C:\Program Files\Windows Sidebar\es-ES\lsm.exe 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe File created C:\Program Files\Windows Sidebar\es-ES\101b941d020240 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe File created C:\Program Files\Windows Media Player\WmiPrvSE.exe 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe -
Drops file in Windows directory 3 IoCs
Processes:
410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exedescription ioc process File created C:\Windows\Installer\sppsvc.exe 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe File opened for modification C:\Windows\Installer\sppsvc.exe 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe File created C:\Windows\Installer\0a1fd5f707cd16 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 45 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2428 schtasks.exe 1212 schtasks.exe 1228 schtasks.exe 636 schtasks.exe 2700 schtasks.exe 2692 schtasks.exe 2856 schtasks.exe 2032 schtasks.exe 1424 schtasks.exe 268 schtasks.exe 2412 schtasks.exe 912 schtasks.exe 2252 schtasks.exe 1824 schtasks.exe 1512 schtasks.exe 2244 schtasks.exe 2360 schtasks.exe 2536 schtasks.exe 2480 schtasks.exe 2184 schtasks.exe 2224 schtasks.exe 1140 schtasks.exe 320 schtasks.exe 2376 schtasks.exe 2744 schtasks.exe 1168 schtasks.exe 2112 schtasks.exe 1724 schtasks.exe 1200 schtasks.exe 1628 schtasks.exe 1944 schtasks.exe 492 schtasks.exe 2396 schtasks.exe 688 schtasks.exe 1640 schtasks.exe 2060 schtasks.exe 840 schtasks.exe 1868 schtasks.exe 968 schtasks.exe 2588 schtasks.exe 2680 schtasks.exe 2476 schtasks.exe 1728 schtasks.exe 2404 schtasks.exe 2024 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exeIdle.exepid process 3048 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 3048 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 3048 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 2776 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 2776 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 2776 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 2776 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 2776 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 2776 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 2776 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 2776 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 2776 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 2776 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 2776 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 2776 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 2776 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 2608 Idle.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exeIdle.exedescription pid process Token: SeDebugPrivilege 3048 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Token: SeDebugPrivilege 2776 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe Token: SeDebugPrivilege 2608 Idle.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.execmd.exedescription pid process target process PID 3048 wrote to memory of 2776 3048 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe PID 3048 wrote to memory of 2776 3048 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe PID 3048 wrote to memory of 2776 3048 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe PID 2776 wrote to memory of 1104 2776 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe cmd.exe PID 2776 wrote to memory of 1104 2776 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe cmd.exe PID 2776 wrote to memory of 1104 2776 410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe cmd.exe PID 1104 wrote to memory of 2056 1104 cmd.exe w32tm.exe PID 1104 wrote to memory of 2056 1104 cmd.exe w32tm.exe PID 1104 wrote to memory of 2056 1104 cmd.exe w32tm.exe PID 1104 wrote to memory of 2608 1104 cmd.exe Idle.exe PID 1104 wrote to memory of 2608 1104 cmd.exe Idle.exe PID 1104 wrote to memory of 2608 1104 cmd.exe Idle.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe"C:\Users\Admin\AppData\Local\Temp\410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe"1⤵
- DcRat
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe"C:\Users\Admin\AppData\Local\Temp\410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a.exe"2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\317xeoslDz.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:24⤵
-
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Idle.exe"C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Idle.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Windows\Installer\sppsvc.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Installer\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\Installer\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Start Menu\dwm.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Start Menu\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\es-ES\lsm.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\es-ES\lsm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\es-ES\lsm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Idle.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\winlogon.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\dwm.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Pictures\schtasks.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\schtasks.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Pictures\schtasks.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\Sample Pictures\schtasks.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\schtasks.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\Sample Pictures\schtasks.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\schtasks.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\schtasks.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\schtasks.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Start Menu\dllhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Start Menu\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\WmiPrvSE.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Media Player\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\explorer.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\explorer.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\explorer.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\winlogon.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WmiPrvSE.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Idle.exeFilesize
828KB
MD538cae3e5ad321877f760a30170e1dbd8
SHA17ca4a891c40ce36a4533aabe32b4a7c70180f6f8
SHA256410c644c78cde640702f1cdbab97efc59420da7b6705f98c3af00e1af3912e3a
SHA5124c2299d27f435f3457c5047b8021b930a4a4d2b8be3dea5d23508499f497d2042b53b67cb071def371f5d6335b372078c362de27533865a09183c3e1fdd9c745
-
C:\Users\Admin\AppData\Local\Temp\317xeoslDz.batFilesize
236B
MD519f0699cf1e6b5d40f7760a72a6f9cff
SHA116f0bc1d375dfbdbc9abe9ac8c71c94731de82dc
SHA256500fa86a513a095baa1703569757f7aded96594308e7fc9ccd1036d81f92414e
SHA5127e64d99211785377e1c29ace66dcd85f5aa7a7b8a340e6dd63f4c42deb9f49088385ab8ac0f79adad7e1f493ad72c3c8ebf852168357c727f6fa69aabbca0d81
-
memory/2608-44-0x000007FEF54A0000-0x000007FEF5E8C000-memory.dmpFilesize
9.9MB
-
memory/2608-45-0x000000001AD00000-0x000000001AD80000-memory.dmpFilesize
512KB
-
memory/2608-46-0x000007FEF54A0000-0x000007FEF5E8C000-memory.dmpFilesize
9.9MB
-
memory/2776-8-0x000000001AFA0000-0x000000001B020000-memory.dmpFilesize
512KB
-
memory/2776-11-0x000007FEF5E90000-0x000007FEF687C000-memory.dmpFilesize
9.9MB
-
memory/2776-41-0x000007FEF5E90000-0x000007FEF687C000-memory.dmpFilesize
9.9MB
-
memory/3048-0-0x0000000000D00000-0x0000000000DD6000-memory.dmpFilesize
856KB
-
memory/3048-1-0x000007FEF5E90000-0x000007FEF687C000-memory.dmpFilesize
9.9MB
-
memory/3048-2-0x000000001B110000-0x000000001B190000-memory.dmpFilesize
512KB
-
memory/3048-7-0x000007FEF5E90000-0x000007FEF687C000-memory.dmpFilesize
9.9MB