dcrat | db831bd29c0acfbc69b882388d8b074081b8008dfdba99f8e04eb54374d06cd5

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3fb209d74252ea949ad3952762374292.exe
Size 1.3MB
Sample240528-ml2j5aff8v
SHA256 db831bd29c0acfbc69b882388d8b074081b8008dfdba99f8e04eb54374d06cd5
MD5 3fb209d74252ea949ad3952762374292
SHA1 e792a5d7fb37073160a9a47e98c97c4cdcc101c1
SHA512 b7504632f6faf5b04f36b59dd27549a3ece8a5d817d2781c6824cd6e00778d329b61bf61c21bb5cb65bb3058b24c81074665052e3ea9a15f9a7846437df755ff
SSDEEP 24576:OO1bN+/W/YyGo7t1SNhoxVX88Nk8Z8XAV4CBk/9WrvFm8lWgQBVxz:O7WMoJ57kk8w+HwjFm8W/D
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4548	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3896	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3240	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3676	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1028	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3504	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3816	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	4932	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	4932	schtasks.exe	81

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3fb209d74252ea949ad3952762374292.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3fb209d74252ea949ad3952762374292.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3fb209d74252ea949ad3952762374292.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4764-1-0x0000000000940000-0x0000000000AA0000-memory.dmp	dcrat
behavioral2/files/0x00070000000233eb-19.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	3fb209d74252ea949ad3952762374292.exe

Executes dropped EXE 1 IoCs

pid	Process
1800	dllhost.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3fb209d74252ea949ad3952762374292.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3fb209d74252ea949ad3952762374292.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\22eafd247d37c3	3fb209d74252ea949ad3952762374292.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\upfc.exe	3fb209d74252ea949ad3952762374292.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\ea1d8f6d871115	3fb209d74252ea949ad3952762374292.exe
File created	C:\Program Files (x86)\Common Files\System\es-ES\SppExtComObj.exe	3fb209d74252ea949ad3952762374292.exe
File created	C:\Program Files (x86)\Common Files\System\es-ES\e1ef82546f0b02	3fb209d74252ea949ad3952762374292.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\dllhost.exe	3fb209d74252ea949ad3952762374292.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\5940a34987c991	3fb209d74252ea949ad3952762374292.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\TextInputHost.exe	3fb209d74252ea949ad3952762374292.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\OCR\en-us\Registry.exe	3fb209d74252ea949ad3952762374292.exe
File created	C:\Windows\Panther\setup.exe\RuntimeBroker.exe	3fb209d74252ea949ad3952762374292.exe
File created	C:\Windows\Panther\setup.exe\9e8d7a4ca61bd9	3fb209d74252ea949ad3952762374292.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3664	schtasks.exe
5092	schtasks.exe
3240	schtasks.exe
4392	schtasks.exe
4772	schtasks.exe
4696	schtasks.exe
1700	schtasks.exe
1208	schtasks.exe
4548	schtasks.exe
3896	schtasks.exe
1956	schtasks.exe
3504	schtasks.exe
3816	schtasks.exe
4948	schtasks.exe
4504	schtasks.exe
2860	schtasks.exe
1896	schtasks.exe
3676	schtasks.exe
3624	schtasks.exe
1028	schtasks.exe
1652	schtasks.exe
1016	schtasks.exe
2940	schtasks.exe
1572	schtasks.exe
2116	schtasks.exe
3908	schtasks.exe
3016	schtasks.exe
4608	schtasks.exe
2376	schtasks.exe
4968	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	3fb209d74252ea949ad3952762374292.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4764	3fb209d74252ea949ad3952762374292.exe
4764	3fb209d74252ea949ad3952762374292.exe
4764	3fb209d74252ea949ad3952762374292.exe
4764	3fb209d74252ea949ad3952762374292.exe
4764	3fb209d74252ea949ad3952762374292.exe
4764	3fb209d74252ea949ad3952762374292.exe
4764	3fb209d74252ea949ad3952762374292.exe
4764	3fb209d74252ea949ad3952762374292.exe
4764	3fb209d74252ea949ad3952762374292.exe
4764	3fb209d74252ea949ad3952762374292.exe
4764	3fb209d74252ea949ad3952762374292.exe
4764	3fb209d74252ea949ad3952762374292.exe
4764	3fb209d74252ea949ad3952762374292.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe
1800	dllhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	3fb209d74252ea949ad3952762374292.exe
Token: SeDebugPrivilege	1800	dllhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 3088	4764	3fb209d74252ea949ad3952762374292.exe	112
PID 4764 wrote to memory of 3088	4764	3fb209d74252ea949ad3952762374292.exe	112
PID 3088 wrote to memory of 4456	3088	cmd.exe	114
PID 3088 wrote to memory of 4456	3088	cmd.exe	114
PID 3088 wrote to memory of 1800	3088	cmd.exe	118
PID 3088 wrote to memory of 1800	3088	cmd.exe	118

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3fb209d74252ea949ad3952762374292.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3fb209d74252ea949ad3952762374292.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3fb209d74252ea949ad3952762374292.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3fb209d74252ea949ad3952762374292.exe
"C:\Users\Admin\AppData\Local\Temp\3fb209d74252ea949ad3952762374292.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9aM8HtMLY2.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4456
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\dllhost.exe
    "C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\dllhost.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\All Users\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\Panther\setup.exe\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Panther\setup.exe\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\Panther\setup.exe\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\Gadgets\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Gadgets\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\System\es-ES\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\es-ES\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\System\es-ES\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

backgroundTaskHost.exe

Path C:\Recovery\WindowsRE\backgroundTaskHost.exe
Size 1.3MB
SHA256 db831bd29c0acfbc69b882388d8b074081b8008dfdba99f8e04eb54374d06cd5
MD5 3fb209d74252ea949ad3952762374292
SHA1 e792a5d7fb37073160a9a47e98c97c4cdcc101c1
SHA512 b7504632f6faf5b04f36b59dd27549a3ece8a5d817d2781c6824cd6e00778d329b61bf61c21bb5cb65bb3058b24c81074665052e3ea9a15f9a7846437df755ff
SSDEEP 24576:OO1bN+/W/YyGo7t1SNhoxVX88Nk8Z8XAV4CBk/9WrvFm8lWgQBVxz:O7WMoJ57kk8w+HwjFm8W/D
MD5 SHA1 SHA512 SSDEEP

Submit Download

9aM8HtMLY2.bat

Path C:\Users\Admin\AppData\Local\Temp\9aM8HtMLY2.bat
Size 246B
SHA256 277480fd176c7e9ab7fc03914440d42bde9a38eff14ef733087e0c91b6666a2e
MD5 4e8e41b82243d538901a8e1e89571efa
SHA1 90200541865eeb370d2526474250daae3ba15615
SHA512 46bfe58750dab4c419357266fa6fa566b8fa3e7b1db856e36fab199e2f0d2e5edbfa8684ec81371b159b9e989ea3a6eaa4a558e81e7475bcb2bedb0e7f8711d2
MD5 SHA1 SHA512

Submit Download

memory/4764-5-0x0000000002D10000-0x0000000002D26000-memory.dmp

Download

memory/4764-3-0x00000000013F0000-0x000000000140C000-memory.dmp

Download

memory/4764-4-0x000000001BC70000-0x000000001BCC0000-memory.dmp

Download

memory/4764-6-0x0000000001380000-0x000000000138A000-memory.dmp

Download

memory/4764-0-0x00007FFE14C73000-0x00007FFE14C75000-memory.dmp

Download

memory/4764-7-0x0000000001410000-0x000000000141C000-memory.dmp

Download

memory/4764-8-0x0000000002D30000-0x0000000002D3C000-memory.dmp

Download

memory/4764-9-0x000000001BC20000-0x000000001BC2C000-memory.dmp

Download

memory/4764-10-0x000000001BC30000-0x000000001BC3C000-memory.dmp

Download

memory/4764-2-0x00007FFE14C70000-0x00007FFE15731000-memory.dmp

Download

memory/4764-36-0x00007FFE14C70000-0x00007FFE15731000-memory.dmp

Download

memory/4764-1-0x0000000000940000-0x0000000000AA0000-memory.dmp

Download