dcrat | 2db6b0154ea9e9ebd4c13868562e7147e8a2fcaaa5dadd497410745a377b0e44

Analysis

max time kernel
141s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Size

2.0MB
MD5

4ddd13c4a3ffff1a0e3ef194e52f65a0
SHA1

f19f68c1ee2313667722f18944fc1d3885b2199c
SHA256

2db6b0154ea9e9ebd4c13868562e7147e8a2fcaaa5dadd497410745a377b0e44
SHA512

5e274b01576b54490dc1af367e6b016396238cd9fee2c3d4ff52419a72e4d7613a5d46340bc6337f955fe850bcd8c564d3d8ad5a21e7b2d95bdf00d4c6949bf3
SSDEEP

24576:Un2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:CaTUv0jmtEttc

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 47 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2928	schtasks.exe
		2400	schtasks.exe
		4676	schtasks.exe
		4216	schtasks.exe
		2416	schtasks.exe
		2196	schtasks.exe
		4700	schtasks.exe
		2288	schtasks.exe
		4260	schtasks.exe
		1368	schtasks.exe
		1192	schtasks.exe
		3956	schtasks.exe
		3008	schtasks.exe
		1396	schtasks.exe
		4368	schtasks.exe
		3728	schtasks.exe
		5064	schtasks.exe
		2120	schtasks.exe
		3364	schtasks.exe
		4600	schtasks.exe
		2936	schtasks.exe
		2004	schtasks.exe
		3408	schtasks.exe
		4084	schtasks.exe
		508	schtasks.exe
		3700	schtasks.exe
		4616	schtasks.exe
		4916	schtasks.exe
		3052	schtasks.exe
		372	schtasks.exe
		1748	schtasks.exe
		4920	schtasks.exe
		3512	schtasks.exe
		3140	schtasks.exe
		3244	schtasks.exe
		1308	schtasks.exe
		1364	schtasks.exe
		4476	schtasks.exe
File created	C:\Windows\DiagTrack\Scenarios\1eb5113a523fc8		4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
		3560	schtasks.exe
		4448	schtasks.exe
		4892	schtasks.exe
File created	C:\Windows\DiagTrack\Scenarios\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe		4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
		824	schtasks.exe
		1232	schtasks.exe
		4104	schtasks.exe
		4224	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 15 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4084	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	508	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3408	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4104	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4260	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3140	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4368	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4216	1908	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4224	1908	schtasks.exe	86

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3452-1-0x00000000000D0000-0x00000000002DC000-memory.dmp	dcrat
behavioral2/files/0x0007000000023450-23.dat	dcrat
behavioral2/files/0x000800000002347b-83.dat	dcrat
behavioral2/files/0x000e00000000a30b-106.dat	dcrat
behavioral2/files/0x0010000000023374-129.dat	dcrat
behavioral2/files/0x000c00000002337e-151.dat	dcrat
behavioral2/files/0x000b000000023380-162.dat	dcrat
behavioral2/files/0x000c00000002338a-183.dat	dcrat
behavioral2/files/0x000900000002338f-192.dat	dcrat
behavioral2/files/0x0008000000023391-217.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe

Executes dropped EXE 1 IoCs

pid	Process
3960	RuntimeBroker.exe

Adds Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MusNotification = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\MusNotification.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Default\\services.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\dllhost.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS = "\"C:\\Windows\\DiagTrack\\Scenarios\\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\Cursors\\fontdrvhost.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Default\\services.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Public\\Videos\\services.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\Cursors\\fontdrvhost.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\explorer.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\dllhost.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\Fonts\\lsass.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default User\\fontdrvhost.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Public\\Videos\\services.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\Windows Defender\\fr-FR\\backgroundTaskHost.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS = "\"C:\\Windows\\DiagTrack\\Scenarios\\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MusNotification = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\MusNotification.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\Windows Defender\\fr-FR\\backgroundTaskHost.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Portable Devices\\wininit.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Portable Devices\\wininit.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default User\\fontdrvhost.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\explorer.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\Fonts\\lsass.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe

Drops file in Program Files directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Reference Assemblies\RCX8797.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files\Reference Assemblies\RuntimeBroker.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Program Files\Reference Assemblies\RuntimeBroker.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\5940a34987c991	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\RCX8C3E.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\explorer.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Program Files\Reference Assemblies\9e8d7a4ca61bd9	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\dllhost.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\RCX98EB.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files\Windows Portable Devices\RCXA12E.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files\Windows Portable Devices\RCXA12F.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\RCXA343.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Program Files\Windows Defender\fr-FR\backgroundTaskHost.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCX9135.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\7a0fd90576e088	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Program Files\Windows Portable Devices\wininit.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\RCXA3D1.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Program Files (x86)\Windows Portable Devices\winlogon.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Program Files (x86)\Windows Portable Devices\cc11b995f2a76d	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\aa97147c4c782d	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Program Files\Windows Defender\fr-FR\eddb19405b7ce1	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Program Files\Windows Portable Devices\56085415360792	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\RCX9969.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\MusNotification.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\explorer.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files\Reference Assemblies\RCX8798.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\RCX8C3F.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX8505.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX8583.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCX9134.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\backgroundTaskHost.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files\Windows Portable Devices\wininit.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\dllhost.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\winlogon.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\MusNotification.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DiagTrack\Scenarios\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Windows\Cursors\RCX899D.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Windows\Cursors\fontdrvhost.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Windows\Cursors\RCX8A1B.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Windows\Cursors\fontdrvhost.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Windows\DiagTrack\Scenarios\RCX80DB.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Windows\Fonts\RCX82EF.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Windows\DiagTrack\Scenarios\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Windows\Fonts\6203df4a6bafc7	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Windows\Cursors\5b884080fd4f94	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Windows\DiagTrack\Scenarios\RCX80DA.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Windows\DiagTrack\Scenarios\1eb5113a523fc8	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File created	C:\Windows\Fonts\lsass.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Windows\Fonts\RCX82F0.tmp	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
File opened for modification	C:\Windows\Fonts\lsass.exe	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1232	schtasks.exe
4916	schtasks.exe
2936	schtasks.exe
3560	schtasks.exe
4600	schtasks.exe
4260	schtasks.exe
4476	schtasks.exe
3700	schtasks.exe
3956	schtasks.exe
4104	schtasks.exe
4368	schtasks.exe
2004	schtasks.exe
3052	schtasks.exe
2120	schtasks.exe
372	schtasks.exe
2196	schtasks.exe
824	schtasks.exe
1364	schtasks.exe
3244	schtasks.exe
3408	schtasks.exe
4700	schtasks.exe
3008	schtasks.exe
1396	schtasks.exe
508	schtasks.exe
5064	schtasks.exe
1368	schtasks.exe
1748	schtasks.exe
1308	schtasks.exe
2416	schtasks.exe
4084	schtasks.exe
4892	schtasks.exe
4224	schtasks.exe
3364	schtasks.exe
4616	schtasks.exe
1192	schtasks.exe
2400	schtasks.exe
3728	schtasks.exe
4920	schtasks.exe
2928	schtasks.exe
3512	schtasks.exe
3140	schtasks.exe
4676	schtasks.exe
4448	schtasks.exe
2288	schtasks.exe
4216	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3452	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
3452	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
3452	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
3452	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
3452	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
3452	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
3452	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
3452	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
3452	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
3452	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
3452	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
3452	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
3452	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
3960	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Token: SeDebugPrivilege	3960	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 3960	3452	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe	141
PID 3452 wrote to memory of 3960	3452	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Program Files\Reference Assemblies\RuntimeBroker.exe
  "C:\Program Files\Reference Assemblies\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS4" /sc MINUTE /mo 11 /tr "'C:\Windows\DiagTrack\Scenarios\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS" /sc ONLOGON /tr "'C:\Windows\DiagTrack\Scenarios\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS4" /sc MINUTE /mo 11 /tr "'C:\Windows\DiagTrack\Scenarios\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Windows\Fonts\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Fonts\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\Fonts\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Reference Assemblies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows\Cursors\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Cursors\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\Cursors\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\MusNotification.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\MusNotification.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\MusNotification.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Videos\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Public\Videos\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Videos\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\fr-FR\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\fr-FR\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\fr-FR\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Users\Default\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\Default\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Portable Devices\winlogon.exe

Filesize
2.0MB

MD5
70705c3e3b6a80cf2d4212a8af5e2fea

SHA1
90644b7fecc6adf6deb764f1030c292accedf0c9

SHA256
7cd252ecb4d5c97d362f898bddcb64fc32654d7bba880ca34959b7d7c769f279

SHA512
538513de8e950ba3bebfac1b7994a54a0f17a35eddc892631ddfca8619e3eb071bcd10561d10410af27214e183700704900ad32736984bcb1c879f6ca0c9ce0d

Download Submit
C:\Program Files\Windows NT\TableTextService\en-US\dllhost.exe

Filesize
2.0MB

MD5
e6664fbc37c842d7016532ea7883e9b2

SHA1
424c69ea979fb8e5406c5b4f1c16ea32171e2a25

SHA256
59ac25ab9ac0ce57df20885c5e77a08e7c7fd17936ae436dd14ec747a3947797

SHA512
a037e2f1094f5439f9ee543d455b94c69d61d21b9821b0767d04ac1b45fa83f61e1a956e32e0a4c84e29b5064ae2f2114a79294cb3a843f2b0b4b06a56010463

Download Submit
C:\Recovery\WindowsRE\Registry.exe

Filesize
2.0MB

MD5
4199867ede0f424afce113f9684b3069

SHA1
63ec7845a6402c26790b7611f77e271cebbf297c

SHA256
d3851ce4591125866d7253e607ee5a7ab345a3f492e09bbe0767aeec2588f960

SHA512
ae184f9b28a5bcc965f8cbbc324b37668cee6bb6b7c863f8e807bff9537ccbddd8859669a733dfe41110fb2b1e9601e0e3ebdc5cb8bddebcbc629a6fb7588032

Download Submit
C:\Recovery\WindowsRE\smss.exe

Filesize
2.0MB

MD5
7f50d670efa16ea8b5fe899effae53ea

SHA1
a36e455b5d0a2a076e85c270e12ff17dbc87b4c9

SHA256
4d9df6fedb4a674e1319b47f5d49dc2e326a1461f958516537f2aa2a6ea1ba21

SHA512
9d9757652aa7ef8ae1a9995734bf82056cf6c8aa47ffa34c9d5d37aa23d0a812e9e7b305956344f9c11b8c4c454147c8dfcbf2ee69652e3405671ffbacee10ca

Download Submit
C:\Users\Default\fontdrvhost.exe

Filesize
2.0MB

MD5
27e97f7602e7476b9cd48d6fec67d242

SHA1
935ba17389db6e9dbaf71dab277771fa413c7a0b

SHA256
d65e99ef65730b33b3e33129e1ed2737566e6b5f811091ca94a19c0c9076abf8

SHA512
7bc3ed5396d5e32ec3cd0f4e47fd92e302138ffad2dffe89da68d90af3db5ad96f479891deb57ab8f982238cca4695dd6cfbd66641cab37acee5b536f456db85

Download Submit
C:\Users\Default\services.exe

Filesize
2.0MB

MD5
c31304e07a879eddf06c6bb0f7a75503

SHA1
b442b4dedda5d0bf9961c528b6ace2c4d8ad6f11

SHA256
4c783b079de7a02dc1f981dacc7c62d8718a3a6ebc632af55433fcf5b085f1a4

SHA512
46e4174e1e1da379b7383f7059e432ad2b595c17aa6b4545948fb5fef286a818d6280f2c85946d29ece1553ffa3dd8f297a0e2148491fcf4d8e067655811521f

Download Submit
C:\Users\Public\Videos\services.exe

Filesize
2.0MB

MD5
a7929914b43cd393280f4cfa2f7a7b3a

SHA1
8317dddb5a44df21ff154dd521cb418b90ae3a5c

SHA256
f5e0e44ff80b664bda1326cdcbf61ee2058f66b6911188605269646e212f60cc

SHA512
a1eff67d0d660282663a3a0c6be6f5d5a433aebeee3006162a8180ae44c46c9f7d6125902baae085b2963dd47614f9d280fdc0b22d238494a7c247b0b9003452

Download Submit
C:\Windows\Cursors\fontdrvhost.exe

Filesize
2.0MB

MD5
4ddd13c4a3ffff1a0e3ef194e52f65a0

SHA1
f19f68c1ee2313667722f18944fc1d3885b2199c

SHA256
2db6b0154ea9e9ebd4c13868562e7147e8a2fcaaa5dadd497410745a377b0e44

SHA512
5e274b01576b54490dc1af367e6b016396238cd9fee2c3d4ff52419a72e4d7613a5d46340bc6337f955fe850bcd8c564d3d8ad5a21e7b2d95bdf00d4c6949bf3

Download Submit
C:\Windows\Cursors\fontdrvhost.exe

Filesize
2.0MB

MD5
ff8202e5d9ac63ba292de79e0f4b7200

SHA1
fb790b1c7dced53552e986dafedb9ef34ce4bb1a

SHA256
3f673f4aceeee991d22f94b03b69a9c794448c1935c9fca739936f6cd944300e

SHA512
882f921ed58301aa66bc7d88954b97044ce8847e246c5a2a6d2f8dff30eddb36cac16cc3e95c18435116f4b68ca4181918f034e84296313c85178fa8f3d39205

Download Submit
memory/3452-5-0x0000000000AA0000-0x0000000000AA8000-memory.dmp

Filesize
32KB

Download
memory/3452-7-0x000000001B430000-0x000000001B446000-memory.dmp

Filesize
88KB

Download
memory/3452-11-0x000000001B470000-0x000000001B47C000-memory.dmp

Filesize
48KB

Download
memory/3452-13-0x000000001B530000-0x000000001B53E000-memory.dmp

Filesize
56KB

Download
memory/3452-12-0x000000001B520000-0x000000001B52E000-memory.dmp

Filesize
56KB

Download
memory/3452-14-0x000000001B540000-0x000000001B54A000-memory.dmp

Filesize
40KB

Download
memory/3452-9-0x000000001B450000-0x000000001B45C000-memory.dmp

Filesize
48KB

Download
memory/3452-10-0x000000001B460000-0x000000001B46C000-memory.dmp

Filesize
48KB

Download
memory/3452-8-0x000000001B4D0000-0x000000001B526000-memory.dmp

Filesize
344KB

Download
memory/3452-0-0x00007FFAE00E3000-0x00007FFAE00E5000-memory.dmp

Filesize
8KB

Download
memory/3452-6-0x0000000002460000-0x0000000002470000-memory.dmp

Filesize
64KB

Download
memory/3452-4-0x000000001B480000-0x000000001B4D0000-memory.dmp

Filesize
320KB

Download
memory/3452-3-0x000000001B410000-0x000000001B42C000-memory.dmp

Filesize
112KB

Download
memory/3452-2-0x00007FFAE00E0000-0x00007FFAE0BA1000-memory.dmp

Filesize
10.8MB

Download
memory/3452-1-0x00000000000D0000-0x00000000002DC000-memory.dmp

Filesize
2.0MB

Download
memory/3452-280-0x00007FFAE00E0000-0x00007FFAE0BA1000-memory.dmp

Filesize
10.8MB

Download

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DiagTrack\\Scenarios\\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DiagTrack\\Scenarios\\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\", \"C:\\Windows\\Cursors\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\MusNotification.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DiagTrack\\Scenarios\\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\", \"C:\\Windows\\Cursors\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\MusNotification.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DiagTrack\\Scenarios\\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\", \"C:\\Windows\\Cursors\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\MusNotification.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Users\\Public\\Videos\\services.exe\", \"C:\\Program Files\\Windows Defender\\fr-FR\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Users\\Default\\services.exe\", \"C:\\Program Files\\Windows Portable Devices\\wininit.exe\", \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\dllhost.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DiagTrack\\Scenarios\\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DiagTrack\\Scenarios\\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe\", \"C:\\Windows\\Fonts\\lsass.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DiagTrack\\Scenarios\\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\", \"C:\\Windows\\Cursors\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\MusNotification.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Users\\Public\\Videos\\services.exe\", \"C:\\Program Files\\Windows Defender\\fr-FR\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DiagTrack\\Scenarios\\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\", \"C:\\Windows\\Cursors\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\MusNotification.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Users\\Public\\Videos\\services.exe\", \"C:\\Program Files\\Windows Defender\\fr-FR\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Users\\Default\\services.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DiagTrack\\Scenarios\\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DiagTrack\\Scenarios\\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\", \"C:\\Windows\\Cursors\\fontdrvhost.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DiagTrack\\Scenarios\\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\", \"C:\\Windows\\Cursors\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\MusNotification.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DiagTrack\\Scenarios\\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\", \"C:\\Windows\\Cursors\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\MusNotification.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Users\\Public\\Videos\\services.exe\", \"C:\\Program Files\\Windows Defender\\fr-FR\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Users\\Default\\services.exe\", \"C:\\Program Files\\Windows Portable Devices\\wininit.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DiagTrack\\Scenarios\\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\", \"C:\\Windows\\Cursors\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\MusNotification.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\explorer.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DiagTrack\\Scenarios\\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\", \"C:\\Windows\\Cursors\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\MusNotification.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Users\\Public\\Videos\\services.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DiagTrack\\Scenarios\\4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\", \"C:\\Windows\\Cursors\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\MusNotification.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Users\\Public\\Videos\\services.exe\", \"C:\\Program Files\\Windows Defender\\fr-FR\\backgroundTaskHost.exe\""	4ddd13c4a3ffff1a0e3ef194e52f65a0_NEAS.exe