dcrat | dbcc1bec2dbc4002cfdade40966eb639ccf4da67a7b9728f444beb1d35ed4f7f

Resubmissions

12-06-2024 08:28

240612-kcy2jawckj 10

10-06-2024 17:27

240610-v1ktxsvbpk 10

Analysis

max time kernel
28s
max time network
36s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
10-06-2024 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mydoom/0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
Size

9.4MB
MD5

813b749967045532f86e6442447bcd8b
SHA1

8d0615e7f7ba672a3fc94c05a9451f9d08797af7
SHA256

0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464
SHA512

47c16f403ab33ebb9e59c7c3a053dc29d0d654174d2be9153966ad9fc873e641f34ab44c7e38fb4c6fd376b384d4e1da0dacafb384e9abb1c7eb92cb32533877
SSDEEP

24576:GYx7SFGwWG8/Ad5kybgeK8uQY2ZqR7NlaDbTxnVhv2MMLdGIhJ:IFFbK8q2ZhDbTNv2MuV

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral4/memory/3824-6-0x0000000000400000-0x0000000000538000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

Processes:

OfficeClickToRun.exeOfficeClickToRun.exe

pid process

1480 OfficeClickToRun.exe
4652 OfficeClickToRun.exe

pid	process
1480	OfficeClickToRun.exe
4652	OfficeClickToRun.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 25 IoCs

Processes:

0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exeOfficeClickToRun.exe

pid	process
4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
1480	OfficeClickToRun.exe
1480	OfficeClickToRun.exe
1480	OfficeClickToRun.exe
1480	OfficeClickToRun.exe
1480	OfficeClickToRun.exe
1480	OfficeClickToRun.exe
1480	OfficeClickToRun.exe
1480	OfficeClickToRun.exe
1480	OfficeClickToRun.exe
1480	OfficeClickToRun.exe
1480	OfficeClickToRun.exe
1480	OfficeClickToRun.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exeOfficeClickToRun.exe

description	pid	process	target process
PID 4976 set thread context of 3824	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
PID 1480 set thread context of 4652	1480	OfficeClickToRun.exe	OfficeClickToRun.exe

Drops file in Program Files directory 9 IoCs

Processes:

0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe

description	ioc	process
File created	C:\Program Files\Windows NT\Accessories\en-US\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
File created	C:\Program Files\Windows NT\Accessories\en-US\8b2be0cc7bfe8939c8722c1b6ee8c4ef4a8ee2ce	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
File opened for modification	C:\Program Files\Microsoft Office\dllhost.exe	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
File created	C:\Program Files\Microsoft Office\5940a34987c99120d96dace90a3f93f329dcad63	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\spoolsv.exe	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
File created	C:\Program Files\Microsoft Office\dllhost.exe	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe

Drops file in Windows directory 2 IoCs

Processes:

0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe

description	ioc	process
File created	C:\Windows\InputMethod\CHT\OfficeClickToRun.exe	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
File created	C:\Windows\InputMethod\CHT\e6c9b481da804f07baff8eff543b0a1441069b5d	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2784	4976	WerFault.exe	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
1992	1480	WerFault.exe	OfficeClickToRun.exe

Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

1192 schtasks.exe
916 schtasks.exe
4620 schtasks.exe
1588 schtasks.exe
1292 schtasks.exe
2060 schtasks.exe
Delays execution with timeout.exe 6 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

3124 timeout.exe
3924 timeout.exe
4724 timeout.exe
2228 timeout.exe
3040 timeout.exe
4008 timeout.exe

pid	process
1192	schtasks.exe
916	schtasks.exe
4620	schtasks.exe
1588	schtasks.exe
1292	schtasks.exe
2060	schtasks.exe

pid	process
3124	timeout.exe
3924	timeout.exe
4724	timeout.exe
2228	timeout.exe
3040	timeout.exe
4008	timeout.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exeOfficeClickToRun.exeOfficeClickToRun.exe

pid	process
4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
1480	OfficeClickToRun.exe
1480	OfficeClickToRun.exe
1480	OfficeClickToRun.exe
4652	OfficeClickToRun.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exeOfficeClickToRun.exeOfficeClickToRun.exe

description	pid	process
Token: SeDebugPrivilege	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
Token: SeDebugPrivilege	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
Token: SeDebugPrivilege	1480	OfficeClickToRun.exe
Token: SeDebugPrivilege	4652	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.execmd.execmd.execmd.exe0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exeOfficeClickToRun.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4976 wrote to memory of 3968	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	cmd.exe
PID 4976 wrote to memory of 3968	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	cmd.exe
PID 4976 wrote to memory of 3968	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	cmd.exe
PID 3968 wrote to memory of 2228	3968	cmd.exe	timeout.exe
PID 3968 wrote to memory of 2228	3968	cmd.exe	timeout.exe
PID 3968 wrote to memory of 2228	3968	cmd.exe	timeout.exe
PID 4976 wrote to memory of 920	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	cmd.exe
PID 4976 wrote to memory of 920	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	cmd.exe
PID 4976 wrote to memory of 920	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	cmd.exe
PID 920 wrote to memory of 3040	920	cmd.exe	timeout.exe
PID 920 wrote to memory of 3040	920	cmd.exe	timeout.exe
PID 920 wrote to memory of 3040	920	cmd.exe	timeout.exe
PID 4976 wrote to memory of 1216	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	cmd.exe
PID 4976 wrote to memory of 1216	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	cmd.exe
PID 4976 wrote to memory of 1216	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	cmd.exe
PID 1216 wrote to memory of 4008	1216	cmd.exe	timeout.exe
PID 1216 wrote to memory of 4008	1216	cmd.exe	timeout.exe
PID 1216 wrote to memory of 4008	1216	cmd.exe	timeout.exe
PID 4976 wrote to memory of 3824	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
PID 4976 wrote to memory of 3824	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
PID 4976 wrote to memory of 3824	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
PID 4976 wrote to memory of 3824	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
PID 4976 wrote to memory of 3824	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
PID 4976 wrote to memory of 3824	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
PID 4976 wrote to memory of 3824	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
PID 4976 wrote to memory of 3824	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
PID 4976 wrote to memory of 3824	4976	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
PID 3824 wrote to memory of 916	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 916	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 916	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 4620	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 4620	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 4620	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 1588	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 1588	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 1588	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 1292	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 1292	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 1292	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 2060	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 2060	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 2060	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 1192	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 1192	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 1192	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	schtasks.exe
PID 3824 wrote to memory of 1480	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	OfficeClickToRun.exe
PID 3824 wrote to memory of 1480	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	OfficeClickToRun.exe
PID 3824 wrote to memory of 1480	3824	0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe	OfficeClickToRun.exe
PID 1480 wrote to memory of 4540	1480	OfficeClickToRun.exe	cmd.exe
PID 1480 wrote to memory of 4540	1480	OfficeClickToRun.exe	cmd.exe
PID 1480 wrote to memory of 4540	1480	OfficeClickToRun.exe	cmd.exe
PID 4540 wrote to memory of 3124	4540	cmd.exe	timeout.exe
PID 4540 wrote to memory of 3124	4540	cmd.exe	timeout.exe
PID 4540 wrote to memory of 3124	4540	cmd.exe	timeout.exe
PID 1480 wrote to memory of 1164	1480	OfficeClickToRun.exe	cmd.exe
PID 1480 wrote to memory of 1164	1480	OfficeClickToRun.exe	cmd.exe
PID 1480 wrote to memory of 1164	1480	OfficeClickToRun.exe	cmd.exe
PID 1164 wrote to memory of 3924	1164	cmd.exe	timeout.exe
PID 1164 wrote to memory of 3924	1164	cmd.exe	timeout.exe
PID 1164 wrote to memory of 3924	1164	cmd.exe	timeout.exe
PID 1480 wrote to memory of 3912	1480	OfficeClickToRun.exe	cmd.exe
PID 1480 wrote to memory of 3912	1480	OfficeClickToRun.exe	cmd.exe
PID 1480 wrote to memory of 3912	1480	OfficeClickToRun.exe	cmd.exe
PID 3912 wrote to memory of 4724	3912	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\Mydoom\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
"C:\Users\Admin\AppData\Local\Temp\Mydoom\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:3968

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:2228

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:920

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:3040

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:4008

C:\Users\Admin\AppData\Local\Temp\Mydoom\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
"C:\Users\Admin\AppData\Local\Temp\Mydoom\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"
2⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\dllhost.exe'" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:916

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe'" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:4620

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "dllhost" /sc ONLOGON /tr "'C:\Documents and Settings\dllhost.exe'" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:1588

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-US\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe'" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:1292

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\spoolsv.exe'" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2060

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\InputMethod\CHT\OfficeClickToRun.exe'" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:1192

C:\Windows\InputMethod\CHT\OfficeClickToRun.exe
"C:\Windows\InputMethod\CHT\OfficeClickToRun.exe"
3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
4⤵
- Suspicious use of WriteProcessMemory
PID:4540

C:\Windows\SysWOW64\timeout.exe
timeout 1
5⤵
- Delays execution with timeout.exe
PID:3124

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
4⤵
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\SysWOW64\timeout.exe
timeout 1
5⤵
- Delays execution with timeout.exe
PID:3924

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
4⤵
- Suspicious use of WriteProcessMemory
PID:3912

C:\Windows\SysWOW64\timeout.exe
timeout 1
5⤵
- Delays execution with timeout.exe
PID:4724

C:\Windows\InputMethod\CHT\OfficeClickToRun.exe
"C:\Windows\InputMethod\CHT\OfficeClickToRun.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 1752
4⤵
- Program crash
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 1196
2⤵
- Program crash
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4976 -ip 4976
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1480 -ip 1480
1⤵
PID:1704

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office 15\ClientX64\spoolsv.exe
Filesize
9.4MB

MD5
813b749967045532f86e6442447bcd8b

SHA1
8d0615e7f7ba672a3fc94c05a9451f9d08797af7

SHA256
0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464

SHA512
47c16f403ab33ebb9e59c7c3a053dc29d0d654174d2be9153966ad9fc873e641f34ab44c7e38fb4c6fd376b384d4e1da0dacafb384e9abb1c7eb92cb32533877

Download Submit
memory/3824-6-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/3824-7-0x0000000005EE0000-0x0000000005F46000-memory.dmp

Filesize
408KB

Download
memory/3824-9-0x0000000006CE0000-0x0000000006D72000-memory.dmp

Filesize
584KB

Download
memory/4976-0-0x0000000074BBE000-0x0000000074BBF000-memory.dmp

Filesize
4KB

Download
memory/4976-1-0x0000000000940000-0x000000000129C000-memory.dmp

Filesize
9.4MB

Download
memory/4976-2-0x0000000005CF0000-0x0000000005D8C000-memory.dmp

Filesize
624KB

Download
memory/4976-3-0x0000000006FE0000-0x0000000007126000-memory.dmp

Filesize
1.3MB

Download
memory/4976-4-0x0000000074BB0000-0x0000000075361000-memory.dmp

Filesize
7.7MB

Download
memory/4976-5-0x000000000B440000-0x000000000B9E6000-memory.dmp

Filesize
5.6MB

Download
memory/4976-8-0x0000000074BB0000-0x0000000075361000-memory.dmp

Filesize
7.7MB

Download