dcrat | 60f7d9f75d3f8cb8716ed9f1f9b77456c11d91e4f9f25c0f4eceaaf703dd12ac

Analysis

max time kernel
11s
max time network
8s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
Size 3.2MB
Sample240513-qlhc2aha47
SHA256 60f7d9f75d3f8cb8716ed9f1f9b77456c11d91e4f9f25c0f4eceaaf703dd12ac
MD5 b9df02adac0846621482835cb8367aa0
SHA1 3fdce171a8de3b8018c5779b27bd95cc837faffd
SHA512 eb7d8c5529e97210a2b47858c391ae1052335a67599da48b46391f89cd6a73248ecab8fbe92b83f97950af10cf4165ad4d66b66bfd5b746f266c1e0fb2cc5457
SSDEEP 49152:HC0Fl8v/911bwaEYpdYUVsk3DZGAy55kBsfJGAW6KyWUcPmWQpE:HC0Fl8v/qXYrv5tG9uKJGAWl5N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1212	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3600	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4176	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	724	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	648	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3176	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	1040	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	1040	schtasks.exe	88

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2680-1-0x0000000000370000-0x00000000006AC000-memory.dmp	dcrat
behavioral2/files/0x00070000000234aa-44.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4472	powershell.exe
4992	powershell.exe
604	powershell.exe
3724	powershell.exe
212	powershell.exe
2328	powershell.exe
3296	powershell.exe
4564	powershell.exe
2700	powershell.exe
1672	powershell.exe
4736	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCX6F9B.tmp	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RCX7F0A.tmp	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RCX7F0B.tmp	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RuntimeBroker.exe	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\121e5b5079f7c0	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCX6F7B.tmp	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\9e8d7a4ca61bd9	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RuntimeBroker.exe	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System\RuntimeBroker.exe	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File created	C:\Windows\Globalization\Sorting\sysmon.exe	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System\RCX7648.tmp	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\Globalization\Sorting\RCX7CF5.tmp	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\Globalization\Sorting\RCX7CF6.tmp	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\Globalization\Sorting\sysmon.exe	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File created	C:\Windows\System\9e8d7a4ca61bd9	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File created	C:\Windows\Globalization\Sorting\121e5b5079f7c0	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System\RCX7638.tmp	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System\RuntimeBroker.exe	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
376	schtasks.exe
2104	schtasks.exe
4992	schtasks.exe
2184	schtasks.exe
4852	schtasks.exe
1148	schtasks.exe
3952	schtasks.exe
4188	schtasks.exe
2732	schtasks.exe
1880	schtasks.exe
1468	schtasks.exe
1384	schtasks.exe
3680	schtasks.exe
4472	schtasks.exe
3724	schtasks.exe
2632	schtasks.exe
4996	schtasks.exe
212	schtasks.exe
548	schtasks.exe
4604	schtasks.exe
3176	schtasks.exe
1212	schtasks.exe
4488	schtasks.exe
724	schtasks.exe
372	schtasks.exe
2232	schtasks.exe
2700	schtasks.exe
3048	schtasks.exe
3600	schtasks.exe
4176	schtasks.exe
2548	schtasks.exe
648	schtasks.exe
2984	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
3724	powershell.exe
3724	powershell.exe
4992	powershell.exe
4992	powershell.exe
2700	powershell.exe
2700	powershell.exe
1672	powershell.exe
1672	powershell.exe
4736	powershell.exe
4736	powershell.exe
4472	powershell.exe
4472	powershell.exe
604	powershell.exe
604	powershell.exe
4564	powershell.exe
4564	powershell.exe
212	powershell.exe
212	powershell.exe
3296	powershell.exe
3296	powershell.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
4992	powershell.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
2328	powershell.exe
2328	powershell.exe
2328	powershell.exe
4472	powershell.exe
3724	powershell.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3724	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	4472	powershell.exe
Token: SeDebugPrivilege	604	powershell.exe
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	212	powershell.exe
Token: SeDebugPrivilege	2328	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 4472	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	128
PID 2680 wrote to memory of 4472	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	128
PID 2680 wrote to memory of 2328	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	129
PID 2680 wrote to memory of 2328	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	129
PID 2680 wrote to memory of 4992	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	130
PID 2680 wrote to memory of 4992	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	130
PID 2680 wrote to memory of 4736	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	131
PID 2680 wrote to memory of 4736	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	131
PID 2680 wrote to memory of 212	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	132
PID 2680 wrote to memory of 212	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	132
PID 2680 wrote to memory of 1672	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	133
PID 2680 wrote to memory of 1672	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	133
PID 2680 wrote to memory of 2700	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	134
PID 2680 wrote to memory of 2700	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	134
PID 2680 wrote to memory of 3724	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	136
PID 2680 wrote to memory of 3724	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	136
PID 2680 wrote to memory of 604	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	137
PID 2680 wrote to memory of 604	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	137
PID 2680 wrote to memory of 4564	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	139
PID 2680 wrote to memory of 4564	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	139
PID 2680 wrote to memory of 3296	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	140
PID 2680 wrote to memory of 3296	2680	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe	140

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b9df02adac0846621482835cb8367aa0_NeikiAnalytics.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\SoftwareDistribution\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\SoftwareDistribution\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\System\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\System\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Windows\Globalization\Sorting\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Globalization\Sorting\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Windows\Globalization\Sorting\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Registry.exe

Path C:\Recovery\WindowsRE\Registry.exe
Size 3.2MB
SHA256 60f7d9f75d3f8cb8716ed9f1f9b77456c11d91e4f9f25c0f4eceaaf703dd12ac
MD5 b9df02adac0846621482835cb8367aa0
SHA1 3fdce171a8de3b8018c5779b27bd95cc837faffd
SHA512 eb7d8c5529e97210a2b47858c391ae1052335a67599da48b46391f89cd6a73248ecab8fbe92b83f97950af10cf4165ad4d66b66bfd5b746f266c1e0fb2cc5457
SSDEEP 49152:HC0Fl8v/911bwaEYpdYUVsk3DZGAy55kBsfJGAW6KyWUcPmWQpE:HC0Fl8v/qXYrv5tG9uKJGAWl5N
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_s10ldx54.ix5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s10ldx54.ix5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/2680-18-0x000000001BA50000-0x000000001BA58000-memory.dmp

Download

memory/2680-20-0x000000001BFC0000-0x000000001C4E8000-memory.dmp

Download

memory/2680-4-0x0000000002840000-0x000000000284E000-memory.dmp

Download

memory/2680-5-0x000000001B230000-0x000000001B238000-memory.dmp

Download

memory/2680-6-0x000000001B910000-0x000000001B92C000-memory.dmp

Download

memory/2680-22-0x000000001BAA0000-0x000000001BAAC000-memory.dmp

Download

memory/2680-8-0x000000001B240000-0x000000001B248000-memory.dmp

Download

memory/2680-9-0x000000001B260000-0x000000001B270000-memory.dmp

Download

memory/2680-10-0x000000001B930000-0x000000001B946000-memory.dmp

Download

memory/2680-11-0x000000001B950000-0x000000001B958000-memory.dmp

Download

memory/2680-12-0x000000001B960000-0x000000001B970000-memory.dmp

Download

memory/2680-13-0x000000001B970000-0x000000001B97A000-memory.dmp

Download

memory/2680-14-0x000000001B9D0000-0x000000001BA26000-memory.dmp

Download

memory/2680-15-0x000000001BA20000-0x000000001BA2C000-memory.dmp

Download

memory/2680-16-0x000000001BA30000-0x000000001BA38000-memory.dmp

Download

memory/2680-17-0x000000001BA40000-0x000000001BA4C000-memory.dmp

Download

memory/2680-0-0x00007FFAC82C3000-0x00007FFAC82C5000-memory.dmp

Download

memory/2680-19-0x000000001BA60000-0x000000001BA72000-memory.dmp

Download

memory/2680-3-0x0000000002830000-0x000000000283E000-memory.dmp

Download

memory/2680-21-0x000000001BA90000-0x000000001BA9C000-memory.dmp

Download

memory/2680-7-0x000000001B980000-0x000000001B9D0000-memory.dmp

Download

memory/2680-23-0x000000001BAB0000-0x000000001BABC000-memory.dmp

Download

memory/2680-24-0x000000001BAC0000-0x000000001BACC000-memory.dmp

Download

memory/2680-25-0x000000001BBD0000-0x000000001BBD8000-memory.dmp

Download

memory/2680-26-0x000000001BBE0000-0x000000001BBEA000-memory.dmp

Download

memory/2680-29-0x000000001BD10000-0x000000001BD1E000-memory.dmp

Download

memory/2680-28-0x000000001BD00000-0x000000001BD08000-memory.dmp

Download

memory/2680-27-0x000000001BBF0000-0x000000001BBFE000-memory.dmp

Download

memory/2680-31-0x000000001BD30000-0x000000001BD38000-memory.dmp

Download

memory/2680-30-0x000000001BD20000-0x000000001BD2C000-memory.dmp

Download

memory/2680-34-0x00007FFAC82C0000-0x00007FFAC8D81000-memory.dmp

Download

memory/2680-33-0x000000001BD80000-0x000000001BD8C000-memory.dmp

Download

memory/2680-32-0x000000001BE80000-0x000000001BE8A000-memory.dmp

Download

memory/2680-37-0x00007FFAC82C0000-0x00007FFAC8D81000-memory.dmp

Download

memory/2680-2-0x00007FFAC82C0000-0x00007FFAC8D81000-memory.dmp

Download

memory/2680-1-0x0000000000370000-0x00000000006AC000-memory.dmp

Download

memory/3724-259-0x00000156EDFC0000-0x00000156EDFE2000-memory.dmp

Download