dcrat | a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4

Analysis

max time kernel
0s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe
Size 1.5MB
Sample240606-exe69shd89
SHA256 a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4
MD5 68ac4f5ddbe458944d1f7d566eaaadf4
SHA1 58f70a8ba29ae9354877a2dbcec1710b6d722f43
SHA512 2a55a068f9b8d24c6275f9182a2f58d780a6d36950a25ae86529216e9eb0bc3cbf1cc42968b8e08ba885dedded1d623720066f81279f5c23c3b9c27d28b325ae
SSDEEP 24576:Mbr+gVR+pFfepH7vQ53zkDETdNYT/19GNPD3vKi5bQvrlFjAL2s:MbtRkFZcraN/xQj/j
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\System\\taskhostw.exe\""	a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2200-0-0x00000000005A0000-0x0000000000724000-memory.dmp	dcrat
behavioral2/files/0x0007000000023426-23.dat	dcrat
behavioral2/files/0x0007000000023419-225.dat	dcrat

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral2/memory/2200-6-0x00000000010E0000-0x00000000010F0000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2200-9-0x000000001B8B0000-0x000000001B8BA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2200-14-0x000000001B950000-0x000000001B95A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2200-13-0x000000001B8F0000-0x000000001B8FA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2200-11-0x000000001B8D0000-0x000000001B8DC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files (x86)\\Common Files\\System\\taskhostw.exe\""	a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files (x86)\\Common Files\\System\\taskhostw.exe\""	a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\System\taskhostw.exe	a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe
File created	C:\Program Files (x86)\Common Files\System\ea9f0e6c9e2dcd	a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe
File created	C:\Program Files (x86)\Common Files\System\taskhostw.exe	a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe

Creates scheduled task(s) 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1360	schtasks.exe
1488	schtasks.exe
3092	schtasks.exe
540	schtasks.exe
3552	schtasks.exe
3240	schtasks.exe
5048	schtasks.exe
2248	schtasks.exe
4900	schtasks.exe
3000	schtasks.exe
3192	schtasks.exe
4824	schtasks.exe
3088	schtasks.exe
1020	schtasks.exe
5044	schtasks.exe
4088	schtasks.exe
1832	schtasks.exe
2768	schtasks.exe
3600	schtasks.exe
2304	schtasks.exe
624	schtasks.exe
1304	schtasks.exe
1524	schtasks.exe
3476	schtasks.exe
4356	schtasks.exe
5076	schtasks.exe
2432	schtasks.exe
2936	schtasks.exe
3380	schtasks.exe
3328	schtasks.exe
2460	schtasks.exe
3928	schtasks.exe
4400	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2200	a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe
"C:\Users\Admin\AppData\Local\Temp\a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2200
- C:\Recovery\WindowsRE\Registry.exe
  "C:\Recovery\WindowsRE\Registry.exe"
  2⤵
  PID:744
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e1da9516-f19e-4c4d-a9a3-07403ec563db.vbs"
    3⤵
    PID:3932
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8a27df9b-408d-4a2f-9685-f36eca84dc79.vbs"
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:13024/
    3⤵
    PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff987c146f8,0x7ff987c14708,0x7ff987c14718
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,12777731139521619240,15879224788360146784,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,12777731139521619240,15879224788360146784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,12777731139521619240,15879224788360146784,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12777731139521619240,15879224788360146784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
      4⤵
      PID:1968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12777731139521619240,15879224788360146784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12777731139521619240,15879224788360146784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12777731139521619240,15879224788360146784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,12777731139521619240,15879224788360146784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 /prefetch:8
      4⤵
      PID:3192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,12777731139521619240,15879224788360146784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 /prefetch:8
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12777731139521619240,15879224788360146784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12777731139521619240,15879224788360146784,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
      4⤵
      PID:1484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12777731139521619240,15879224788360146784,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12777731139521619240,15879224788360146784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12777731139521619240,15879224788360146784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
      4⤵
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12777731139521619240,15879224788360146784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
      4⤵
      PID:640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,12777731139521619240,15879224788360146784,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
      4⤵
      PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\System\taskhostw.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\System\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Security\BrowserCore\unsecapp.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\BrowserCore\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\System.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\System.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\System.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4a" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4" /sc ONLOGON /tr "'C:\Users\Admin\a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4a" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\Public\dwm.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\dwm.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\Public\dwm.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4a" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4" /sc ONLOGON /tr "'C:\Program Files\Google\a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4a" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\backgroundTaskHost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Multimedia Platform\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\Registry.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Creates scheduled task(s)
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\dllhost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\dllhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\dllhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX455B.tmp

Path C:\Recovery\WindowsRE\RCX455B.tmp
Size 1.5MB
SHA256 59122fb389c4f619c40d864cf394e46a33336425cd829fdbedfed969f2601229
MD5 656daa75d5a9dfe041e5684094609896
SHA1 a9f10b9815b6ea573466696c8479145848abc7f4
SHA512 388f34cf77979860ec23ac2c43a93ea73b54f7c80ff6d5f9c0ed4259003e9b4fcb9eb001c7364f5bce1f2251d2c0ca4f700c22a603cc1946402850d50191bc35
SSDEEP 24576:sbr+gVR+pFfepH7vQ53zkDETdNYT/19GNPD3vKi5bQvrlFjAL2s:sbtRkFZcraN/xQj/j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Registry.exe

Path C:\Recovery\WindowsRE\Registry.exe
Size 1.5MB
SHA256 a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4
MD5 68ac4f5ddbe458944d1f7d566eaaadf4
SHA1 58f70a8ba29ae9354877a2dbcec1710b6d722f43
SHA512 2a55a068f9b8d24c6275f9182a2f58d780a6d36950a25ae86529216e9eb0bc3cbf1cc42968b8e08ba885dedded1d623720066f81279f5c23c3b9c27d28b325ae
SSDEEP 24576:Mbr+gVR+pFfepH7vQ53zkDETdNYT/19GNPD3vKi5bQvrlFjAL2s:MbtRkFZcraN/xQj/j
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c89aab8c142c9bde87ee14745d72488542eeb58b7db9bfc3e784a71a790bddd9
MD5 07ea4203289d610f7b5ec46a92ebf5ec
SHA1 508ca23417a825eb8b8cda2244d27bf2e8d15fd5
SHA512 73c6d5d2b0c3660e80a541e151f6a32f3adec1e175ca547336cf227f60443557124bc76b83c8238b2641d6ee3dc9cf75a0e4cda1c0193d6402c8be313ebb71fa
SSDEEP 96:nfkC015mga9IQwpvWMoiVmdeHpCrvbXUWQyV+VDCziEwb:nfkbX1aCQGWMXpAbXro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a31b185395deea986736ac042bcce46c49b5ceee8e1a69ed1d08dd81b2f5643b
MD5 868eb998bf51ec87be7bc0d6a411ae4c
SHA1 b1e87e33e99be4d481109f4fadb3db88481412c6
SHA512 a8943772a7378a41bead60149dc98005583143b5505f2200ad5c9bfd144a62fa4549f3c8f666ffdadb17921939b70d46cf5be41f33d2e6337630e4504e74b77e
SSDEEP 96:nfk501pmga9IQwpvWMoiVmdeHpCrvbXUWQyV+VD7AiEwb:nfk+71aCQGWMXpAbXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4940f4fc127d269567d282ea3b4c59fe445287f2ca6ef8279c4d107544bdcf5a
MD5 d8b34011a30925baaca14197a4339a9f
SHA1 1ef218371afe0908015bd6040de5be25c3843074
SHA512 d11910fb75b93559c61f825b150fd1de9d525a88e3b865006223e9069a9cc59b020423f3b4810c68fbe20f769a8217dc1b34367d589e1e1e8ce32474c3994bfd
SSDEEP 96:nfk5015mga9IQwpvWMoiVmdeHpCrvbXUWQyV+VD7AiEwb:nfk+X1aCQGWMXpAbXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 8cfe079dce7e1beea5cb475efcc26a74ac7799a12175072d760d9996d6324ff7
MD5 b7f62f19c7ea99c712801394346a00a6
SHA1 181f57752dbb8c5d30b45e18d8b2ed341014f14b
SHA512 ebb6dcdc3ba47d3e45852fcfe159f3c25d930b9d3408f849f8848f374011034f09897519589a8139420696c7a8475e8d663b94106617466430221d8e527f9b4d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfiTkke2RUcjf7ZV3z2OMDk:A9iIxuERzA83h09RZxYfiTkKbzZVaOMg
MD5 SHA1 SHA512 SSDEEP

Submit Download

8a27df9b-408d-4a2f-9685-f36eca84dc79.vbs

Path C:\Users\Admin\AppData\Local\Temp\8a27df9b-408d-4a2f-9685-f36eca84dc79.vbs
Size 486B
SHA256 b450ff7cae827f633b648589c00ef8c5e9f6f757fe2815b5aff2a04e2ef05adc
MD5 04611bae0dee48a345bf3ff4cbba9ace
SHA1 2cac5ec6c72b79a657f67dca14bc8a1ecc15f435
SHA512 b5529a7b6832191de6fd1bce0efa71ebadce5f3c9f9b895c4d92a8ed95f784513fd74c2830f4bbf4863c1e46354875f1426accf98176f419ebadedf1683d7037
MD5 SHA1 SHA512

Submit Download

e1da9516-f19e-4c4d-a9a3-07403ec563db.vbs

Path C:\Users\Admin\AppData\Local\Temp\e1da9516-f19e-4c4d-a9a3-07403ec563db.vbs
Size 709B
SHA256 f45fee42dcf0d76c0d350e997158228653157b3444d63a43f664b9d490431d52
MD5 8587ca3a100ec9b76af26b86cbba1e51
SHA1 5dcae0604b6bbafc1931b10b27301a9868f91bfd
SHA512 0c63f9b9bd2421b5fc7018171921d0e424dab1b120965810920e4f5c35718f737e41a8663fb4aa0013c997c919e1e811655b0aca8035c6cf88f3ef47b6135031
MD5 SHA1 SHA512

Submit Download

a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe

Path C:\Users\Admin\a8ddb0d617d728e8febc0e375bad9db3176ece41c6e54a9b3a873944e907cfe4.exe
Size 448KB
SHA256 8e554dfb519f0a1961fc96fa7a00f2369ad9a0fefc85fc5fabd46329d933f7a5
MD5 30d2fc7d2b9235d13ef4f21abad55ade
SHA1 f46039dedd36b1c882f9b6943cf34bc4c89486a2
SHA512 8f2d2391b366855c8fb6e18835db5e2500ff7097c51220ee87edfd21f601ee079fed6540513866042091431f7c7ced6be9d8266292c41217238ce410e7ae0d0d
SSDEEP 6144:C4XqM4oPOn0jX7h7WnqqcDKBF+gv3KLMN/INCKVTFD7ek5:koPO00qqxF+g/KARiFpFfek5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/744-313-0x000000001CFA0000-0x000000001D149000-memory.dmp

Download

memory/2200-12-0x000000001B8E0000-0x000000001B8E8000-memory.dmp

Download

memory/2200-13-0x000000001B8F0000-0x000000001B8FA000-memory.dmp

Download

memory/2200-3-0x00000000010B0000-0x00000000010CC000-memory.dmp

Download

memory/2200-10-0x000000001B8C0000-0x000000001B8CC000-memory.dmp

Download

memory/2200-227-0x00007FF98D980000-0x00007FF98E441000-memory.dmp

Download

memory/2200-11-0x000000001B8D0000-0x000000001B8DC000-memory.dmp

Download

memory/2200-8-0x000000001B390000-0x000000001B3A0000-memory.dmp

Download

memory/2200-4-0x000000001B900000-0x000000001B950000-memory.dmp

Download

memory/2200-5-0x00000000010D0000-0x00000000010D8000-memory.dmp

Download

memory/2200-1-0x00007FF98D983000-0x00007FF98D985000-memory.dmp

Download

memory/2200-14-0x000000001B950000-0x000000001B95A000-memory.dmp

Download

memory/2200-7-0x00000000010F0000-0x0000000001106000-memory.dmp

Download

memory/2200-9-0x000000001B8B0000-0x000000001B8BA000-memory.dmp

Download

memory/2200-6-0x00000000010E0000-0x00000000010F0000-memory.dmp

Download

memory/2200-2-0x00007FF98D980000-0x00007FF98E441000-memory.dmp

Download

memory/2200-0-0x00000000005A0000-0x0000000000724000-memory.dmp

Download