dcrat | 6010d342cb5d71301a5f43312c4d11e844f85cb3e8b84152a85fbdfbe0594d12

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
Size 3.0MB
Sample240517-a29jfshe21
SHA256 6010d342cb5d71301a5f43312c4d11e844f85cb3e8b84152a85fbdfbe0594d12
MD5 6c1f5d8c88959accc79396696fca4f40
SHA1 0d3d0aa5a6d57f6d6b4878fd8bb8a74abcfbf7f6
SHA512 24f1f222587a9d30d268970f9d8838228ebb7d983443b8c2f1d1ac75181310ab8fa70358f1963391b2c3e368bc9eb74abca8b53d36e1bc3ad43a7efda1b38c82
SSDEEP 49152:AZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:07ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	100	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1264	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3176	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3332	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4280	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4276	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	716	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4204	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	808	4620	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3844	4620	schtasks.exe	91

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3764-13-0x0000000000400000-0x0000000000648000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3076	powershell.exe
3676	powershell.exe
764	powershell.exe
2604	powershell.exe
3616	powershell.exe
1748	powershell.exe
4276	powershell.exe
2968	powershell.exe
1756	powershell.exe
2280	powershell.exe
4404	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe

Executes dropped EXE 6 IoCs

pid	Process
4392	fontdrvhost.exe
1756	fontdrvhost.exe
932	fontdrvhost.exe
2224	fontdrvhost.exe
1796	fontdrvhost.exe
2876	fontdrvhost.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
45	ip-api.com
63	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3596 set thread context of 3764	3596	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	97
PID 4392 set thread context of 932	4392	fontdrvhost.exe	181
PID 1796 set thread context of 2876	1796	fontdrvhost.exe	191

Drops file in Program Files directory 45 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\5b884080fd4f94	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\fontdrvhost.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\fontdrvhost.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCX1AE.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXAEC.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\sihost.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\66fc9ff0ee96c2	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXFCF7.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\RCXFEFB.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\RCX8D7.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Uninstall Information\backgroundTaskHost.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\Services\38384e6a620884	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\RCXF639.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\RCXFA65.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\sihost.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCX1AD.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\spoolsv.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\dotnet\swidtag\RuntimeBroker.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\smss.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\smss.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Mail\9e8d7a4ca61bd9	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files\Uninstall Information\eddb19405b7ce1	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\swidtag\RuntimeBroker.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXFC79.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\dotnet\swidtag\RCX1661.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXB6A.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\5b884080fd4f94	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\f3b6ecef712a24	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\Services\SearchApp.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files\Uninstall Information\backgroundTaskHost.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\swidtag\9e8d7a4ca61bd9	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXF84E.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXF84F.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\69ddcba757bf72	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\RCXFF79.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\SearchApp.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\spoolsv.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\RCXFA64.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\RCX8D8.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\dotnet\swidtag\RCX15E3.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\RCXF63A.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\CSC\backgroundTaskHost.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Windows\InputMethod\CHS\fontdrvhost.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Windows\InputMethod\CHS\5b884080fd4f94	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Windows\InputMethod\CHS\RCX13CE.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Windows\InputMethod\CHS\RCX13CF.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Windows\InputMethod\CHS\fontdrvhost.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1064	schtasks.exe
2960	schtasks.exe
4972	schtasks.exe
812	schtasks.exe
3844	schtasks.exe
3008	schtasks.exe
4380	schtasks.exe
1968	schtasks.exe
116	schtasks.exe
2920	schtasks.exe
2036	schtasks.exe
1680	schtasks.exe
448	schtasks.exe
2256	schtasks.exe
4616	schtasks.exe
3580	schtasks.exe
2988	schtasks.exe
4876	schtasks.exe
2592	schtasks.exe
5064	schtasks.exe
100	schtasks.exe
4952	schtasks.exe
4404	schtasks.exe
4204	schtasks.exe
396	schtasks.exe
2280	schtasks.exe
808	schtasks.exe
3176	schtasks.exe
2008	schtasks.exe
4280	schtasks.exe
3616	schtasks.exe
4696	schtasks.exe
4784	schtasks.exe
3244	schtasks.exe
208	schtasks.exe
1084	schtasks.exe
2000	schtasks.exe
4788	schtasks.exe
4192	schtasks.exe
436	schtasks.exe
4480	schtasks.exe
2420	schtasks.exe
5104	schtasks.exe
1652	schtasks.exe
1264	schtasks.exe
228	schtasks.exe
2968	schtasks.exe
3332	schtasks.exe
4732	schtasks.exe
4276	schtasks.exe
716	schtasks.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	fontdrvhost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
1756	powershell.exe
1756	powershell.exe
764	powershell.exe
764	powershell.exe
3616	powershell.exe
3616	powershell.exe
1748	powershell.exe
1748	powershell.exe
2280	powershell.exe
2280	powershell.exe
4404	powershell.exe
4404	powershell.exe
2968	powershell.exe
2968	powershell.exe
4276	powershell.exe
4276	powershell.exe
2604	powershell.exe
2604	powershell.exe
3676	powershell.exe
3676	powershell.exe
3076	powershell.exe
3076	powershell.exe
1756	powershell.exe
1748	powershell.exe
2280	powershell.exe
4276	powershell.exe
3676	powershell.exe
3616	powershell.exe
764	powershell.exe
4404	powershell.exe
2604	powershell.exe
2968	powershell.exe
3076	powershell.exe
4392	fontdrvhost.exe
4392	fontdrvhost.exe
4392	fontdrvhost.exe
4392	fontdrvhost.exe
932	fontdrvhost.exe
932	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	764	powershell.exe
Token: SeDebugPrivilege	3616	powershell.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	3076	powershell.exe
Token: SeDebugPrivilege	4392	fontdrvhost.exe
Token: SeDebugPrivilege	932	fontdrvhost.exe
Token: SeDebugPrivilege	2876	fontdrvhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 3764	3596	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	97
PID 3596 wrote to memory of 3764	3596	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	97
PID 3596 wrote to memory of 3764	3596	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	97
PID 3596 wrote to memory of 3764	3596	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	97
PID 3596 wrote to memory of 3764	3596	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	97
PID 3596 wrote to memory of 3764	3596	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	97
PID 3596 wrote to memory of 3764	3596	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	97
PID 3596 wrote to memory of 3764	3596	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	97
PID 3764 wrote to memory of 3616	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	149
PID 3764 wrote to memory of 3616	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	149
PID 3764 wrote to memory of 3616	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	149
PID 3764 wrote to memory of 2604	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	150
PID 3764 wrote to memory of 2604	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	150
PID 3764 wrote to memory of 2604	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	150
PID 3764 wrote to memory of 4404	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	151
PID 3764 wrote to memory of 4404	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	151
PID 3764 wrote to memory of 4404	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	151
PID 3764 wrote to memory of 764	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	152
PID 3764 wrote to memory of 764	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	152
PID 3764 wrote to memory of 764	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	152
PID 3764 wrote to memory of 3676	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	153
PID 3764 wrote to memory of 3676	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	153
PID 3764 wrote to memory of 3676	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	153
PID 3764 wrote to memory of 3076	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	155
PID 3764 wrote to memory of 3076	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	155
PID 3764 wrote to memory of 3076	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	155
PID 3764 wrote to memory of 2968	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	156
PID 3764 wrote to memory of 2968	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	156
PID 3764 wrote to memory of 2968	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	156
PID 3764 wrote to memory of 4276	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	158
PID 3764 wrote to memory of 4276	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	158
PID 3764 wrote to memory of 4276	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	158
PID 3764 wrote to memory of 1748	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	159
PID 3764 wrote to memory of 1748	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	159
PID 3764 wrote to memory of 1748	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	159
PID 3764 wrote to memory of 2280	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	160
PID 3764 wrote to memory of 2280	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	160
PID 3764 wrote to memory of 2280	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	160
PID 3764 wrote to memory of 1756	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	161
PID 3764 wrote to memory of 1756	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	161
PID 3764 wrote to memory of 1756	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	161
PID 3764 wrote to memory of 4372	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	171
PID 3764 wrote to memory of 4372	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	171
PID 3764 wrote to memory of 4372	3764	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	171
PID 4372 wrote to memory of 380	4372	cmd.exe	173
PID 4372 wrote to memory of 380	4372	cmd.exe	173
PID 4372 wrote to memory of 380	4372	cmd.exe	173
PID 380 wrote to memory of 1220	380	w32tm.exe	174
PID 380 wrote to memory of 1220	380	w32tm.exe	174
PID 4372 wrote to memory of 4392	4372	cmd.exe	175
PID 4372 wrote to memory of 4392	4372	cmd.exe	175
PID 4372 wrote to memory of 4392	4372	cmd.exe	175
PID 4392 wrote to memory of 1756	4392	fontdrvhost.exe	179
PID 4392 wrote to memory of 1756	4392	fontdrvhost.exe	179
PID 4392 wrote to memory of 1756	4392	fontdrvhost.exe	179
PID 4392 wrote to memory of 2224	4392	fontdrvhost.exe	180
PID 4392 wrote to memory of 2224	4392	fontdrvhost.exe	180
PID 4392 wrote to memory of 2224	4392	fontdrvhost.exe	180
PID 4392 wrote to memory of 932	4392	fontdrvhost.exe	181
PID 4392 wrote to memory of 932	4392	fontdrvhost.exe	181
PID 4392 wrote to memory of 932	4392	fontdrvhost.exe	181
PID 4392 wrote to memory of 932	4392	fontdrvhost.exe	181
PID 4392 wrote to memory of 932	4392	fontdrvhost.exe	181
PID 4392 wrote to memory of 932	4392	fontdrvhost.exe	181

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Users\Admin\AppData\Local\Temp\6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3616
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2604
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4404
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:764
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3676
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3076
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2968
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1748
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2280
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s3H8thGZrQ.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4372
  - - C:\Windows\SysWOW64\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      Suspicious use of WriteProcessMemory
      PID:380
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:1220
  - - C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
      "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4392
    - - C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
        5⤵
        Executes dropped EXE
        
        PID:1756
    - - C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
        5⤵
        Executes dropped EXE
        
        PID:2224
    - - C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:932
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b1e75884-859d-44d3-b3af-ab1390ecf71d.vbs"
        6⤵
        
        PID:4688
        
        C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1796
        
        C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db8214bf-418f-4c8f-a3b1-e7efbaa546d2.vbs"
        9⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b5e021c-4c54-4edc-bd16-175a2b7a23d2.vbs"
        9⤵
        
        PID:972
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3bc423a5-a5ff-44f4-889e-a198bd6cbe69.vbs"
        6⤵
        
        PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Common Files\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Application Data\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Application Data\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\Services\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\Services\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\SoftwareDistribution\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\SoftwareDistribution\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Saved Games\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Saved Games\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Windows\InputMethod\CHS\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\InputMethod\CHS\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\InputMethod\CHS\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\dotnet\swidtag\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\dotnet\swidtag\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Admin\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe
Size 3.0MB
SHA256 418771c20d45920e4a1bc4612bea50f9ecf598c81d7ce27baae00b3ddd4b1b68
MD5 fb8813293e2f709567a246d8ce71452d
SHA1 a208d924e2c24fb6bf45a61053f76e96d6343be2
SHA512 382228590c2c1dc3d691279e2915427ce5e45e8b4bedeccd85a3c6c6a46c1a6ed46e71927d8aaaa8963886afbdb55aa55288839d5b715d4d660c6acfe70bad9c
SSDEEP 49152:AZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:07ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

sihost.exe

Path C:\Program Files\Common Files\sihost.exe
Size 3.0MB
SHA256 6010d342cb5d71301a5f43312c4d11e844f85cb3e8b84152a85fbdfbe0594d12
MD5 6c1f5d8c88959accc79396696fca4f40
SHA1 0d3d0aa5a6d57f6d6b4878fd8bb8a74abcfbf7f6
SHA512 24f1f222587a9d30d268970f9d8838228ebb7d983443b8c2f1d1ac75181310ab8fa70358f1963391b2c3e368bc9eb74abca8b53d36e1bc3ad43a7efda1b38c82
SSDEEP 49152:AZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:07ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

sihost.exe

Path C:\Program Files\Common Files\sihost.exe
Size 3.0MB
SHA256 f7a3328bfeb8898d9f6642121b58bea0007234dcbf4741b823ee1dc6ab022479
MD5 0aeeaf5bf8fc53bec22545175bb70c94
SHA1 24e61a69042eb980f9b5dd8071f5946e8681254b
SHA512 59aa493597cb8b4e86b5c59eeb4779140c9ae611871803f5e2de915e65db5a37a19a97c607f62633f3bed557ba4ee51d24280157f664261827d6df79961dac3b
SSDEEP 49152:wZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:k7ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

backgroundTaskHost.exe

Path C:\Program Files\Uninstall Information\backgroundTaskHost.exe
Size 3.0MB
SHA256 bb26e42b63f4392e3d0cf8152dd0409d5d409343bc706c1e08f78ff34e5528ff
MD5 ea61ed0c78c8ba55a22eff5db71fb470
SHA1 59f2bae06a2392f1c7a460b73343048c2d1d0549
SHA512 00575a765b9768d8e339973d05e22b7e1a90bc16fb985edfccbe16dfcd1cbecbe8344a722b716329a2cd318cfe506d4b2c5de20acc5ebd38c68b85b959f3d829
SSDEEP 49152:AZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:07ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

RuntimeBroker.exe

Path C:\Program Files\dotnet\swidtag\RuntimeBroker.exe
Size 3.0MB
SHA256 12cbc60961facdfb5feeb4db0ef2b770273ca8302b0918a505e36296e71b1c28
MD5 9251d74bcbda2ae1f87fb2aa9b46c28c
SHA1 ca3b089cbf065e5b63c0132c90d3bd307ac6a7fb
SHA512 70c17569229af8fc8107dc1be323f630b7848887fc9cad42cdfaa0d38efd7dfee75b9e90614a12536c781572858d4ce8b088373a73d10354440d5fef6b119004
SSDEEP 49152:wZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:k7ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe.log
Size 1KB
SHA256 1ad8f00e485dbebe5a1f40f60b9e588e6563c4feef20b8134f335b3e16208dc3
MD5 95b0eabd8c9c516fc2d8632ff8f4dc10
SHA1 8118b2b54184a5add848198f36a905b9a511940e
SHA512 60147da0bc922f18e2eeae00dc7dda1caa432df6ed0f853cd4757535bf371536902c1ce1bc40db167540bbc79dedf9a742498fab5bafcbd1053c4b2dd9c79e62
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
MD5 SHA1 SHA512

Submit Download