dcrat | 959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe
Size 3.0MB
Sample240520-c965eagb67
SHA256 959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915
MD5 b0a2f53baa478b541ddab184cb0b3820
SHA1 4a7c64dad7d8e9b468f81af6112d2c7fec3d79e7
SHA512 8b31cacd4eddbf829da987bb65a64a9cef4de31a5762031ed5b542f18bf91e43f1883a90f2fb82fb5c669c332a9facb28b9f2609aca7dc4af3b35036ac5d1a5d
SSDEEP 49152:AZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:07ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	644	516	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	516	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	516	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	516	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	516	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	516	schtasks.exe	91

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1624-13-0x0000000000400000-0x0000000000648000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1432	powershell.exe
4360	powershell.exe
5032	powershell.exe
3568	powershell.exe
4996	powershell.exe
3196	powershell.exe
1344	powershell.exe
2216	powershell.exe
3296	powershell.exe
1908	powershell.exe
2344	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe

Executes dropped EXE 7 IoCs

pid	Process
5304	fontdrvhost.exe
5780	fontdrvhost.exe
5792	fontdrvhost.exe
5800	fontdrvhost.exe
5204	fontdrvhost.exe
4456	fontdrvhost.exe
4296	fontdrvhost.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
43	ip-api.com
72	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1816 set thread context of 1624	1816	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	98
PID 5304 set thread context of 5800	5304	fontdrvhost.exe	135
PID 5204 set thread context of 4296	5204	fontdrvhost.exe	149

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4300	schtasks.exe
2196	schtasks.exe
644	schtasks.exe
4052	schtasks.exe
4392	schtasks.exe
2676	schtasks.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	fontdrvhost.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe
1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe
1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe
1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe
1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe
1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe
1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe
1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe
1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe
1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe
1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe
3196	powershell.exe
3196	powershell.exe
1344	powershell.exe
1344	powershell.exe
4360	powershell.exe
4360	powershell.exe
2216	powershell.exe
2216	powershell.exe
1432	powershell.exe
1432	powershell.exe
2344	powershell.exe
2344	powershell.exe
3568	powershell.exe
3568	powershell.exe
4996	powershell.exe
4996	powershell.exe
1908	powershell.exe
1908	powershell.exe
3296	powershell.exe
3296	powershell.exe
5032	powershell.exe
5032	powershell.exe
3196	powershell.exe
2216	powershell.exe
4360	powershell.exe
1432	powershell.exe
1344	powershell.exe
4996	powershell.exe
5032	powershell.exe
3568	powershell.exe
2344	powershell.exe
1908	powershell.exe
3296	powershell.exe
5304	fontdrvhost.exe
5304	fontdrvhost.exe
5304	fontdrvhost.exe
5304	fontdrvhost.exe
5800	fontdrvhost.exe
5800	fontdrvhost.exe
5800	fontdrvhost.exe
5800	fontdrvhost.exe
5800	fontdrvhost.exe
5204	fontdrvhost.exe
5204	fontdrvhost.exe
4296	fontdrvhost.exe
4296	fontdrvhost.exe
4296	fontdrvhost.exe
4296	fontdrvhost.exe
4296	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	5304	fontdrvhost.exe
Token: SeDebugPrivilege	5800	fontdrvhost.exe
Token: SeDebugPrivilege	5204	fontdrvhost.exe
Token: SeDebugPrivilege	4296	fontdrvhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1624	1816	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	98
PID 1816 wrote to memory of 1624	1816	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	98
PID 1816 wrote to memory of 1624	1816	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	98
PID 1816 wrote to memory of 1624	1816	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	98
PID 1816 wrote to memory of 1624	1816	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	98
PID 1816 wrote to memory of 1624	1816	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	98
PID 1816 wrote to memory of 1624	1816	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	98
PID 1816 wrote to memory of 1624	1816	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	98
PID 1624 wrote to memory of 3196	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	105
PID 1624 wrote to memory of 3196	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	105
PID 1624 wrote to memory of 3196	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	105
PID 1624 wrote to memory of 2216	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	106
PID 1624 wrote to memory of 2216	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	106
PID 1624 wrote to memory of 2216	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	106
PID 1624 wrote to memory of 1344	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	107
PID 1624 wrote to memory of 1344	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	107
PID 1624 wrote to memory of 1344	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	107
PID 1624 wrote to memory of 1432	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	108
PID 1624 wrote to memory of 1432	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	108
PID 1624 wrote to memory of 1432	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	108
PID 1624 wrote to memory of 4360	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	109
PID 1624 wrote to memory of 4360	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	109
PID 1624 wrote to memory of 4360	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	109
PID 1624 wrote to memory of 3296	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	111
PID 1624 wrote to memory of 3296	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	111
PID 1624 wrote to memory of 3296	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	111
PID 1624 wrote to memory of 1908	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	112
PID 1624 wrote to memory of 1908	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	112
PID 1624 wrote to memory of 1908	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	112
PID 1624 wrote to memory of 2344	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	113
PID 1624 wrote to memory of 2344	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	113
PID 1624 wrote to memory of 2344	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	113
PID 1624 wrote to memory of 3568	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	114
PID 1624 wrote to memory of 3568	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	114
PID 1624 wrote to memory of 3568	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	114
PID 1624 wrote to memory of 5032	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	115
PID 1624 wrote to memory of 5032	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	115
PID 1624 wrote to memory of 5032	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	115
PID 1624 wrote to memory of 4996	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	116
PID 1624 wrote to memory of 4996	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	116
PID 1624 wrote to memory of 4996	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	116
PID 1624 wrote to memory of 3284	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	127
PID 1624 wrote to memory of 3284	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	127
PID 1624 wrote to memory of 3284	1624	959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe	127
PID 3284 wrote to memory of 1596	3284	cmd.exe	129
PID 3284 wrote to memory of 1596	3284	cmd.exe	129
PID 3284 wrote to memory of 1596	3284	cmd.exe	129
PID 1596 wrote to memory of 3328	1596	w32tm.exe	130
PID 1596 wrote to memory of 3328	1596	w32tm.exe	130
PID 3284 wrote to memory of 5304	3284	cmd.exe	131
PID 3284 wrote to memory of 5304	3284	cmd.exe	131
PID 3284 wrote to memory of 5304	3284	cmd.exe	131
PID 5304 wrote to memory of 5780	5304	fontdrvhost.exe	133
PID 5304 wrote to memory of 5780	5304	fontdrvhost.exe	133
PID 5304 wrote to memory of 5780	5304	fontdrvhost.exe	133
PID 5304 wrote to memory of 5792	5304	fontdrvhost.exe	134
PID 5304 wrote to memory of 5792	5304	fontdrvhost.exe	134
PID 5304 wrote to memory of 5792	5304	fontdrvhost.exe	134
PID 5304 wrote to memory of 5800	5304	fontdrvhost.exe	135
PID 5304 wrote to memory of 5800	5304	fontdrvhost.exe	135
PID 5304 wrote to memory of 5800	5304	fontdrvhost.exe	135
PID 5304 wrote to memory of 5800	5304	fontdrvhost.exe	135
PID 5304 wrote to memory of 5800	5304	fontdrvhost.exe	135
PID 5304 wrote to memory of 5800	5304	fontdrvhost.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe
"C:\Users\Admin\AppData\Local\Temp\959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Local\Temp\959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe
  "C:\Users\Admin\AppData\Local\Temp\959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3196
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2216
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1344
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1432
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4360
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3296
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1908
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2344
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3568
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WUgLeqyDKr.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Windows\SysWOW64\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1596
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:3328
  - - C:\Recovery\WindowsRE\fontdrvhost.exe
      "C:\Recovery\WindowsRE\fontdrvhost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5304
    - - C:\Recovery\WindowsRE\fontdrvhost.exe
        
        "C:\Recovery\WindowsRE\fontdrvhost.exe"
        5⤵
        Executes dropped EXE
        
        PID:5780
    - - C:\Recovery\WindowsRE\fontdrvhost.exe
        
        "C:\Recovery\WindowsRE\fontdrvhost.exe"
        5⤵
        Executes dropped EXE
        
        PID:5792
    - - C:\Recovery\WindowsRE\fontdrvhost.exe
        
        "C:\Recovery\WindowsRE\fontdrvhost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5800
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dcfb96fa-75b5-4140-ab5b-248e6a07dbab.vbs"
        6⤵
        
        PID:6008
        
        C:\Recovery\WindowsRE\fontdrvhost.exe
        
        C:\Recovery\WindowsRE\fontdrvhost.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5204
        
        C:\Recovery\WindowsRE\fontdrvhost.exe
        
        "C:\Recovery\WindowsRE\fontdrvhost.exe"
        8⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Recovery\WindowsRE\fontdrvhost.exe
        
        "C:\Recovery\WindowsRE\fontdrvhost.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4296
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ca44cb3d-1cfb-4e78-b42c-c83a0de03884.vbs"
        9⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\adeb5b84-2705-4448-8937-0585f9184122.vbs"
        9⤵
        
        PID:1316
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ebb30c6a-4ad9-4025-9d05-d1aa386276f9.vbs"
        6⤵
        
        PID:6048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fontdrvhost.exe

Path C:\Recovery\WindowsRE\fontdrvhost.exe
Size 3.0MB
SHA256 959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915
MD5 b0a2f53baa478b541ddab184cb0b3820
SHA1 4a7c64dad7d8e9b468f81af6112d2c7fec3d79e7
SHA512 8b31cacd4eddbf829da987bb65a64a9cef4de31a5762031ed5b542f18bf91e43f1883a90f2fb82fb5c669c332a9facb28b9f2609aca7dc4af3b35036ac5d1a5d
SSDEEP 49152:AZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:07ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\959800fa97270fcdfc8dd6795a1040a0972a8be32820950ff79551b7a1800915.exe.log
Size 1KB
SHA256 1ad8f00e485dbebe5a1f40f60b9e588e6563c4feef20b8134f335b3e16208dc3
MD5 95b0eabd8c9c516fc2d8632ff8f4dc10
SHA1 8118b2b54184a5add848198f36a905b9a511940e
SHA512 60147da0bc922f18e2eeae00dc7dda1caa432df6ed0f853cd4757535bf371536902c1ce1bc40db167540bbc79dedf9a742498fab5bafcbd1053c4b2dd9c79e62
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
MD5 SHA1 SHA512

Submit Download