Analysis
- max time kernel
273s - max time network
299s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
18/05/2024, 09:38
Behavioral task
behavioral1
Sample
skeet.cc.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
21 signatures
300 seconds
Behavioral task
behavioral2
Sample
skeet.cc.exe
Resource
win10-20240404-en
windows10-1703-x64
20 signatures
300 seconds
Behavioral task
behavioral3
Sample
skeet.cc.exe
Resource
win7-20240508-en
windows7-x64
21 signatures
300 seconds
Behavioral task
behavioral4
Sample
skeet.cc.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
21 signatures
300 seconds
Behavioral task
behavioral5
Sample
skeet.cc.exe
Resource
win11-20240426-en
windows11-21h2-x64
20 signatures
300 seconds
General
- Target skeet.cc.exe
- Size 1.6MB
- Sample240518-ll9easdf42
- SHA256 dc2a17964084118aad74ee22789ca6a771d00f1028451eea8947eb63365d2b9e
- MD5 ad0e2712fec29876b2c5794ef99b2254
- SHA1 9e86419ddacfa04e20f4554dd34756844f3de25d
- SHA512 2c1ddb88215cd81099ca6931d2535f1cad80f5e2fbf285892ce8efd4e9cc49b447ced100b2fd5208bde2713f6b4fcefe5b740e63c0f20268a110ee8796f90154
- SSDEEP 24576:L2G/nvxW3WQgkdlESdayd3rFfezUTnrtDENS2i8SIq7bARyGrx0f7MHqeTMap:LbA3Nxd2SdtihITtKto7ij
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- DcRat 40 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process 4176 schtasks.exe 4080 schtasks.exe 3824 schtasks.exe 1436 schtasks.exe 1428 schtasks.exe 4792 schtasks.exe 4692 schtasks.exe 3896 schtasks.exe 64 schtasks.exe 4340 schtasks.exe 4448 schtasks.exe 4272 schtasks.exe 432 schtasks.exe 1960 schtasks.exe 4160 schtasks.exe 4204 schtasks.exe 2284 schtasks.exe 4968 schtasks.exe 3576 schtasks.exe 3044 schtasks.exe 4804 schtasks.exe 4652 schtasks.exe 1888 schtasks.exe 3988 schtasks.exe 3376 schtasks.exe 1424 schtasks.exe 1360 schtasks.exe 4356 schtasks.exe 1988 schtasks.exe 1476 schtasks.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings skeet.cc.exe 2776 schtasks.exe 4336 schtasks.exe 2896 schtasks.exe 648 schtasks.exe 2300 schtasks.exe 4584 schtasks.exe 4328 schtasks.exe 1968 schtasks.exe 1204 schtasks.exe - Modifies WinLogon for persistence 2 TTPs 13 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\System.exe\", \"C:\\Windows\\PolicyDefinitions\\fontdrvhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Word\\ApplicationFrameHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\ShellExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Users\\All Users\\sysmon.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\fontdrvhost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\System.exe\", \"C:\\Windows\\PolicyDefinitions\\fontdrvhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Word\\ApplicationFrameHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\ShellExperienceHost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\System.exe\", \"C:\\Windows\\PolicyDefinitions\\fontdrvhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Word\\ApplicationFrameHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\ShellExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Users\\All Users\\sysmon.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\System.exe\", \"C:\\Windows\\PolicyDefinitions\\fontdrvhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Word\\ApplicationFrameHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\ShellExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Users\\All Users\\sysmon.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\fontdrvhost.exe\", \"C:\\Users\\Default\\sysmon.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\System.exe\", \"C:\\Windows\\PolicyDefinitions\\fontdrvhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Word\\ApplicationFrameHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\ShellExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Users\\All Users\\sysmon.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\fontdrvhost.exe\", \"C:\\Users\\Default\\sysmon.exe\", \"C:\\Windows\\Fonts\\System.exe\", \"C:\\Program Files\\Google\\Chrome\\taskhostw.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\System.exe\", \"C:\\Windows\\PolicyDefinitions\\fontdrvhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Word\\ApplicationFrameHost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\System.exe\", \"C:\\Windows\\PolicyDefinitions\\fontdrvhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Word\\ApplicationFrameHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\ShellExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\System.exe\", \"C:\\Windows\\PolicyDefinitions\\fontdrvhost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\System.exe\", \"C:\\Windows\\PolicyDefinitions\\fontdrvhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Word\\ApplicationFrameHost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\ShellExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Users\\All Users\\sysmon.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\fontdrvhost.exe\", \"C:\\Users\\Default\\sysmon.exe\", \"C:\\Windows\\Fonts\\System.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sihost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\System.exe\"" browserwinsvc.exe - Process spawned unexpected child process 39 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2776 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2284 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4328 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4968 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4792 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4692 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4336 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3044 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1960 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3896 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1968 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4176 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1204 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1360 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4356 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4652 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1476 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1988 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2896 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3376 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4160 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3576 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4204 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4080 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3824 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1436 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1428 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 648 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4272 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 64 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2300 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1424 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1888 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3988 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4340 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4804 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4584 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4448 4768 schtasks.exe 79 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 432 4768 schtasks.exe 79 -
resource yara_rule behavioral2/files/0x000800000001ac11-12.dat dcrat behavioral2/memory/4564-14-0x00000000001D0000-0x0000000000320000-memory.dmp dcrat - Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1584 powershell.exe 3940 powershell.exe 4488 powershell.exe 4440 powershell.exe 4452 powershell.exe 904 powershell.exe 4384 powershell.exe 964 powershell.exe 816 powershell.exe 2080 powershell.exe 4120 powershell.exe 1868 powershell.exe 4132 powershell.exe 2288 powershell.exe - Executes dropped EXE 4 IoCs
pid Process 4564 browserwinsvc.exe 4980 taskhostw.exe 4120 System.exe 1996 ShellExperienceHost.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 26 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Users\\All Users\\sysmon.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ApplicationFrameHost = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Word\\ApplicationFrameHost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Surrogateprovidercomponentsessionmonitor\\fontdrvhost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\Program Files (x86)\\Windows Portable Devices\\ShellExperienceHost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Users\\All Users\\sysmon.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Surrogateprovidercomponentsessionmonitor\\fontdrvhost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\Fonts\\System.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\Fonts\\System.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Recovery\\WindowsRE\\conhost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicationFrameHost = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Word\\ApplicationFrameHost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Default User\\sihost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Recovery\\WindowsRE\\conhost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\PolicyDefinitions\\fontdrvhost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\PolicyDefinitions\\fontdrvhost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Surrogateprovidercomponentsessionmonitor\\spoolsv.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Surrogateprovidercomponentsessionmonitor\\System.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Users\\Default\\sysmon.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Google\\Chrome\\taskhostw.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Surrogateprovidercomponentsessionmonitor\\System.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Google\\Chrome\\taskhostw.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Default User\\sihost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\Program Files (x86)\\Windows Portable Devices\\ShellExperienceHost.exe\"" browserwinsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Users\\Default\\sysmon.exe\"" browserwinsvc.exe - Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com 9 ipinfo.io 10 ipinfo.io - Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Portable Devices\f8c8f1285d826b browserwinsvc.exe File created C:\Program Files\Google\Chrome\taskhostw.exe browserwinsvc.exe File created C:\Program Files\Google\Chrome\ea9f0e6c9e2dcd browserwinsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\ShellExperienceHost.exe browserwinsvc.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\PolicyDefinitions\fontdrvhost.exe browserwinsvc.exe File created C:\Windows\PolicyDefinitions\5b884080fd4f94 browserwinsvc.exe File created C:\Windows\Fonts\System.exe browserwinsvc.exe File created C:\Windows\Fonts\27d1bcfc3c54e0 browserwinsvc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 39 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1968 schtasks.exe 1204 schtasks.exe 3576 schtasks.exe 1436 schtasks.exe 432 schtasks.exe 4328 schtasks.exe 64 schtasks.exe 4584 schtasks.exe 4968 schtasks.exe 3044 schtasks.exe 3376 schtasks.exe 1428 schtasks.exe 3988 schtasks.exe 4448 schtasks.exe 4336 schtasks.exe 4356 schtasks.exe 4080 schtasks.exe 4340 schtasks.exe 2284 schtasks.exe 1888 schtasks.exe 1960 schtasks.exe 2896 schtasks.exe 4160 schtasks.exe 4692 schtasks.exe 3896 schtasks.exe 1988 schtasks.exe 3824 schtasks.exe 4272 schtasks.exe 4792 schtasks.exe 4176 schtasks.exe 1360 schtasks.exe 4652 schtasks.exe 1476 schtasks.exe 4204 schtasks.exe 648 schtasks.exe 2300 schtasks.exe 2776 schtasks.exe 4804 schtasks.exe 1424 schtasks.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings skeet.cc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4564 browserwinsvc.exe 4564 browserwinsvc.exe 4564 browserwinsvc.exe 4564 browserwinsvc.exe 4452 powershell.exe 4452 powershell.exe 4452 powershell.exe 2288 powershell.exe 2288 powershell.exe 3940 powershell.exe 3940 powershell.exe 964 powershell.exe 964 powershell.exe 4452 powershell.exe 4440 powershell.exe 4440 powershell.exe 904 powershell.exe 904 powershell.exe 4120 powershell.exe 4120 powershell.exe 1584 powershell.exe 1584 powershell.exe 4488 powershell.exe 4488 powershell.exe 904 powershell.exe 4132 powershell.exe 4132 powershell.exe 3940 powershell.exe 4132 powershell.exe 1868 powershell.exe 1868 powershell.exe 4384 powershell.exe 4384 powershell.exe 4120 powershell.exe 1584 powershell.exe 1868 powershell.exe 2288 powershell.exe 2080 powershell.exe 2080 powershell.exe 3940 powershell.exe 4132 powershell.exe 4440 powershell.exe 904 powershell.exe 2080 powershell.exe 4980 taskhostw.exe 4980 taskhostw.exe 4120 powershell.exe 816 powershell.exe 816 powershell.exe 1584 powershell.exe 964 powershell.exe 2288 powershell.exe 4488 powershell.exe 1868 powershell.exe 4384 powershell.exe 2080 powershell.exe 4440 powershell.exe 964 powershell.exe 4980 taskhostw.exe 816 powershell.exe 4488 powershell.exe 4384 powershell.exe 816 powershell.exe 4980 taskhostw.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4980 taskhostw.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4564 browserwinsvc.exe Token: SeDebugPrivilege 4452 powershell.exe Token: SeDebugPrivilege 2288 powershell.exe Token: SeDebugPrivilege 904 powershell.exe Token: SeDebugPrivilege 3940 powershell.exe Token: SeDebugPrivilege 964 powershell.exe Token: SeDebugPrivilege 4440 powershell.exe Token: SeDebugPrivilege 4120 powershell.exe Token: SeDebugPrivilege 4132 powershell.exe Token: SeDebugPrivilege 1584 powershell.exe Token: SeDebugPrivilege 4488 powershell.exe Token: SeDebugPrivilege 1868 powershell.exe Token: SeDebugPrivilege 4384 powershell.exe Token: SeDebugPrivilege 4980 taskhostw.exe Token: SeDebugPrivilege 2080 powershell.exe Token: SeDebugPrivilege 816 powershell.exe Token: SeIncreaseQuotaPrivilege 4452 powershell.exe Token: SeSecurityPrivilege 4452 powershell.exe Token: SeTakeOwnershipPrivilege 4452 powershell.exe Token: SeLoadDriverPrivilege 4452 powershell.exe Token: SeSystemProfilePrivilege 4452 powershell.exe Token: SeSystemtimePrivilege 4452 powershell.exe Token: SeProfSingleProcessPrivilege 4452 powershell.exe Token: SeIncBasePriorityPrivilege 4452 powershell.exe Token: SeCreatePagefilePrivilege 4452 powershell.exe Token: SeBackupPrivilege 4452 powershell.exe Token: SeRestorePrivilege 4452 powershell.exe Token: SeShutdownPrivilege 4452 powershell.exe Token: SeDebugPrivilege 4452 powershell.exe Token: SeSystemEnvironmentPrivilege 4452 powershell.exe Token: SeRemoteShutdownPrivilege 4452 powershell.exe Token: SeUndockPrivilege 4452 powershell.exe Token: SeManageVolumePrivilege 4452 powershell.exe Token: 33 4452 powershell.exe Token: 34 4452 powershell.exe Token: 35 4452 powershell.exe Token: 36 4452 powershell.exe Token: SeIncreaseQuotaPrivilege 3940 powershell.exe Token: SeSecurityPrivilege 3940 powershell.exe Token: SeTakeOwnershipPrivilege 3940 powershell.exe Token: SeLoadDriverPrivilege 3940 powershell.exe Token: SeSystemProfilePrivilege 3940 powershell.exe Token: SeSystemtimePrivilege 3940 powershell.exe Token: SeProfSingleProcessPrivilege 3940 powershell.exe Token: SeIncBasePriorityPrivilege 3940 powershell.exe Token: SeCreatePagefilePrivilege 3940 powershell.exe Token: SeBackupPrivilege 3940 powershell.exe Token: SeRestorePrivilege 3940 powershell.exe Token: SeShutdownPrivilege 3940 powershell.exe Token: SeDebugPrivilege 3940 powershell.exe Token: SeSystemEnvironmentPrivilege 3940 powershell.exe Token: SeRemoteShutdownPrivilege 3940 powershell.exe Token: SeUndockPrivilege 3940 powershell.exe Token: SeManageVolumePrivilege 3940 powershell.exe Token: 33 3940 powershell.exe Token: 34 3940 powershell.exe Token: 35 3940 powershell.exe Token: 36 3940 powershell.exe Token: SeIncreaseQuotaPrivilege 4132 powershell.exe Token: SeSecurityPrivilege 4132 powershell.exe Token: SeTakeOwnershipPrivilege 4132 powershell.exe Token: SeLoadDriverPrivilege 4132 powershell.exe Token: SeSystemProfilePrivilege 4132 powershell.exe Token: SeSystemtimePrivilege 4132 powershell.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 4944 wrote to memory of 4212 4944 skeet.cc.exe 75 PID 4944 wrote to memory of 4212 4944 skeet.cc.exe 75 PID 4944 wrote to memory of 4212 4944 skeet.cc.exe 75 PID 4212 wrote to memory of 3408 4212 WScript.exe 76 PID 4212 wrote to memory of 3408 4212 WScript.exe 76 PID 4212 wrote to memory of 3408 4212 WScript.exe 76 PID 3408 wrote to memory of 4564 3408 cmd.exe 78 PID 3408 wrote to memory of 4564 3408 cmd.exe 78 PID 4564 wrote to memory of 3940 4564 browserwinsvc.exe 119 PID 4564 wrote to memory of 3940 4564 browserwinsvc.exe 119 PID 4564 wrote to memory of 2288 4564 browserwinsvc.exe 120 PID 4564 wrote to memory of 2288 4564 browserwinsvc.exe 120 PID 4564 wrote to memory of 1584 4564 browserwinsvc.exe 121 PID 4564 wrote to memory of 1584 4564 browserwinsvc.exe 121 PID 4564 wrote to memory of 4452 4564 browserwinsvc.exe 122 PID 4564 wrote to memory of 4452 4564 browserwinsvc.exe 122 PID 4564 wrote to memory of 4120 4564 browserwinsvc.exe 123 PID 4564 wrote to memory of 4120 4564 browserwinsvc.exe 123 PID 4564 wrote to memory of 904 4564 browserwinsvc.exe 124 PID 4564 wrote to memory of 904 4564 browserwinsvc.exe 124 PID 4564 wrote to memory of 1868 4564 browserwinsvc.exe 125 PID 4564 wrote to memory of 1868 4564 browserwinsvc.exe 125 PID 4564 wrote to memory of 4384 4564 browserwinsvc.exe 126 PID 4564 wrote to memory of 4384 4564 browserwinsvc.exe 126 PID 4564 wrote to memory of 964 4564 browserwinsvc.exe 127 PID 4564 wrote to memory of 964 4564 browserwinsvc.exe 127 PID 4564 wrote to memory of 816 4564 browserwinsvc.exe 128 PID 4564 wrote to memory of 816 4564 browserwinsvc.exe 128 PID 4564 wrote to memory of 2080 4564 browserwinsvc.exe 129 PID 4564 wrote to memory of 2080 4564 browserwinsvc.exe 129 PID 4564 wrote to memory of 4132 4564 browserwinsvc.exe 130 PID 4564 wrote to memory of 4132 4564 browserwinsvc.exe 130 PID 4564 wrote to memory of 4488 4564 browserwinsvc.exe 131 PID 4564 wrote to memory of 4488 4564 browserwinsvc.exe 131 PID 4564 wrote to memory of 4440 4564 browserwinsvc.exe 132 PID 4564 wrote to memory of 4440 4564 browserwinsvc.exe 132 PID 4564 wrote to memory of 4980 4564 browserwinsvc.exe 147 PID 4564 wrote to memory of 4980 4564 browserwinsvc.exe 147 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\skeet.cc.exe"C:\Users\Admin\AppData\Local\Temp\skeet.cc.exe"1⤵
- DcRat
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Surrogateprovidercomponentsessionmonitor\GdYaNq.vbe"2⤵
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Surrogateprovidercomponentsessionmonitor\RS64buulixvrgn.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Surrogateprovidercomponentsessionmonitor\browserwinsvc.exe"C:\Surrogateprovidercomponentsessionmonitor\browserwinsvc.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Surrogateprovidercomponentsessionmonitor\browserwinsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\sihost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1584
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Surrogateprovidercomponentsessionmonitor\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Surrogateprovidercomponentsessionmonitor\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PolicyDefinitions\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:904
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Word\ApplicationFrameHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\ShellExperienceHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4384
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:964
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:816
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Surrogateprovidercomponentsessionmonitor\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4132
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Fonts\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4488
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4440
-
-
C:\Program Files\Google\Chrome\taskhostw.exe"C:\Program Files\Google\Chrome\taskhostw.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4980
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\sihost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2776
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Surrogateprovidercomponentsessionmonitor\spoolsv.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4336
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Surrogateprovidercomponentsessionmonitor\spoolsv.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Surrogateprovidercomponentsessionmonitor\spoolsv.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Surrogateprovidercomponentsessionmonitor\System.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3896
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Surrogateprovidercomponentsessionmonitor\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Surrogateprovidercomponentsessionmonitor\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4176
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\PolicyDefinitions\fontdrvhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1204
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1360
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Windows\PolicyDefinitions\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Word\ApplicationFrameHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ApplicationFrameHost" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Word\ApplicationFrameHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1476
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Word\ApplicationFrameHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\ShellExperienceHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2896
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\ShellExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3376
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\ShellExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4160
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3576
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4204
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\sysmon.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\All Users\sysmon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\sysmon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Surrogateprovidercomponentsessionmonitor\fontdrvhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:648
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Surrogateprovidercomponentsessionmonitor\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Surrogateprovidercomponentsessionmonitor\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:64
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Users\Default\sysmon.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2300
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Default\sysmon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1424
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Users\Default\sysmon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1888
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\Fonts\System.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Fonts\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Windows\Fonts\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4804
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\taskhostw.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\Chrome\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:432
-
C:\Windows\Fonts\System.exeC:\Windows\Fonts\System.exe1⤵
- Executes dropped EXE
PID:4120
-
C:\Program Files (x86)\Windows Portable Devices\ShellExperienceHost.exe"C:\Program Files (x86)\Windows Portable Devices\ShellExperienceHost.exe"1⤵
- Executes dropped EXE
PID:1996
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Surrogateprovidercomponentsessionmonitor\GdYaNq.vbe
- Size 231B
- SHA256 3f7ab00980558804600b2f6d048923ef4c3f541504ec929ddeaf64c84e9e5ea2
- MD5 5883718a5a7d15442c10bb5f0ec73490
- SHA1 debc58b4e3cd5121a51b1ac23108a3a10993227f
- SHA512 0e261e1571f828f9e93778a5c98b7e9669383568d5a915a1b4af1b8273ca17f11ee47f6957b3768bca01ea88936da4541f318f7b91542a65e51db3ab03e62502
- MD5 SHA1 SHA512
- Path C:\Surrogateprovidercomponentsessionmonitor\RS64buulixvrgn.bat
- Size 63B
- SHA256 80d02a1cb8e68ffbc609a6c4914600604153ce929d46994200f837d354a5a611
- MD5 6de687cf7ca366429c953cb49905b70a
- SHA1 58e2c1823c038d8da8a2f042672027184066279e
- SHA512 6bfa7a07d6adf167458cece0ba3a110479ee7677feb58c0ae9ba5c8913bcdda13664060ce0261abc1668c18831d5c73f6bc570be8595323d46704b810fc024ef
- MD5 SHA1 SHA512
- Path C:\Surrogateprovidercomponentsessionmonitor\browserwinsvc.exe
- Size 1.3MB
- SHA256 604d318dd35c84d75e070b534558a3f7f5a52e1bfedee8e77fc1d756ac684ca2
- MD5 3110f5c22dfea46122ca06ddabd3f84c
- SHA1 57de9aa7bfe69bec5a9ba747e6ec0c2f105c256f
- SHA512 045787765b26d81346bc4818c1e58520b5c920182e9b84e15e1c0e123d475222420a6114fd56b4ecbb10ac4d34f333dc3c055f9396b39cc8707cf1bf207b4130
- SSDEEP 24576:OlESdayd3rFfezUTnrtDENS2i8SIq7bARyGrx0f7MHqeTMa:O2SdtihITtKto7i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
- MD5 8592ba100a78835a6b94d5949e13dfc1
- SHA1 63e901200ab9a57c7dd4c078d7f75dcd3b357020
- SHA512 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 5723a62683450e9f5af85eee2657d16a02e16e324a48af55a401829f85f5b33f
- MD5 0235ba518674976b2618809e3c059d4e
- SHA1 447d4a6812e9c1544f5c22bf379e268c9fa947c2
- SHA512 286f1093ae82a418a629dff3d29dec512d2cd5cca360a70e1965e3f1ed9ccf167c7f2561c79bc4f2ddbe0d5ddd127ef527728f672d72cb1799e5f91fd3340a4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 1e1c8002ab7dc9bac72334f7b93677e22ab4d097a65edf775d5f27ca2c833be6
- MD5 d01f2133603734e76042ca6b0a27c0e0
- SHA1 2ec7017fe73214a74742684f3ff5d3a5077b80ac
- SHA512 44cc796f6ba6cc5548b0a8f712a5be403f95e9f8bedd564392c85c167b39607529feebe960450e1a04bafd5786e58ba6c78b1d51940129610d400d2811c7f046
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 31b93342a463036c8553aacdf630c314d990976be5138130da6b5be2c2da6f1c
- MD5 91d90c9debb9492962fc60d6f788233c
- SHA1 ed1e8dfe3c80d177664c2a61e33ff7233f19f0e2
- SHA512 29022c623240800c796a4aa4f767dbb81af348446460080d7bc8147bd07cd19dc0780c788838b19d022d1e0f655a0169fb4cdc4c0308cad2a4f3779be14afc17
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 6b529c6b88b78c59c35a744cbc09bfa4b357465e2c9989f41e0db4f90443e561
- MD5 8c65b061091f70ec5d1ec18030656508
- SHA1 4a319b5a621c01a5d237986fdc290114f4e12260
- SHA512 0c4edc3bddcd49d359e3cd5e5e516412e5cf7d3dc982a4f5471cf72c06aea4a52257c1d49a68d520a85d4977052e4ce0065c69bc132d32de55c802be5311f314
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 f329b20e571361be6a53ba7f83490caaa56fb94463a66bd2939acb4b2f448067
- MD5 582d854d7b90b8695a61de089dc4bcb1
- SHA1 da29b1df3c5d9ed8d87e999312f5c28646ea6a1a
- SHA512 7e41519fac73b88dab58d0d663a699a6e04d632bf2b00e43b6a339ce11572cd2c490f167c62a789ec8690418548daa3f51ddb1133221d814a32befdb41657eb5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 8d56989acb880b3bf88fef049121122288a059ab8a6fd3108ce9d620795a2501
- MD5 abd5bab46c3ca29ae975e739e4d95c2a
- SHA1 1c8f3fa6ab9d9387e133a144c85024b84a63e7ad
- SHA512 449d40db0ae8858b18b78c174afcc4a0f07b6c160680095d2af636fc435be506668e084ce4b586629e5ef2def27a5822b78094398dd2073b8b74cfc0362d9d5c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 e654530944b81da06fcd1b6f7f774d58b5c26fe7207dc64f411d56c5dca6f170
- MD5 7db24464b0a323fae4887b7dd2ea79e9
- SHA1 eb747a270a849cda5fd4ad4a76d433031eb07fa6
- SHA512 6906c0035ca9f759650bb224b73ff9cd3acf7318e0ad0c1ee6d32556b95a00172a90d9e9fdc50fe9c54bfb0ab3031c1701650c4157c206b51296c681f04ba563
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 5e2f62e95b31a1957d4a18d2847fb89d3a1d0e5a2eb35bd4d446aff98515e2f7
- MD5 3aa155037b965748aa5f4708b795cdb4
- SHA1 fed2517020d67fecab99b21912b025006a235069
- SHA512 7833626d596fc91c7da74b06d335df7c351c903dc77f6614ea7b630d00e24efbecf8922fc45aa7dad046f6f23d83ec5493d40c912197c635a3276591ef419fe6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 2431414809c77930662e4a844eeaaf4e25437d3ecc9ab3c73cdc45d6ef53fdaa
- MD5 d56ce0abb26fff87943fbf8feda2fb1f
- SHA1 3a9f27e2c303046403dedf5fc39b0e74adb168ff
- SHA512 40e3d678474a0dbb8d842cfa62a27beecc976d02d0b8effddf9a2e933cbe3bb3726eedb4e0fa0b209c78d14b780f025d7e2914e03b3b9aef607d6ddecb4a4df7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 0db07c5d3036358404a2b8a11f152e3e7e9876d5e3e8101c148bb822c468b51f
- MD5 652a0988eef20bf0b6667e1cfaa962c5
- SHA1 ebc60a55fa7a7f1d7c51bf3fec9ddb08f147ac97
- SHA512 af6af3bb1550f779fa69d1470d92dbda66e2a3058ae480809de1e8133858ee921a527fbe6d19561b1c27e3203506fac9496f0214728627a0a98216e933f6224c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f5fcjxoa.hwm.ps1
- Size 1B
- SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
- MD5 c4ca4238a0b923820dcc509a6f75849b
- SHA1 356a192b7913b04c54574d18c28d46e6395428ab
- SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
- MD5 SHA1 SHA512