dcrat | 8d31ae46e123de0d23937d664298428e37b45a7a135a95d73f5887779ee48710

Analysis

max time kernel
131s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0a32536cc1d5e2a35d7d289b4ff0e76b.exe
Size 1.5MB
Sample240517-cfjf9acd2v
SHA256 8d31ae46e123de0d23937d664298428e37b45a7a135a95d73f5887779ee48710
MD5 0a32536cc1d5e2a35d7d289b4ff0e76b
SHA1 98736b0b5a6f3709f81365c9e6477819074c3170
SHA512 b2d5d91eb7ecfc6eb295c63ecba5c3ceb4b4a865fc9a9f90bd1e82bff4bc39905baf9ab2962580ee708761632e5499694f3f823aa2f139bce809398262eb3b73
SSDEEP 24576:0Q1yLJg2WGBITqb6YtZuhH6bxzDtR8P56fpjPFWm:0Q1FdrqeoAR4NfjS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4792	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3220	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	804	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3932	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4028	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3780	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4280	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3332	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	3676	schtasks.exe	83

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0a32536cc1d5e2a35d7d289b4ff0e76b.exe

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4956-1-0x0000000000DF0000-0x0000000000F7C000-memory.dmp	dcrat
behavioral2/files/0x000700000002344d-24.dat	dcrat
behavioral2/files/0x0005000000022977-69.dat	dcrat
behavioral2/files/0x001f00000001629e-108.dat	dcrat
behavioral2/files/0x000b000000022977-148.dat	dcrat
behavioral2/files/0x000a00000002297b-195.dat	dcrat
behavioral2/files/0x000a0000000233a0-206.dat	dcrat
behavioral2/memory/740-217-0x0000000000510000-0x000000000069C000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	0a32536cc1d5e2a35d7d289b4ff0e76b.exe

Executes dropped EXE 1 IoCs

pid	Process
740	dllhost.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\lsass.exe	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File created	C:\Program Files\MSBuild\66fc9ff0ee96c2	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File created	C:\Program Files (x86)\Windows Portable Devices\9e8d7a4ca61bd9	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Program Files\MSBuild\RCX43EA.tmp	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Program Files (x86)\Adobe\RCX4814.tmp	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX57FE.tmp	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File created	C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\csrss.exe	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RCX5B0E.tmp	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File created	C:\Program Files (x86)\Adobe\886983d96e3d3e	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File created	C:\Program Files (x86)\Windows Sidebar\886983d96e3d3e	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RCX5A90.tmp	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File created	C:\Program Files (x86)\Adobe\csrss.exe	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File created	C:\Program Files (x86)\Windows Sidebar\csrss.exe	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Program Files (x86)\Adobe\csrss.exe	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File created	C:\Program Files\MSBuild\sihost.exe	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Program Files\MSBuild\RCX436C.tmp	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Program Files\MSBuild\sihost.exe	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX587C.tmp	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Program Files (x86)\Adobe\RCX4813.tmp	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\RCX4A29.tmp	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\RCX4A97.tmp	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\9e8d7a4ca61bd9	0a32536cc1d5e2a35d7d289b4ff0e76b.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\debug\RCX557C.tmp	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Windows\debug\RuntimeBroker.exe	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File created	C:\Windows\Resources\Ease of Access Themes\29c1c3cc0f7685	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File created	C:\Windows\ServiceState\EventLog\Data\SppExtComObj.exe	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File created	C:\Windows\debug\RuntimeBroker.exe	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Windows\Resources\Ease of Access Themes\RCX3D5C.tmp	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Windows\debug\RCX550E.tmp	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File created	C:\Windows\Resources\Ease of Access Themes\unsecapp.exe	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File created	C:\Windows\debug\9e8d7a4ca61bd9	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Windows\Resources\Ease of Access Themes\RCX3D5B.tmp	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
File opened for modification	C:\Windows\Resources\Ease of Access Themes\unsecapp.exe	0a32536cc1d5e2a35d7d289b4ff0e76b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
884	schtasks.exe
1972	schtasks.exe
2392	schtasks.exe
5048	schtasks.exe
4792	schtasks.exe
2124	schtasks.exe
804	schtasks.exe
4856	schtasks.exe
3332	schtasks.exe
2820	schtasks.exe
1224	schtasks.exe
4880	schtasks.exe
4108	schtasks.exe
1960	schtasks.exe
4712	schtasks.exe
3932	schtasks.exe
4280	schtasks.exe
1192	schtasks.exe
3040	schtasks.exe
2840	schtasks.exe
4264	schtasks.exe
2004	schtasks.exe
4028	schtasks.exe
4432	schtasks.exe
1100	schtasks.exe
4556	schtasks.exe
3780	schtasks.exe
4404	schtasks.exe
2948	schtasks.exe
1160	schtasks.exe
3912	schtasks.exe
2460	schtasks.exe
3956	schtasks.exe
2488	schtasks.exe
1580	schtasks.exe
1536	schtasks.exe
544	schtasks.exe
4632	schtasks.exe
5064	schtasks.exe
2628	schtasks.exe
1096	schtasks.exe
3220	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	0a32536cc1d5e2a35d7d289b4ff0e76b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4956	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
740	dllhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
Token: SeDebugPrivilege	740	dllhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 3956	4956	0a32536cc1d5e2a35d7d289b4ff0e76b.exe	135
PID 4956 wrote to memory of 3956	4956	0a32536cc1d5e2a35d7d289b4ff0e76b.exe	135
PID 3956 wrote to memory of 4404	3956	cmd.exe	137
PID 3956 wrote to memory of 4404	3956	cmd.exe	137
PID 3956 wrote to memory of 740	3956	cmd.exe	138
PID 3956 wrote to memory of 740	3956	cmd.exe	138

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0a32536cc1d5e2a35d7d289b4ff0e76b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0a32536cc1d5e2a35d7d289b4ff0e76b.exe
"C:\Users\Admin\AppData\Local\Temp\0a32536cc1d5e2a35d7d289b4ff0e76b.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M6GUBXEQen.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4404
- - C:\Recovery\WindowsRE\dllhost.exe
    "C:\Recovery\WindowsRE\dllhost.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Windows\Resources\Ease of Access Themes\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Windows\Resources\Ease of Access Themes\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Users\Default User\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\debug\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\debug\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\debug\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe
Size 1.5MB
SHA256 b0a4e82dcc150c8cbb301469be6463e2a208f3e97f7d35297fd1d8e9265befb1
MD5 910cb4ff7876a8580a9b7c0e0762ee9c
SHA1 bc56606c06a4c80197b2752bad904e6e15f6b859
SHA512 fbf641d0be411b43b23ff190eb90c47f8a31d22225e50f8bbc43cf008e2fc06f007a0e23fe494bb813da77eaa325c60de77e6528e50e0829e83460a0eab92d3d
SSDEEP 24576:kQ1yLJg2WGBITqb6YtZuhH6bxzDtR8P56fpjPFWm:kQ1FdrqeoAR4NfjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

RuntimeBroker.exe

Path C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe
Size 1.5MB
SHA256 7a6ac5ec73a3bf0d5397f2d19caf1ff592fc744af7eadb7183d8ffdc56edaf15
MD5 376b5a219fcac6b53271179d079044c6
SHA1 fde1c9aa5de3e5a18d800fe28a9136242f6b3c4c
SHA512 60a60daed5ffbe3fc10521ea5498e823ab8b4dc37a8a94c3e648cb6853ed99228eedb9f7c16e97e8ea610f397e27e41d491a4375decb48e2e4ef35cf9d6e6aef
SSDEEP 24576:sQ1yLJg2WGBITqb6YtZuhH6bxzDtR8P56fpjPFWm:sQ1FdrqeoAR4NfjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

sihost.exe

Path C:\Program Files\MSBuild\sihost.exe
Size 1.5MB
SHA256 8d31ae46e123de0d23937d664298428e37b45a7a135a95d73f5887779ee48710
MD5 0a32536cc1d5e2a35d7d289b4ff0e76b
SHA1 98736b0b5a6f3709f81365c9e6477819074c3170
SHA512 b2d5d91eb7ecfc6eb295c63ecba5c3ceb4b4a865fc9a9f90bd1e82bff4bc39905baf9ab2962580ee708761632e5499694f3f823aa2f139bce809398262eb3b73
SSDEEP 24576:0Q1yLJg2WGBITqb6YtZuhH6bxzDtR8P56fpjPFWm:0Q1FdrqeoAR4NfjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

sihost.exe

Path C:\Program Files\MSBuild\sihost.exe
Size 1.5MB
SHA256 c57642b93f990f95e17261483ccfa1e6937cbe892cd576525559abec16b4e8b8
MD5 32872e523e2a6923fec8f3d9b200b1a5
SHA1 4a957a396084cb171a60fb03fb70c1cb333c2bb0
SHA512 e96641846a40426ceecc5b6bc7fd128480e7ee5d5b0277ea8dcf1c8e2749c36b0a6def802fa10e739698dec753bf40d8799f78ecc0662f6d3116361a12c69218
SSDEEP 24576:MQ1yLJg2WGBITqb6YtZuhH6bxzDtR8P56fpjPFWm:MQ1FdrqeoAR4NfjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Recovery\WindowsRE\spoolsv.exe
Size 1.5MB
SHA256 63b058c1c13866958854e0b2cce7a1c2deca5507dbd2622e9380f77ab0181353
MD5 4b7f70c5cd68aaf16678237686d7fa0a
SHA1 6967821472fba2c0e1266ef866b9ffb3d5c6b71f
SHA512 80c58da97d29efc784eb099fcd65bff02f3cf77dc30e5cd63cdc5e8b4662c36b093db2d56aa66da0855aa0c5fe4d5f7d35578e3fc6f12bc98d30ac2373e5f76a
SSDEEP 24576:kQ1yLJg2WGBITqb6YtZuhH6bxzDtR8P56fpjPFWm:kQ1FdrqeoAR4NfjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

M6GUBXEQen.bat

Path C:\Users\Admin\AppData\Local\Temp\M6GUBXEQen.bat
Size 198B
SHA256 062bc30229fcc3982eeb1d8fdb8c1cc24277d47e7018ab0f156837ab324a70ee
MD5 d404fa8e2249fc7e0bc0a3dec7e17785
SHA1 e08c3ab91a21b420ebd16f99a0bad7e273fda38b
SHA512 4d83c758affcef32389a7870c2988260150363703515719937693aa21b7a11f9d9817e4fdb3022bb143b3ac214bcdf716e80f455ee53c6ac22020ce20832ba5d
MD5 SHA1 SHA512

Submit Download

RCX3D5C.tmp

Path C:\Windows\Resources\Ease of Access Themes\RCX3D5C.tmp
Size 1.5MB
SHA256 1d547dd97ae48345cae40c0a76258b3efa12dd8e9ea689f3d022e482584aa173
MD5 bf164fec3cd078761a70462be31050fb
SHA1 48ebbb45426cbe2056e5f0bca1bd03e06ddfa5a2
SHA512 fc4dbc0aa8d172b2b6c706e778acf5e49a5fc4c1c1fa763bd01a6d4332f1731ae5a87bfb500027067c3bb1b7508326c81b0462c08667b2b7a68bdc1ec38e748b
SSDEEP 24576:UQ1yLJg2WGBITqb6YtZuhH6bxzDtR8P56fpjPFWm:UQ1FdrqeoAR4NfjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/740-217-0x0000000000510000-0x000000000069C000-memory.dmp

Download

memory/4956-3-0x00000000030A0000-0x00000000030BC000-memory.dmp

Download

memory/4956-7-0x00000000030E0000-0x00000000030F0000-memory.dmp

Download

memory/4956-10-0x0000000003110000-0x000000000311C000-memory.dmp

Download

memory/4956-11-0x0000000003120000-0x0000000003128000-memory.dmp

Download

memory/4956-13-0x0000000003140000-0x000000000314C000-memory.dmp

Download

memory/4956-12-0x0000000003130000-0x0000000003138000-memory.dmp

Download

memory/4956-14-0x000000001BC30000-0x000000001BC3A000-memory.dmp

Download

memory/4956-15-0x000000001BC50000-0x000000001BC5C000-memory.dmp

Download

memory/4956-8-0x00000000030F0000-0x00000000030FA000-memory.dmp

Download

memory/4956-9-0x0000000003100000-0x0000000003108000-memory.dmp

Download

memory/4956-0-0x00007FFD7B753000-0x00007FFD7B755000-memory.dmp

Download

memory/4956-4-0x000000001C190000-0x000000001C1E0000-memory.dmp

Download

memory/4956-5-0x00000000017A0000-0x00000000017B0000-memory.dmp

Download

memory/4956-6-0x00000000030C0000-0x00000000030D6000-memory.dmp

Download

memory/4956-212-0x00007FFD7B750000-0x00007FFD7C211000-memory.dmp

Download

memory/4956-2-0x00007FFD7B750000-0x00007FFD7C211000-memory.dmp

Download

memory/4956-1-0x0000000000DF0000-0x0000000000F7C000-memory.dmp

Download