dcrat | 09bbdf5b842a244123b81ba715cd80776f83fcff31994a07376112e3524135c5

Analysis

max time kernel
134s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 11:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
15c730b69a961a70a764d6c103c8103d.exe
Size 2.8MB
Sample240602-njt8pscc95
SHA256 09bbdf5b842a244123b81ba715cd80776f83fcff31994a07376112e3524135c5
MD5 15c730b69a961a70a764d6c103c8103d
SHA1 8ab55ae4b0f5c3fca54b3d28f84bde5e6bf0aef8
SHA512 5077678ca04b268d9ed1a872744731c3cd1ed8111bd303b8343e072889635e1a0297935b4547e22e1faf91616e5f82bbdb111bf1522482fe452f4bf3dfaed028
SSDEEP 49152:ybA3ndI5sas0QmyluVk0fFEfGxe0CvSNlckd0hrXq8hil:ybL5sasSoGTaL0CvSf7E3E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4260	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1028	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3372	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	516	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3520	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3712	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	4644	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	4644	schtasks.exe	92

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperperfCrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperperfCrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperperfCrt.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x00070000000233ce-10.dat	dcrat
behavioral2/memory/2980-13-0x0000000000C60000-0x0000000000EE0000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	15c730b69a961a70a764d6c103c8103d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	hyperperfCrt.exe

Executes dropped EXE 2 IoCs

pid	Process
2980	hyperperfCrt.exe
5004	taskhostw.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hyperperfCrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperperfCrt.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fi-FI\winlogon.exe	hyperperfCrt.exe
File created	C:\Windows\SysWOW64\fi-FI\cc11b995f2a76d	hyperperfCrt.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsPowerShell\Modules\taskhostw.exe	hyperperfCrt.exe
File created	C:\Program Files\WindowsPowerShell\Modules\ea9f0e6c9e2dcd	hyperperfCrt.exe
File created	C:\Program Files\Uninstall Information\RuntimeBroker.exe	hyperperfCrt.exe
File created	C:\Program Files\Uninstall Information\9e8d7a4ca61bd9	hyperperfCrt.exe
File created	C:\Program Files\Google\RuntimeBroker.exe	hyperperfCrt.exe
File created	C:\Program Files\Google\9e8d7a4ca61bd9	hyperperfCrt.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Provisioning\Packages\RuntimeBroker.exe	hyperperfCrt.exe
File created	C:\Windows\Provisioning\Packages\9e8d7a4ca61bd9	hyperperfCrt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4980	schtasks.exe
1548	schtasks.exe
3152	schtasks.exe
4048	schtasks.exe
3756	schtasks.exe
4940	schtasks.exe
3584	schtasks.exe
2456	schtasks.exe
2540	schtasks.exe
1012	schtasks.exe
2284	schtasks.exe
1028	schtasks.exe
2044	schtasks.exe
3112	schtasks.exe
4976	schtasks.exe
824	schtasks.exe
3232	schtasks.exe
876	schtasks.exe
4508	schtasks.exe
3372	schtasks.exe
516	schtasks.exe
2004	schtasks.exe
3648	schtasks.exe
3520	schtasks.exe
1592	schtasks.exe
4260	schtasks.exe
1984	schtasks.exe
2384	schtasks.exe
3468	schtasks.exe
4484	schtasks.exe
4972	schtasks.exe
2332	schtasks.exe
3144	schtasks.exe
2428	schtasks.exe
3712	schtasks.exe
692	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	15c730b69a961a70a764d6c103c8103d.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	hyperperfCrt.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2980	hyperperfCrt.exe
2980	hyperperfCrt.exe
2980	hyperperfCrt.exe
2980	hyperperfCrt.exe
2980	hyperperfCrt.exe
5004	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	hyperperfCrt.exe
Token: SeDebugPrivilege	5004	taskhostw.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 768	1576	15c730b69a961a70a764d6c103c8103d.exe	82
PID 1576 wrote to memory of 768	1576	15c730b69a961a70a764d6c103c8103d.exe	82
PID 1576 wrote to memory of 768	1576	15c730b69a961a70a764d6c103c8103d.exe	82
PID 768 wrote to memory of 2128	768	WScript.exe	86
PID 768 wrote to memory of 2128	768	WScript.exe	86
PID 768 wrote to memory of 2128	768	WScript.exe	86
PID 2128 wrote to memory of 2980	2128	cmd.exe	88
PID 2128 wrote to memory of 2980	2128	cmd.exe	88
PID 2980 wrote to memory of 2396	2980	hyperperfCrt.exe	129
PID 2980 wrote to memory of 2396	2980	hyperperfCrt.exe	129
PID 2396 wrote to memory of 1992	2396	cmd.exe	132
PID 2396 wrote to memory of 1992	2396	cmd.exe	132
PID 2396 wrote to memory of 5004	2396	cmd.exe	134
PID 2396 wrote to memory of 5004	2396	cmd.exe	134

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperperfCrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperperfCrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperperfCrt.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\15c730b69a961a70a764d6c103c8103d.exe
"C:\Users\Admin\AppData\Local\Temp\15c730b69a961a70a764d6c103c8103d.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Hyperprovider\bE4uo01WJ5U.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Hyperprovider\OO78aMqZUi.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Hyperprovider\hyperperfCrt.exe
      "C:\Hyperprovider\hyperperfCrt.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2980
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PZ0xuLrcDj.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2396
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1992
      - C:\Program Files\WindowsPowerShell\Modules\taskhostw.exe
        
        "C:\Program Files\WindowsPowerShell\Modules\taskhostw.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Windows\SysWOW64\fi-FI\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\SysWOW64\fi-FI\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Windows\SysWOW64\fi-FI\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Google\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Google\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Hyperprovider\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Hyperprovider\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Hyperprovider\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files\WindowsPowerShell\Modules\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\Modules\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\Provisioning\Packages\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Provisioning\Packages\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\Provisioning\Packages\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Hyperprovider\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Hyperprovider\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Hyperprovider\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OO78aMqZUi.bat

Path C:\Hyperprovider\OO78aMqZUi.bat
Size 35B
SHA256 a1bf4281d5264e880cfd2797128bf3c2580cc932e25b6b0b11231ed82fae10ce
MD5 b203b1ede424b043c3069d4b4c68d401
SHA1 adaa6558386566c10409189223685d2bdda341d5
SHA512 427dbb26a65395a986a37e5bfe89b8c9aa036e13647b7a0226ed94457005d24c12464ec43424670dae423303a6f672aaf462262cd14aed4afad283e1fb722d8c
MD5 SHA1 SHA512

Submit Download

bE4uo01WJ5U.vbe

Path C:\Hyperprovider\bE4uo01WJ5U.vbe
Size 200B
SHA256 623dc862c3925aa7940e863a34fd1aa15be6f9a50a012c3a855327aadb55bc64
MD5 5c444cdae370b8408b5fe63f95630243
SHA1 05621a3355d8ff69cfc0f080f31301b11f2839cc
SHA512 dbb3c63716576c89dd00e4941b403cb0d1610df38ebcde993062aa255f4bf7e7f6a4045f3f48c7ce898cb816c7b056def42d4a132fdf79319bf07a48f94d5fc0
MD5 SHA1 SHA512

Submit Download

hyperperfCrt.exe

Path C:\Hyperprovider\hyperperfCrt.exe
Size 2.5MB
SHA256 32f71ef21a67f318a02518229fa4db7587b6bf021544df3082dcf888c4e49fad
MD5 408488c893d0f6e7109deba33570a2eb
SHA1 6dbe802ae2353b0ecb2ace47d16af8fd5cf23403
SHA512 084f027323473f59e00007f73f0ebd5c82c1882255f0307de72865881cb74c748f78306b280d218dbd8dfbd02dbc26aa5a8656d025baf139dd53f89b9fa3d13b
SSDEEP 49152:4I5sas0QmyluVk0fFEfGxe0CvSNlckd0hrXq8hi:D5sasSoGTaL0CvSf7E3
MD5 SHA1 SHA512 SSDEEP

Submit Download

PZ0xuLrcDj.bat

Path C:\Users\Admin\AppData\Local\Temp\PZ0xuLrcDj.bat
Size 221B
SHA256 7a76599a94f2dd844141ad28dd165bb18f3b58c03d8d796e7d630aec76116230
MD5 99774140e12273ee0a4d6c995cfc4c55
SHA1 d1ecddf3ae15a567edd79094af430366a011165e
SHA512 f15cc58e3963234a46df10d12adccc2e71123ab26f1c267024ad6beb3c55893fe4f730ec765e03c2c5612d17ac76055c5eca5b61a4a20e89b6809b81eb3e3f9c
MD5 SHA1 SHA512

Submit Download

memory/2980-17-0x0000000001820000-0x0000000001828000-memory.dmp

Download

memory/2980-22-0x000000001C110000-0x000000001C166000-memory.dmp

Download

memory/2980-15-0x0000000001800000-0x000000000181C000-memory.dmp

Download

memory/2980-19-0x0000000003150000-0x0000000003158000-memory.dmp

Download

memory/2980-18-0x0000000003130000-0x0000000003146000-memory.dmp

Download

memory/2980-20-0x0000000003180000-0x000000000318C000-memory.dmp

Download

memory/2980-13-0x0000000000C60000-0x0000000000EE0000-memory.dmp

Download

memory/2980-16-0x000000001C0C0000-0x000000001C110000-memory.dmp

Download

memory/2980-21-0x0000000003160000-0x000000000316A000-memory.dmp

Download

memory/2980-14-0x0000000001690000-0x0000000001698000-memory.dmp

Download

memory/2980-23-0x0000000003170000-0x000000000317C000-memory.dmp

Download

memory/2980-24-0x00000000031A0000-0x00000000031B2000-memory.dmp

Download

memory/2980-25-0x000000001CA70000-0x000000001CF98000-memory.dmp

Download

memory/2980-26-0x000000001C160000-0x000000001C16E000-memory.dmp

Download

memory/2980-27-0x000000001C170000-0x000000001C17C000-memory.dmp

Download

memory/2980-12-0x00007FFB42A83000-0x00007FFB42A85000-memory.dmp

Download

memory/5004-61-0x000000001B460000-0x000000001B472000-memory.dmp

Download