dcrat | 279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab

Analysis

max time kernel
92s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 20:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
Size 1.9MB
Sample240526-yrbfnsab5v
SHA256 279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab
MD5 c61d77fea70f8639331570193b35e9d9
SHA1 1cac81128fa4e7a489f84d411ec2c3c54342aaff
SHA512 a643dadc1616e87271de5338fe9519a1ab5d0a2215431fbef0159665d483f206c07c3de51b9f1fd04ad8b0e956748789e7288b8e429ec7d27cda576687c2a5ab
SSDEEP 24576:5cIqg3pZ9Lbp1x5mMnbJ4ANfUAlkDd/2uUpET57RLGKETv/cyUM6MniOlsxvZBSg:XrhDbJ4dAlkpuuUpY57cKEr0a7iOyKc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\SppExtComObj.exe\""	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\""	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Program Files (x86)\\Common Files\\winlogon.exe\""	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Program Files (x86)\\Common Files\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	4724	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	4724	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4164	4724	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	4724	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	4724	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	4724	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	4724	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	4724	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	4724	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	4724	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	4724	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	4724	schtasks.exe	84

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1076-1-0x0000000000560000-0x000000000075A000-memory.dmp	dcrat
behavioral2/files/0x000700000002326f-36.dat	dcrat

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral2/memory/1076-7-0x0000000002970000-0x0000000002980000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1076-14-0x000000001B380000-0x000000001B38C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1076-21-0x000000001BD40000-0x000000001BD4A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1076-20-0x000000001BD30000-0x000000001BD3C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1076-16-0x000000001B3A0000-0x000000001B3AC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4616	powershell.exe
748	powershell.exe
4956	powershell.exe
4432	powershell.exe
3548	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe

Executes dropped EXE 1 IoCs

pid	Process
4964	backgroundTaskHost.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\SppExtComObj.exe\""	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\SppExtComObj.exe\""	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\WindowsRE\\dwm.exe\""	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\WindowsRE\\dwm.exe\""	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Common Files\\winlogon.exe\""	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Common Files\\winlogon.exe\""	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\SppExtComObj.exe	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\SppExtComObj.exe	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\e1ef82546f0b02	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
File created	C:\Program Files (x86)\Common Files\winlogon.exe	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
File created	C:\Program Files (x86)\Common Files\cc11b995f2a76d	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\RCX43E0.tmp	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
File opened for modification	C:\Program Files (x86)\Common Files\RCX47E9.tmp	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
File opened for modification	C:\Program Files (x86)\Common Files\winlogon.exe	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4000	schtasks.exe
2928	schtasks.exe
4008	schtasks.exe
4992	schtasks.exe
2700	schtasks.exe
4852	schtasks.exe
4552	schtasks.exe
3680	schtasks.exe
4400	schtasks.exe
4612	schtasks.exe
4164	schtasks.exe
4596	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
4956	powershell.exe
748	powershell.exe
4432	powershell.exe
4616	powershell.exe
4616	powershell.exe
3548	powershell.exe
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
748	powershell.exe
748	powershell.exe
4956	powershell.exe
4956	powershell.exe
4616	powershell.exe
4432	powershell.exe
4432	powershell.exe
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
3548	powershell.exe
3548	powershell.exe
4964	backgroundTaskHost.exe
4964	backgroundTaskHost.exe
4964	backgroundTaskHost.exe
4964	backgroundTaskHost.exe
4964	backgroundTaskHost.exe
4964	backgroundTaskHost.exe
4964	backgroundTaskHost.exe
4964	backgroundTaskHost.exe
4964	backgroundTaskHost.exe
4964	backgroundTaskHost.exe
4964	backgroundTaskHost.exe
4964	backgroundTaskHost.exe
4964	backgroundTaskHost.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	748	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	4964	backgroundTaskHost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 4616	1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe	100
PID 1076 wrote to memory of 4616	1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe	100
PID 1076 wrote to memory of 748	1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe	101
PID 1076 wrote to memory of 748	1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe	101
PID 1076 wrote to memory of 4956	1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe	102
PID 1076 wrote to memory of 4956	1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe	102
PID 1076 wrote to memory of 4432	1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe	103
PID 1076 wrote to memory of 4432	1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe	103
PID 1076 wrote to memory of 3548	1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe	104
PID 1076 wrote to memory of 3548	1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe	104
PID 1076 wrote to memory of 4964	1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe	110
PID 1076 wrote to memory of 4964	1076	279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe
"C:\Users\Admin\AppData\Local\Temp\279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\SppExtComObj.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\backgroundTaskHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3548
- C:\Recovery\WindowsRE\backgroundTaskHost.exe
  "C:\Recovery\WindowsRE\backgroundTaskHost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SppExtComObj.exe

Path C:\Program Files (x86)\Reference Assemblies\Microsoft\SppExtComObj.exe
Size 1.9MB
SHA256 279c417918a968b65986abedbdf64de2736f7d731cc0000d215b1e4d9fc547ab
MD5 c61d77fea70f8639331570193b35e9d9
SHA1 1cac81128fa4e7a489f84d411ec2c3c54342aaff
SHA512 a643dadc1616e87271de5338fe9519a1ab5d0a2215431fbef0159665d483f206c07c3de51b9f1fd04ad8b0e956748789e7288b8e429ec7d27cda576687c2a5ab
SSDEEP 24576:5cIqg3pZ9Lbp1x5mMnbJ4ANfUAlkDd/2uUpET57RLGKETv/cyUM6MniOlsxvZBSg:XrhDbJ4dAlkpuuUpY57cKEr0a7iOyKc
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
MD5 59d97011e091004eaffb9816aa0b9abd
SHA1 1602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA512 d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_utujs12x.11u.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_utujs12x.11u.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/748-117-0x00000215FFDE0000-0x00000215FFE02000-memory.dmp

Download

memory/1076-18-0x000000001BCD0000-0x000000001BCD8000-memory.dmp

Download

memory/1076-19-0x000000001BD20000-0x000000001BD2E000-memory.dmp

Download

memory/1076-9-0x000000001B2C0000-0x000000001B2D0000-memory.dmp

Download

memory/1076-10-0x000000001B2D0000-0x000000001B2DC000-memory.dmp

Download

memory/1076-11-0x000000001B2E0000-0x000000001B2F2000-memory.dmp

Download

memory/1076-12-0x000000001C000000-0x000000001C528000-memory.dmp

Download

memory/1076-13-0x000000001B310000-0x000000001B31C000-memory.dmp

Download

memory/1076-14-0x000000001B380000-0x000000001B38C000-memory.dmp

Download

memory/1076-15-0x000000001B390000-0x000000001B398000-memory.dmp

Download

memory/1076-0-0x00007FFE7E333000-0x00007FFE7E335000-memory.dmp

Download

memory/1076-17-0x000000001B3B0000-0x000000001B3BE000-memory.dmp

Download

memory/1076-21-0x000000001BD40000-0x000000001BD4A000-memory.dmp

Download

memory/1076-20-0x000000001BD30000-0x000000001BD3C000-memory.dmp

Download

memory/1076-8-0x000000001B2A0000-0x000000001B2B6000-memory.dmp

Download

memory/1076-16-0x000000001B3A0000-0x000000001B3AC000-memory.dmp

Download

memory/1076-23-0x00007FFE7E330000-0x00007FFE7EDF1000-memory.dmp

Download

memory/1076-22-0x000000001BD50000-0x000000001BD5C000-memory.dmp

Download

memory/1076-26-0x00007FFE7E330000-0x00007FFE7EDF1000-memory.dmp

Download

memory/1076-6-0x000000001B330000-0x000000001B380000-memory.dmp

Download

memory/1076-7-0x0000000002970000-0x0000000002980000-memory.dmp

Download

memory/1076-5-0x0000000002950000-0x000000000296C000-memory.dmp

Download

memory/1076-169-0x00007FFE7E330000-0x00007FFE7EDF1000-memory.dmp

Download

memory/1076-4-0x0000000002830000-0x0000000002838000-memory.dmp

Download

memory/1076-3-0x0000000002820000-0x000000000282E000-memory.dmp

Download

memory/1076-2-0x00007FFE7E330000-0x00007FFE7EDF1000-memory.dmp

Download

memory/1076-1-0x0000000000560000-0x000000000075A000-memory.dmp

Download

memory/4964-181-0x000000001B0B0000-0x000000001B0C2000-memory.dmp

Download