dcrat | 5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
Size 3.0MB
Sample240530-ca144sbc57
SHA256 5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052
MD5 06d247f5cee1e9380b7cff8cfa4cdb70
SHA1 fa12163a5c3cff690d5bff9696a68a9df0789c8c
SHA512 c5e7013c86405be9d8fe3aa2b732092b3e6f58f7ae84fe51ac5b0dd7a363fc5458b1bed3fe0f81cfa168df272e62c0d0ad16965a71cbef9439d1403a3f37d0c3
SSDEEP 49152:wZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:k7ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3480	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3768	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3432	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3180	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4100	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4172	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3740	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3280	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	440	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	1084	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3556	1084	schtasks.exe	88

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1484-13-0x0000000000400000-0x0000000000648000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3544	powershell.exe
1948	powershell.exe
1644	powershell.exe
4364	powershell.exe
2568	powershell.exe
2180	powershell.exe
3168	powershell.exe
4196	powershell.exe
4400	powershell.exe
3608	powershell.exe
3128	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	csrss.exe

Executes dropped EXE 6 IoCs

pid	Process
4948	csrss.exe
4856	csrss.exe
1680	csrss.exe
3592	csrss.exe
3644	csrss.exe
464	csrss.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	ip-api.com
30	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 396 set thread context of 1484	396	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	94
PID 4948 set thread context of 1680	4948	csrss.exe	171
PID 3592 set thread context of 464	3592	csrss.exe	176

Drops file in Program Files directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\9e8d7a4ca61bd9	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files\dotnet\RCXC29.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\RCX18F5.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Program Files (x86)\WindowsPowerShell\csrss.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Program Files\Common Files\System\de-DE\spoolsv.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\RCX3B6.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RCX6F5.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\RCX1877.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\csrss.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Program Files (x86)\Microsoft.NET\WmiPrvSE.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RCX25F0.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RCX2562.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\0a1fd5f707cd16	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\dllhost.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Program Files\dotnet\RuntimeBroker.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Program Files\dotnet\9e8d7a4ca61bd9	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\RCX4A2.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\WmiPrvSE.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\5940a34987c991	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Program Files\Common Files\System\de-DE\f3b6ecef712a24	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Program Files\Windows Security\BrowserCore\886983d96e3d3e	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files\Common Files\System\de-DE\spoolsv.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\dllhost.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files\dotnet\RuntimeBroker.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Program Files\Windows Security\BrowserCore\csrss.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Program Files (x86)\WindowsPowerShell\886983d96e3d3e	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RCX6E5.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files\dotnet\RCXBCB.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files\Common Files\System\de-DE\RCXEAB.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files\Common Files\System\de-DE\RCXEAC.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\RCX1362.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Program Files (x86)\Microsoft.NET\24dbde2999530e	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\csrss.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\RCX13E0.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\IdentityCRL\production\SppExtComObj.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Windows\IdentityCRL\production\RCX1E29.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Windows\ServiceState\SEMgrSvc\lsass.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Windows\ImmersiveControlPanel\images\9e8d7a4ca61bd9	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Windows\twain_32\38384e6a620884	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\images\RCX113D.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Windows\IdentityCRL\production\SppExtComObj.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Windows\IdentityCRL\production\e1ef82546f0b02	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\images\RCX114E.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Windows\ImmersiveControlPanel\images\RuntimeBroker.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File created	C:\Windows\twain_32\SearchApp.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\images\RuntimeBroker.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Windows\twain_32\RCX1AFA.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Windows\twain_32\RCX1B78.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Windows\twain_32\SearchApp.exe	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
File opened for modification	C:\Windows\IdentityCRL\production\RCX1DAB.tmp	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5008	schtasks.exe
2588	schtasks.exe
3432	schtasks.exe
2124	schtasks.exe
3460	schtasks.exe
4628	schtasks.exe
3760	schtasks.exe
3948	schtasks.exe
1680	schtasks.exe
3292	schtasks.exe
4100	schtasks.exe
4172	schtasks.exe
212	schtasks.exe
1640	schtasks.exe
4872	schtasks.exe
3808	schtasks.exe
3480	schtasks.exe
3768	schtasks.exe
3180	schtasks.exe
3944	schtasks.exe
4584	schtasks.exe
1800	schtasks.exe
3556	schtasks.exe
2056	schtasks.exe
4836	schtasks.exe
1368	schtasks.exe
4188	schtasks.exe
4520	schtasks.exe
3508	schtasks.exe
1092	schtasks.exe
4580	schtasks.exe
3640	schtasks.exe
3052	schtasks.exe
3280	schtasks.exe
440	schtasks.exe
2940	schtasks.exe
216	schtasks.exe
4256	schtasks.exe
1884	schtasks.exe
1432	schtasks.exe
4844	schtasks.exe
3740	schtasks.exe
4824	schtasks.exe
3008	schtasks.exe
2716	schtasks.exe
1076	schtasks.exe
3596	schtasks.exe
2612	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe

Suspicious behavior: EnumeratesProcesses 59 IoCs

pid	Process
396	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
396	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
3544	powershell.exe
3544	powershell.exe
4196	powershell.exe
4196	powershell.exe
3128	powershell.exe
3128	powershell.exe
4364	powershell.exe
4364	powershell.exe
3168	powershell.exe
3168	powershell.exe
3608	powershell.exe
3608	powershell.exe
1644	powershell.exe
1644	powershell.exe
1948	powershell.exe
1948	powershell.exe
4400	powershell.exe
4400	powershell.exe
2568	powershell.exe
2568	powershell.exe
2180	powershell.exe
2180	powershell.exe
3544	powershell.exe
4196	powershell.exe
4400	powershell.exe
3168	powershell.exe
2568	powershell.exe
3128	powershell.exe
2180	powershell.exe
1948	powershell.exe
4364	powershell.exe
3608	powershell.exe
1644	powershell.exe
4948	csrss.exe
4948	csrss.exe
1680	csrss.exe
1680	csrss.exe
1680	csrss.exe
1680	csrss.exe
1680	csrss.exe
3592	csrss.exe
3592	csrss.exe
464	csrss.exe
464	csrss.exe
464	csrss.exe
464	csrss.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	396	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
Token: SeDebugPrivilege	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
Token: SeDebugPrivilege	3544	powershell.exe
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	3128	powershell.exe
Token: SeDebugPrivilege	4364	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeDebugPrivilege	3608	powershell.exe
Token: SeDebugPrivilege	1644	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	4948	csrss.exe
Token: SeDebugPrivilege	1680	csrss.exe
Token: SeDebugPrivilege	3592	csrss.exe
Token: SeDebugPrivilege	464	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 2000	396	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	93
PID 396 wrote to memory of 2000	396	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	93
PID 396 wrote to memory of 2000	396	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	93
PID 396 wrote to memory of 1484	396	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	94
PID 396 wrote to memory of 1484	396	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	94
PID 396 wrote to memory of 1484	396	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	94
PID 396 wrote to memory of 1484	396	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	94
PID 396 wrote to memory of 1484	396	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	94
PID 396 wrote to memory of 1484	396	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	94
PID 396 wrote to memory of 1484	396	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	94
PID 396 wrote to memory of 1484	396	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	94
PID 1484 wrote to memory of 4400	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	143
PID 1484 wrote to memory of 4400	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	143
PID 1484 wrote to memory of 4400	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	143
PID 1484 wrote to memory of 4196	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	144
PID 1484 wrote to memory of 4196	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	144
PID 1484 wrote to memory of 4196	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	144
PID 1484 wrote to memory of 3168	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	145
PID 1484 wrote to memory of 3168	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	145
PID 1484 wrote to memory of 3168	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	145
PID 1484 wrote to memory of 3608	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	146
PID 1484 wrote to memory of 3608	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	146
PID 1484 wrote to memory of 3608	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	146
PID 1484 wrote to memory of 3544	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	147
PID 1484 wrote to memory of 3544	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	147
PID 1484 wrote to memory of 3544	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	147
PID 1484 wrote to memory of 4364	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	149
PID 1484 wrote to memory of 4364	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	149
PID 1484 wrote to memory of 4364	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	149
PID 1484 wrote to memory of 2180	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	150
PID 1484 wrote to memory of 2180	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	150
PID 1484 wrote to memory of 2180	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	150
PID 1484 wrote to memory of 1644	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	151
PID 1484 wrote to memory of 1644	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	151
PID 1484 wrote to memory of 1644	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	151
PID 1484 wrote to memory of 2568	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	152
PID 1484 wrote to memory of 2568	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	152
PID 1484 wrote to memory of 2568	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	152
PID 1484 wrote to memory of 3128	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	153
PID 1484 wrote to memory of 3128	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	153
PID 1484 wrote to memory of 3128	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	153
PID 1484 wrote to memory of 1948	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	154
PID 1484 wrote to memory of 1948	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	154
PID 1484 wrote to memory of 1948	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	154
PID 1484 wrote to memory of 1808	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	165
PID 1484 wrote to memory of 1808	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	165
PID 1484 wrote to memory of 1808	1484	5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe	165
PID 1808 wrote to memory of 2588	1808	cmd.exe	167
PID 1808 wrote to memory of 2588	1808	cmd.exe	167
PID 1808 wrote to memory of 2588	1808	cmd.exe	167
PID 2588 wrote to memory of 1680	2588	w32tm.exe	168
PID 2588 wrote to memory of 1680	2588	w32tm.exe	168
PID 1808 wrote to memory of 4948	1808	cmd.exe	169
PID 1808 wrote to memory of 4948	1808	cmd.exe	169
PID 1808 wrote to memory of 4948	1808	cmd.exe	169
PID 4948 wrote to memory of 4856	4948	csrss.exe	170
PID 4948 wrote to memory of 4856	4948	csrss.exe	170
PID 4948 wrote to memory of 4856	4948	csrss.exe	170
PID 4948 wrote to memory of 1680	4948	csrss.exe	171
PID 4948 wrote to memory of 1680	4948	csrss.exe	171
PID 4948 wrote to memory of 1680	4948	csrss.exe	171
PID 4948 wrote to memory of 1680	4948	csrss.exe	171
PID 4948 wrote to memory of 1680	4948	csrss.exe	171
PID 4948 wrote to memory of 1680	4948	csrss.exe	171

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
"C:\Users\Admin\AppData\Local\Temp\5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:396
- C:\Users\Admin\AppData\Local\Temp\5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
  "C:\Users\Admin\AppData\Local\Temp\5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe"
  2⤵
  PID:2000
- C:\Users\Admin\AppData\Local\Temp\5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe
  "C:\Users\Admin\AppData\Local\Temp\5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4400
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4196
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3168
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3608
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3544
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2180
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1644
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3128
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1948
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aGjaybPuf4.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Windows\SysWOW64\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2588
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:1680
  - - C:\Program Files\Windows Security\BrowserCore\csrss.exe
      "C:\Program Files\Windows Security\BrowserCore\csrss.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4948
    - - C:\Program Files\Windows Security\BrowserCore\csrss.exe
        
        "C:\Program Files\Windows Security\BrowserCore\csrss.exe"
        5⤵
        Executes dropped EXE
        
        PID:4856
    - - C:\Program Files\Windows Security\BrowserCore\csrss.exe
        
        "C:\Program Files\Windows Security\BrowserCore\csrss.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a2a56cff-ae2c-453a-8ec7-eb5239e7d57a.vbs"
        6⤵
        
        PID:4304
        
        C:\Program Files\Windows Security\BrowserCore\csrss.exe
        
        "C:\Program Files\Windows Security\BrowserCore\csrss.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3592
        
        C:\Program Files\Windows Security\BrowserCore\csrss.exe
        
        "C:\Program Files\Windows Security\BrowserCore\csrss.exe"
        8⤵
        Executes dropped EXE
        
        PID:3644
        
        C:\Program Files\Windows Security\BrowserCore\csrss.exe
        
        "C:\Program Files\Windows Security\BrowserCore\csrss.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:464
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc77a11c-2cb1-4d05-9cc1-4adcb18dbbc8.vbs"
        6⤵
        
        PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 7 /tr "'C:\Users\Public\AccountPictures\MoUsoCoreWorker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\dotnet\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\dotnet\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\dotnet\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\System\de-DE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Common Files\System\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\System\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\ImmersiveControlPanel\images\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\images\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\ImmersiveControlPanel\images\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Security\BrowserCore\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\BrowserCore\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\WindowsPowerShell\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Windows\twain_32\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\twain_32\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Windows\twain_32\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Windows\IdentityCRL\production\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\production\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Windows\IdentityCRL\production\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Documents\My Pictures\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\Documents\My Pictures\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Documents\My Pictures\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\dotnet\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\dotnet\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\dotnet\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

csrss.exe

Path C:\Program Files (x86)\WindowsPowerShell\csrss.exe
Size 3.0MB
SHA256 1e2ea0e6de416419531fcd19a3ac33c5e82b6466141d0e0c3582370ffbbb6f38
MD5 f3943cfd2c2bb8f4e3c2fe060e22a2ce
SHA1 fa9e0bfa09677d72cfdafc7c34fcf4481e417d47
SHA512 cc8ce3b364127dcaed68af1426efda4d26966938e8db03354acd11effe61dd2f0abe5ef4c64568eb7ea6d8a2fc43091f858305689203908e60ce48b11810e872
SSDEEP 49152:QZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:E7ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Program Files\Common Files\System\de-DE\spoolsv.exe
Size 3.0MB
SHA256 5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052
MD5 06d247f5cee1e9380b7cff8cfa4cdb70
SHA1 fa12163a5c3cff690d5bff9696a68a9df0789c8c
SHA512 c5e7013c86405be9d8fe3aa2b732092b3e6f58f7ae84fe51ac5b0dd7a363fc5458b1bed3fe0f81cfa168df272e62c0d0ad16965a71cbef9439d1403a3f37d0c3
SSDEEP 49152:wZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:k7ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

sppsvc.exe

Path C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
Size 3.0MB
SHA256 90024b3a9c03e692e29d0067aa8c71790355e84b4bf8a7f2cfa9461b09fc9f5e
MD5 782b71c26c3750fe8291f5d80d73f10a
SHA1 707600d3d975bc3ab1fd229d7f5713d5bd718fdf
SHA512 b41aae8abe545cace207c05fe6f2657e4d0d2cfd2df9548fc2fecb9fa0731e08c9fc83b2b04148efeef0442daee6fb5a7eb99c046d4bf41526b53fad9c585b1d
SSDEEP 49152:AZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:07ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Program Files\Windows Security\BrowserCore\csrss.exe
Size 3.0MB
SHA256 b9c5fbbc185f59789394019bce20e73e83f94356f3b5fa9c2abb5488226d9675
MD5 5ef94ffef7ed99b26f709d4c2beafdc4
SHA1 13f0e1af146b18b105d881fd2f5d3cf9b06a39ab
SHA512 25ac6ca760784f1e5f2e4afa5512d906b00f8d0203c8da1696864dad217a5e0af88ee64609659561b8d8536f0c5f250bdd903a22087ec5c685e0e561b6da3760
SSDEEP 49152:AZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:07ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\ProgramData\csrss.exe
Size 3.0MB
SHA256 f7e5a60b17060cda7ed0f79c9697af754321ea7e31e76b3cb33976dbed734d41
MD5 cd2b346c4ea1cf21f6dc448910b5ee5b
SHA1 831ced21b8138316634a53476a594ef041296daa
SHA512 ebd07ec5508b24481a6d2ec758ea27323b70adbbf0c962d2b3207bc4f17b369a89364ec1f5631fc603c4d0638aa3726f06f3d9d304c53007e37c169af366f82a
SSDEEP 49152:QZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:E7ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5f6b62b2a3a5ffe059fde9ac3de656a5aac60d50674e5f2f14e61d3d72443052.exe.log
Size 1KB
SHA256 1ad8f00e485dbebe5a1f40f60b9e588e6563c4feef20b8134f335b3e16208dc3
MD5 95b0eabd8c9c516fc2d8632ff8f4dc10
SHA1 8118b2b54184a5add848198f36a905b9a511940e
SHA512 60147da0bc922f18e2eeae00dc7dda1caa432df6ed0f853cd4757535bf371536902c1ce1bc40db167540bbc79dedf9a742498fab5bafcbd1053c4b2dd9c79e62
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
MD5 SHA1 SHA512

Submit Download