dcrat | 0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9.exe
Size 3.4MB
Sample240520-ktcjvsda3t
SHA256 0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9
MD5 0718b2656d9730a5e356773497e24462
SHA1 e97957b4eaccd7b4600e9ed7fae0bf4a0cfdfe33
SHA512 f58f7c4577021376a83e704dfcd4af91ec33a82619e8618d1a19eb33de201024219851fc4e554c27f74bdbc94a069ee6a922b395b46943c5d87b2a5356deb8a5
SSDEEP 98304:ubIXaItAdMSUEVtrCcvt0pI5oVzYik21D0Dxm3tQT4:u0KIadKEVt5vL5oZYiNyDWM4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3104	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3208	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3408	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4640	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3344	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	3140	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	3140	schtasks.exe	90

UAC bypass 3 TTPs 9 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	unsecapp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	unsecapp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	unsecapp.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x00070000000233c0-10.dat	dcrat
behavioral2/memory/4296-13-0x00000000004F0000-0x0000000000804000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Xsec.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Xsec.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 3 IoCs

pid	Process
4296	Xsec.exe
3392	Xsec.exe
1116	unsecapp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Xsec.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Xsec.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	unsecapp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	unsecapp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Xsec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
21	pastebin.com
22	pastebin.com

Drops file in Program Files directory 36 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\Stationery\RuntimeBroker.exe	Xsec.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\RuntimeBroker.exe	Xsec.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\dwm.exe	Xsec.exe
File created	C:\Program Files (x86)\Common Files\Services\0a1fd5f707cd16	Xsec.exe
File created	C:\Program Files\Java\jre-1.8\bin\5b884080fd4f94	Xsec.exe
File created	C:\Program Files\ModifiableWindowsApps\RuntimeBroker.exe	Xsec.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\TrustedInstaller.exe	Xsec.exe
File created	C:\Program Files (x86)\Google\CrashReports\csrss.exe	Xsec.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\cc11b995f2a76d	Xsec.exe
File created	C:\Program Files (x86)\Google\Temp\5940a34987c991	Xsec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\Registry.exe	Xsec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\ee2ad38f3d4382	Xsec.exe
File created	C:\Program Files (x86)\Windows Sidebar\ea1d8f6d871115	Xsec.exe
File created	C:\Program Files\Windows Mail\RuntimeBroker.exe	Xsec.exe
File created	C:\Program Files\Java\jre-1.8\bin\fontdrvhost.exe	Xsec.exe
File created	C:\Program Files (x86)\Common Files\Oracle\winlogon.exe	Xsec.exe
File created	C:\Program Files (x86)\Common Files\Oracle\cc11b995f2a76d	Xsec.exe
File created	C:\Program Files\Windows Mail\ea1d8f6d871115	Xsec.exe
File created	C:\Program Files (x86)\Windows Sidebar\upfc.exe	Xsec.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\04c1e7795967e4	Xsec.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\winlogon.exe	Xsec.exe
File created	C:\Program Files\Common Files\microsoft shared\Stationery\9e8d7a4ca61bd9	Xsec.exe
File created	C:\Program Files (x86)\Google\Temp\dllhost.exe	Xsec.exe
File created	C:\Program Files\7-Zip\66fc9ff0ee96c2	Xsec.exe
File created	C:\Program Files (x86)\Google\CrashReports\886983d96e3d3e	Xsec.exe
File created	C:\Program Files (x86)\Windows Mail\sppsvc.exe	Xsec.exe
File created	C:\Program Files\7-Zip\sihost.exe	Xsec.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Registry.exe	Xsec.exe
File created	C:\Program Files (x86)\Common Files\Services\sppsvc.exe	Xsec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\sppsvc.exe	Xsec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\0a1fd5f707cd16	Xsec.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\6cb0b6c459d5d3	Xsec.exe
File created	C:\Program Files\Windows Mail\9e8d7a4ca61bd9	Xsec.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\Registry.exe	Xsec.exe
File created	C:\Program Files (x86)\Windows Mail\0a1fd5f707cd16	Xsec.exe
File created	C:\Program Files\Windows Mail\upfc.exe	Xsec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Offline Web Pages\69ddcba757bf72	Xsec.exe
File created	C:\Windows\DiagTrack\088424020bedd6	Xsec.exe
File created	C:\Windows\en-US\TrustedInstaller.exe	Xsec.exe
File created	C:\Windows\en-US\04c1e7795967e4	Xsec.exe
File created	C:\Windows\PLA\Rules\es-ES\Xsec.exe	Xsec.exe
File created	C:\Windows\es-ES\upfc.exe	Xsec.exe
File created	C:\Windows\security\database\SppExtComObj.exe	Xsec.exe
File created	C:\Windows\Prefetch\ReadyBoot\f3b6ecef712a24	Xsec.exe
File created	C:\Windows\PLA\Rules\es-ES\63d8c0478496ee	Xsec.exe
File created	C:\Windows\Offline Web Pages\smss.exe	Xsec.exe
File created	C:\Windows\DiagTrack\conhost.exe	Xsec.exe
File created	C:\Windows\security\database\e1ef82546f0b02	Xsec.exe
File created	C:\Windows\es-ES\ea1d8f6d871115	Xsec.exe
File created	C:\Windows\Prefetch\ReadyBoot\spoolsv.exe	Xsec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2952	schtasks.exe
1588	schtasks.exe
3404	schtasks.exe
4600	schtasks.exe
740	schtasks.exe
4100	schtasks.exe
3224	schtasks.exe
3444	schtasks.exe
956	schtasks.exe
4392	schtasks.exe
1492	schtasks.exe
3408	schtasks.exe
2604	schtasks.exe
752	schtasks.exe
3136	schtasks.exe
2648	schtasks.exe
3184	schtasks.exe
1852	schtasks.exe
1944	schtasks.exe
3408	schtasks.exe
4844	schtasks.exe
2668	schtasks.exe
3384	schtasks.exe
5092	schtasks.exe
3104	schtasks.exe
3396	schtasks.exe
2760	schtasks.exe
3852	schtasks.exe
4396	schtasks.exe
4976	schtasks.exe
2004	schtasks.exe
2980	schtasks.exe
3208	schtasks.exe
1168	schtasks.exe
1060	schtasks.exe
4396	schtasks.exe
456	schtasks.exe
1260	schtasks.exe
3344	schtasks.exe
1152	schtasks.exe
4560	schtasks.exe
800	schtasks.exe
2372	schtasks.exe
2108	schtasks.exe
2332	schtasks.exe
4000	schtasks.exe
4376	schtasks.exe
4400	schtasks.exe
3652	schtasks.exe
2588	schtasks.exe
2328	schtasks.exe
2184	schtasks.exe
3648	schtasks.exe
1564	schtasks.exe
1624	schtasks.exe
3068	schtasks.exe
2000	schtasks.exe
4964	schtasks.exe
4640	schtasks.exe
4448	schtasks.exe
768	schtasks.exe
4184	schtasks.exe
1488	schtasks.exe
2396	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	unsecapp.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2712	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4296	Xsec.exe
4296	Xsec.exe
4296	Xsec.exe
4296	Xsec.exe
4296	Xsec.exe
4296	Xsec.exe
4296	Xsec.exe
4296	Xsec.exe
4296	Xsec.exe
4296	Xsec.exe
3392	Xsec.exe
3392	Xsec.exe
3392	Xsec.exe
3392	Xsec.exe
3392	Xsec.exe
3392	Xsec.exe
3392	Xsec.exe
3392	Xsec.exe
3392	Xsec.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe
1116	unsecapp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1116	unsecapp.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4296	Xsec.exe
Token: SeDebugPrivilege	3392	Xsec.exe
Token: SeDebugPrivilege	1116	unsecapp.exe
Token: SeBackupPrivilege	2088	vssvc.exe
Token: SeRestorePrivilege	2088	vssvc.exe
Token: SeAuditPrivilege	2088	vssvc.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 2008	1072	0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9.exe	83
PID 1072 wrote to memory of 2008	1072	0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9.exe	83
PID 1072 wrote to memory of 2008	1072	0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9.exe	83
PID 2008 wrote to memory of 5072	2008	WScript.exe	91
PID 2008 wrote to memory of 5072	2008	WScript.exe	91
PID 2008 wrote to memory of 5072	2008	WScript.exe	91
PID 5072 wrote to memory of 4296	5072	cmd.exe	93
PID 5072 wrote to memory of 4296	5072	cmd.exe	93
PID 4296 wrote to memory of 3392	4296	Xsec.exe	152
PID 4296 wrote to memory of 3392	4296	Xsec.exe	152
PID 5072 wrote to memory of 2712	5072	cmd.exe	153
PID 5072 wrote to memory of 2712	5072	cmd.exe	153
PID 5072 wrote to memory of 2712	5072	cmd.exe	153
PID 3392 wrote to memory of 1116	3392	Xsec.exe	194
PID 3392 wrote to memory of 1116	3392	Xsec.exe	194
PID 1116 wrote to memory of 1824	1116	unsecapp.exe	196
PID 1116 wrote to memory of 1824	1116	unsecapp.exe	196
PID 1116 wrote to memory of 432	1116	unsecapp.exe	197
PID 1116 wrote to memory of 432	1116	unsecapp.exe	197

System policy modification 1 TTPs 9 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	unsecapp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	unsecapp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	unsecapp.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9.exe
"C:\Users\Admin\AppData\Local\Temp\0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\BlockWinHostnet\Hostnet\Sec_Exec\EuTvLCPQkcrvAlZ1rIR5sP2f.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\BlockWinHostnet\Hostnet\Sec_Exec\TKgbn4JzaGo.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Users\Admin\AppData\Roaming\BlockWinHostnet\Hostnet\Sec_Exec\Xsec.exe
      "C:\Users\Admin\AppData\Roaming\BlockWinHostnet\Hostnet\Sec_Exec\Xsec.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4296
    - - C:\Users\Admin\AppData\Roaming\BlockWinHostnet\Hostnet\Sec_Exec\Xsec.exe
        
        "C:\Users\Admin\AppData\Roaming\BlockWinHostnet\Hostnet\Sec_Exec\Xsec.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3392
      - C:\Users\Admin\Music\unsecapp.exe
        
        "C:\Users\Admin\Music\unsecapp.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1116
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e9bb19eb-ea8e-4782-91fd-17228f3f3a9e.vbs"
        7⤵
        
        PID:1824
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d15415a0-b2b6-48db-9fa3-8a54949234b5.vbs"
        7⤵
        
        PID:432
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\microsoft shared\Stationery\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\Stationery\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\microsoft shared\Stationery\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Windows\es-ES\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\es-ES\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Windows\es-ES\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jre-1.8\bin\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\bin\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jre-1.8\bin\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\Offline Web Pages\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\Offline Web Pages\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 11 /tr "'C:\Users\Public\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Users\Public\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 6 /tr "'C:\Users\Public\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Oracle\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Oracle\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\Oracle\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Temp\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Temp\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\CrashReports\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\CrashReports\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Downloads\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\Downloads\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Downloads\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Videos\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Videos\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Videos\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Windows\DiagTrack\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\DiagTrack\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\DiagTrack\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Windows\security\database\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\security\database\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Windows\security\database\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 9 /tr "'C:\Windows\en-US\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Windows\en-US\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 10 /tr "'C:\Windows\en-US\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Windows\Prefetch\ReadyBoot\spoolsv.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\Prefetch\ReadyBoot\spoolsv.exe'" /rl HIGHEST /f
1⤵
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\sihost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\7-Zip\sihost.exe'" /rl HIGHEST /f
1⤵
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\sihost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Searches\SppExtComObj.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Admin\Searches\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
PID:4168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Searches\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Services\sppsvc.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\Services\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "XsecX" /sc MINUTE /mo 8 /tr "'C:\Windows\PLA\Rules\es-ES\Xsec.exe'" /f
1⤵
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Xsec" /sc ONLOGON /tr "'C:\Windows\PLA\Rules\es-ES\Xsec.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "XsecX" /sc MINUTE /mo 7 /tr "'C:\Windows\PLA\Rules\es-ES\Xsec.exe'" /rl HIGHEST /f
1⤵
PID:464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\upfc.exe'" /f
1⤵
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\upfc.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\upfc.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Music\unsecapp.exe'" /f
1⤵
- Creates scheduled task(s)
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Admin\Music\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Music\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\sppsvc.exe'" /f
1⤵
- Creates scheduled task(s)
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\sppsvc.exe'" /rl HIGHEST /f
1⤵
PID:4448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2088

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Xsec.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Xsec.exe.log
Size 1KB
SHA256 2b1ffeab025cc7c61c50e3e2e4c9253046d9174cf00181a8c1de733a4c0daa14
MD5 655010c15ea0ca05a6e5ddcd84986b98
SHA1 120bf7e516aeed462c07625fbfcdab5124ad05d3
SHA512 e52c26718d7d1e979837b5ac626dde26920fe7413b8aa7be6f1be566a1b0f035582f4d313400e3ad6b92552abb1dfaf186b60b875fb955a2a94fd839fe841437
MD5 SHA1 SHA512

Submit Download

d15415a0-b2b6-48db-9fa3-8a54949234b5.vbs

Path C:\Users\Admin\AppData\Local\Temp\d15415a0-b2b6-48db-9fa3-8a54949234b5.vbs
Size 485B
SHA256 4e6155c86c90d8cc7149491de5bccf8cade8cc1c62a21259413f8ed16a463ec1
MD5 d18ad2a8fceeaba0d87a3a5d56980e72
SHA1 87eeda8d443584e570642a35300f7a86f4145cea
SHA512 7c660cc7a0a5f025ebe29eb279ae8bd1187f71c2e2ca0c7f3ddef7d9fe35fafe3e8b3088b93e4922afcb780d7ddbb8f03b02d2c369dac0fd1a34a71e3355a7ef
MD5 SHA1 SHA512

Submit Download

e9bb19eb-ea8e-4782-91fd-17228f3f3a9e.vbs

Path C:\Users\Admin\AppData\Local\Temp\e9bb19eb-ea8e-4782-91fd-17228f3f3a9e.vbs
Size 709B
SHA256 5b16509d5c0d588a9bb0a09a8774adf6695ea91ed5954b50bf5f186787e4a5a8
MD5 754f6608f23af0a2bfa1c83f8a4a8238
SHA1 d97f17edccb6638433a2deb6597b104a2596cff4
SHA512 762805ebfc911c65715e72ad3ab237750a5ac81641bc4d447fbda22239f7ff5debee782858c1ee0c1fa2910a9efb340042e87f0c3ba1da3aea5e85bd1a6fe639
MD5 SHA1 SHA512

Submit Download

EuTvLCPQkcrvAlZ1rIR5sP2f.vbe

Path C:\Users\Admin\AppData\Roaming\BlockWinHostnet\Hostnet\Sec_Exec\EuTvLCPQkcrvAlZ1rIR5sP2f.vbe
Size 227B
SHA256 b1db61ec04e4ce9e14e903ef0dab6bbb44da57f390f899130b1d7302a96bbde9
MD5 e5e4945a3acda8504795cbcba7f7ab39
SHA1 8c9b430ab5028430ee52bc66b8171fc86dbd0152
SHA512 c672570240e0ba421f52428d71455d3d1f6a4e7b9fa4cbc4fd0bb2ed9890fd8deb61cd10be8bd73f197f1dc93822b5638be96ed452c9c61f64be70a2cef207df
MD5 SHA1 SHA512

Submit Download

TKgbn4JzaGo.bat

Path C:\Users\Admin\AppData\Roaming\BlockWinHostnet\Hostnet\Sec_Exec\TKgbn4JzaGo.bat
Size 165B
SHA256 c1921bd76587dfebca55b8fe6ad4baf45cd189b1f2d93f803327ae9d3cca3a8a
MD5 eda5df5294922ff3df9a1838907d99bf
SHA1 3421763abeca4c9486a4603e107d1c9b5d36d99c
SHA512 145500d4623d5c631fdcbc3315bc1af2a34301a528f02b747476890b246ce765e0b7af3aa898e1204b6de9afc762932690476039684dc3c7d9d3b2bb887e2e17
MD5 SHA1 SHA512

Submit Download

Xsec.exe

Path C:\Users\Admin\AppData\Roaming\BlockWinHostnet\Hostnet\Sec_Exec\Xsec.exe
Size 3.1MB
SHA256 276ff9f0bc857f8cba727cb86ca4289cca4be1bb8c7c31c0c9c65f5b98a36821
MD5 ae38336481097a8262174b70bb3d65ef
SHA1 248c710a7a87ade1e7fa40815fa71e78e999c34f
SHA512 85d95d7ae46c45c8721d672f6849ab8255dda688751aa60c30f6898338a78fd539ec1974fe8faad1143d6211dfe693cb7ff0b315fbc505c5a90020ca128c2b19
SSDEEP 98304:7XaItAdMSUEVtrCcvt0pI5oVzYik21D0Dxm3tQT:7KIadKEVt5vL5oZYiNyDWM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1116-120-0x000000001B5A0000-0x000000001B5F6000-memory.dmp

Download

memory/3392-82-0x000000001C2E0000-0x000000001C2F2000-memory.dmp

Download

memory/4296-27-0x000000001BC90000-0x000000001BC98000-memory.dmp

Download

memory/4296-32-0x000000001BCE0000-0x000000001BCEC000-memory.dmp

Download

memory/4296-19-0x0000000002880000-0x0000000002890000-memory.dmp

Download

memory/4296-21-0x00000000028B0000-0x00000000028B8000-memory.dmp

Download

memory/4296-22-0x000000001B500000-0x000000001B512000-memory.dmp

Download

memory/4296-20-0x0000000002890000-0x00000000028A6000-memory.dmp

Download

memory/4296-23-0x000000001B510000-0x000000001B520000-memory.dmp

Download

memory/4296-24-0x000000001B4F0000-0x000000001B4FA000-memory.dmp

Download

memory/4296-25-0x000000001BC40000-0x000000001BC96000-memory.dmp

Download

memory/4296-26-0x000000001B520000-0x000000001B52C000-memory.dmp

Download

memory/4296-18-0x0000000002870000-0x0000000002878000-memory.dmp

Download

memory/4296-28-0x000000001BDA0000-0x000000001BDAC000-memory.dmp

Download

memory/4296-29-0x000000001BCA0000-0x000000001BCA8000-memory.dmp

Download

memory/4296-30-0x000000001BCB0000-0x000000001BCC2000-memory.dmp

Download

memory/4296-31-0x000000001C2E0000-0x000000001C808000-memory.dmp

Download

memory/4296-17-0x00000000028C0000-0x0000000002910000-memory.dmp

Download

memory/4296-33-0x000000001BCF0000-0x000000001BCFC000-memory.dmp

Download

memory/4296-34-0x000000001BD00000-0x000000001BD0C000-memory.dmp

Download

memory/4296-35-0x000000001BD80000-0x000000001BD88000-memory.dmp

Download

memory/4296-40-0x000000001BD40000-0x000000001BD4A000-memory.dmp

Download

memory/4296-41-0x000000001BD50000-0x000000001BD5C000-memory.dmp

Download

memory/4296-39-0x000000001BD90000-0x000000001BD98000-memory.dmp

Download

memory/4296-38-0x000000001BD30000-0x000000001BD38000-memory.dmp

Download

memory/4296-37-0x000000001BD20000-0x000000001BD2E000-memory.dmp

Download

memory/4296-36-0x000000001BD10000-0x000000001BD1A000-memory.dmp

Download

memory/4296-16-0x0000000002850000-0x000000000286C000-memory.dmp

Download

memory/4296-15-0x0000000002840000-0x0000000002848000-memory.dmp

Download

memory/4296-14-0x0000000002830000-0x000000000283E000-memory.dmp

Download

memory/4296-13-0x00000000004F0000-0x0000000000804000-memory.dmp

Download

memory/4296-12-0x00007FFD5B1C3000-0x00007FFD5B1C5000-memory.dmp

Download