dcrat | 7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 09:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
418f825c59e0d356af1f50468043ff76.exe
Size 1.2MB
Sample240615-k2qrfsycmq
SHA256 7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d
MD5 418f825c59e0d356af1f50468043ff76
SHA1 4cb9afa9418ec197194afb1c3b47a5d41fb5345f
SHA512 4c7cc87817b226f91e206e2eaa88c91830f51595594e4bb1eb7eaf259f7352486345f69c31924b752249299fb767cc44b795d90de7364d238ed3021bdf43281d
SSDEEP 24576:FlQJKeQ3fDuaq7RrNTeCXtjGxV3Mc3ml3:wGneNTfXtCxV3Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	464	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4356	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3768	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4268	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3176	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	712	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	612	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	3512	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1420	3512	schtasks.exe	82

UAC bypass 3 TTPs 24 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	418f825c59e0d356af1f50468043ff76.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	418f825c59e0d356af1f50468043ff76.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	418f825c59e0d356af1f50468043ff76.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2848-1-0x00000000007B0000-0x00000000008F6000-memory.dmp	dcrat
behavioral2/files/0x000700000002343d-22.dat	dcrat

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	418f825c59e0d356af1f50468043ff76.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe

Executes dropped EXE 7 IoCs

pid	Process
628	SppExtComObj.exe
2212	SppExtComObj.exe
2344	SppExtComObj.exe
3452	SppExtComObj.exe
2232	SppExtComObj.exe
4424	SppExtComObj.exe
1368	SppExtComObj.exe

Checks whether UAC is enabled 1 TTPs 16 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	418f825c59e0d356af1f50468043ff76.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	418f825c59e0d356af1f50468043ff76.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SppExtComObj.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
18	pastebin.com
19	pastebin.com
6	pastebin.com
15	pastebin.com
16	pastebin.com
17	pastebin.com

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\fr-FR\OfficeClickToRun.exe	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Program Files\Internet Explorer\fr-FR\e6c9b481da804f	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\5b884080fd4f94	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Program Files\Google\Chrome\38384e6a620884	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\fontdrvhost.exe	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\Registry.exe	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Program Files\Internet Explorer\fr-FR\OfficeClickToRun.exe	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Schema\lsass.exe	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Schema\6203df4a6bafc7	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Program Files\Google\Chrome\SearchApp.exe	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Program Files (x86)\Windows Portable Devices\csrss.exe	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Program Files (x86)\Windows Portable Devices\886983d96e3d3e	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Program Files\Windows Security\BrowserCore\OfficeClickToRun.exe	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Program Files\Windows Security\BrowserCore\e6c9b481da804f	418f825c59e0d356af1f50468043ff76.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\DigitalLocker\en-US\SppExtComObj.exe	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Windows\DigitalLocker\en-US\e1ef82546f0b02	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Windows\apppatch\upfc.exe	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Windows\apppatch\ea1d8f6d871115	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Windows\Performance\WinSAT\DataStore\418f825c59e0d356af1f50468043ff76.exe	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Windows\Performance\WinSAT\DataStore\b37f0f1858b84c	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Windows\PolicyDefinitions\es-ES\RuntimeBroker.exe	418f825c59e0d356af1f50468043ff76.exe
File created	C:\Windows\PolicyDefinitions\es-ES\9e8d7a4ca61bd9	418f825c59e0d356af1f50468043ff76.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3024	schtasks.exe
4484	schtasks.exe
2912	schtasks.exe
1956	schtasks.exe
4972	schtasks.exe
3916	schtasks.exe
1408	schtasks.exe
2756	schtasks.exe
1772	schtasks.exe
748	schtasks.exe
464	schtasks.exe
1708	schtasks.exe
1916	schtasks.exe
3176	schtasks.exe
712	schtasks.exe
1572	schtasks.exe
3640	schtasks.exe
2396	schtasks.exe
448	schtasks.exe
4880	schtasks.exe
816	schtasks.exe
2476	schtasks.exe
4928	schtasks.exe
4456	schtasks.exe
3768	schtasks.exe
2152	schtasks.exe
4664	schtasks.exe
4864	schtasks.exe
4596	schtasks.exe
5020	schtasks.exe
4816	schtasks.exe
4404	schtasks.exe
2400	schtasks.exe
2000	schtasks.exe
4340	schtasks.exe
4920	schtasks.exe
1108	schtasks.exe
4268	schtasks.exe
624	schtasks.exe
4776	schtasks.exe
3704	schtasks.exe
4256	schtasks.exe
4180	schtasks.exe
1448	schtasks.exe
4932	schtasks.exe
1420	schtasks.exe
3000	schtasks.exe
4356	schtasks.exe
4720	schtasks.exe
612	schtasks.exe
4688	schtasks.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	418f825c59e0d356af1f50468043ff76.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	SppExtComObj.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2848	418f825c59e0d356af1f50468043ff76.exe
2848	418f825c59e0d356af1f50468043ff76.exe
2848	418f825c59e0d356af1f50468043ff76.exe
2848	418f825c59e0d356af1f50468043ff76.exe
2848	418f825c59e0d356af1f50468043ff76.exe
2848	418f825c59e0d356af1f50468043ff76.exe
2848	418f825c59e0d356af1f50468043ff76.exe
2848	418f825c59e0d356af1f50468043ff76.exe
2848	418f825c59e0d356af1f50468043ff76.exe
2848	418f825c59e0d356af1f50468043ff76.exe
2848	418f825c59e0d356af1f50468043ff76.exe
2848	418f825c59e0d356af1f50468043ff76.exe
2848	418f825c59e0d356af1f50468043ff76.exe
2848	418f825c59e0d356af1f50468043ff76.exe
2848	418f825c59e0d356af1f50468043ff76.exe
2848	418f825c59e0d356af1f50468043ff76.exe
628	SppExtComObj.exe
2212	SppExtComObj.exe
2344	SppExtComObj.exe
3452	SppExtComObj.exe
2232	SppExtComObj.exe
4424	SppExtComObj.exe
1368	SppExtComObj.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	418f825c59e0d356af1f50468043ff76.exe
Token: SeDebugPrivilege	628	SppExtComObj.exe
Token: SeDebugPrivilege	2212	SppExtComObj.exe
Token: SeDebugPrivilege	2344	SppExtComObj.exe
Token: SeDebugPrivilege	3452	SppExtComObj.exe
Token: SeDebugPrivilege	2232	SppExtComObj.exe
Token: SeDebugPrivilege	4424	SppExtComObj.exe
Token: SeDebugPrivilege	1368	SppExtComObj.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2868	2848	418f825c59e0d356af1f50468043ff76.exe	136
PID 2848 wrote to memory of 2868	2848	418f825c59e0d356af1f50468043ff76.exe	136
PID 2868 wrote to memory of 780	2868	cmd.exe	138
PID 2868 wrote to memory of 780	2868	cmd.exe	138
PID 2868 wrote to memory of 628	2868	cmd.exe	140
PID 2868 wrote to memory of 628	2868	cmd.exe	140
PID 628 wrote to memory of 2108	628	SppExtComObj.exe	141
PID 628 wrote to memory of 2108	628	SppExtComObj.exe	141
PID 2108 wrote to memory of 1572	2108	cmd.exe	143
PID 2108 wrote to memory of 1572	2108	cmd.exe	143
PID 2108 wrote to memory of 2212	2108	cmd.exe	145
PID 2108 wrote to memory of 2212	2108	cmd.exe	145
PID 2212 wrote to memory of 4864	2212	SppExtComObj.exe	146
PID 2212 wrote to memory of 4864	2212	SppExtComObj.exe	146
PID 4864 wrote to memory of 1108	4864	cmd.exe	148
PID 4864 wrote to memory of 1108	4864	cmd.exe	148
PID 4864 wrote to memory of 2344	4864	cmd.exe	151
PID 4864 wrote to memory of 2344	4864	cmd.exe	151
PID 2344 wrote to memory of 3952	2344	SppExtComObj.exe	155
PID 2344 wrote to memory of 3952	2344	SppExtComObj.exe	155
PID 3952 wrote to memory of 3984	3952	cmd.exe	157
PID 3952 wrote to memory of 3984	3952	cmd.exe	157
PID 3952 wrote to memory of 3452	3952	cmd.exe	158
PID 3952 wrote to memory of 3452	3952	cmd.exe	158
PID 3452 wrote to memory of 948	3452	SppExtComObj.exe	159
PID 3452 wrote to memory of 948	3452	SppExtComObj.exe	159
PID 948 wrote to memory of 2376	948	cmd.exe	161
PID 948 wrote to memory of 2376	948	cmd.exe	161
PID 948 wrote to memory of 2232	948	cmd.exe	162
PID 948 wrote to memory of 2232	948	cmd.exe	162
PID 2232 wrote to memory of 4460	2232	SppExtComObj.exe	163
PID 2232 wrote to memory of 4460	2232	SppExtComObj.exe	163
PID 4460 wrote to memory of 2544	4460	cmd.exe	165
PID 4460 wrote to memory of 2544	4460	cmd.exe	165
PID 4460 wrote to memory of 4424	4460	cmd.exe	166
PID 4460 wrote to memory of 4424	4460	cmd.exe	166
PID 4424 wrote to memory of 1504	4424	SppExtComObj.exe	167
PID 4424 wrote to memory of 1504	4424	SppExtComObj.exe	167
PID 1504 wrote to memory of 1572	1504	cmd.exe	169
PID 1504 wrote to memory of 1572	1504	cmd.exe	169
PID 1504 wrote to memory of 1368	1504	cmd.exe	170
PID 1504 wrote to memory of 1368	1504	cmd.exe	170

System policy modification 1 TTPs 24 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	418f825c59e0d356af1f50468043ff76.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	418f825c59e0d356af1f50468043ff76.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	418f825c59e0d356af1f50468043ff76.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\418f825c59e0d356af1f50468043ff76.exe
"C:\Users\Admin\AppData\Local\Temp\418f825c59e0d356af1f50468043ff76.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\13IBiK6xH2.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:780
- - C:\Users\Public\SppExtComObj.exe
    "C:\Users\Public\SppExtComObj.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:628
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nGcIoKmMem.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2108
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:1572
    - - C:\Users\Public\SppExtComObj.exe
        
        "C:\Users\Public\SppExtComObj.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2212
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9ncYvmuuF5.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1108
        
        C:\Users\Public\SppExtComObj.exe
        
        "C:\Users\Public\SppExtComObj.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2344
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eQ9EwglUAP.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3984
        
        C:\Users\Public\SppExtComObj.exe
        
        "C:\Users\Public\SppExtComObj.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4yKdveU0JJ.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:948
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2376
        
        C:\Users\Public\SppExtComObj.exe
        
        "C:\Users\Public\SppExtComObj.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2232
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\syYKg8QxNI.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2544
        
        C:\Users\Public\SppExtComObj.exe
        
        "C:\Users\Public\SppExtComObj.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gSW9k5bhgR.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1572
        
        C:\Users\Public\SppExtComObj.exe
        
        "C:\Users\Public\SppExtComObj.exe"
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\fr-FR\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\fr-FR\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\fr-FR\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\OneDrive\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Admin\OneDrive\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\OneDrive\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Users\Public\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Public\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Users\Public\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\PolicyDefinitions\es-ES\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\PolicyDefinitions\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Default User\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Google\Chrome\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\VideoLAN\VLC\lua\playlist\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\playlist\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\lua\playlist\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\BrowserCore\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Windows\DigitalLocker\en-US\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Windows\DigitalLocker\en-US\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Windows\apppatch\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\apppatch\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Windows\apppatch\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "418f825c59e0d356af1f50468043ff764" /sc MINUTE /mo 7 /tr "'C:\Windows\Performance\WinSAT\DataStore\418f825c59e0d356af1f50468043ff76.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "418f825c59e0d356af1f50468043ff76" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\418f825c59e0d356af1f50468043ff76.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "418f825c59e0d356af1f50468043ff764" /sc MINUTE /mo 12 /tr "'C:\Windows\Performance\WinSAT\DataStore\418f825c59e0d356af1f50468043ff76.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Favorites\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\Favorites\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Favorites\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SppExtComObj.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SppExtComObj.exe.log
Size 1KB
SHA256 5779e6406a1a1a3938bcc0dcc2eecbdea9a23ae203d9d9dc678b056315139b69
MD5 45b7b984ff65c4ed6e0e1eec9a7e1dbb
SHA1 319c613685ba61edb0956fcb3301e659572e6255
SHA512 c8733ff26e452805c7791b1cd9a17913dafaf55567a6d8dea4bdd675aae5077d857b546878ab605101a2320e53621b9e07d2b0a51942ef14839891f2be581049
MD5 SHA1 SHA512

Submit Download

13IBiK6xH2.bat

Path C:\Users\Admin\AppData\Local\Temp\13IBiK6xH2.bat
Size 197B
SHA256 4eb5e085018dfc8cd739c92cf2d569c467cc02139d2265855fa78d62010e2c9f
MD5 fd87c823d7b040ab4eaebd0f0b02e0ef
SHA1 b275c43741bdca020e14003a2089faa2d6fa20f5
SHA512 76f2717133ffcf447582b6090d6a6b818d06ceda6bc7121c529d8a0455abcd07ce103798f6786c15de7fdc4bae9c08016b2326d31ffa14e214442860631276fe
MD5 SHA1 SHA512

Submit Download

4yKdveU0JJ.bat

Path C:\Users\Admin\AppData\Local\Temp\4yKdveU0JJ.bat
Size 197B
SHA256 ef2f6e936235e2cee8e4795446ec4cc15c938c4acd1558aa06498143fa76749f
MD5 a481fc21510d2312f48aa19cd9bedfe7
SHA1 21898f24a96af4e5403c5bdbe0f615c9fa67e5b4
SHA512 21f76d044698ee7fa11f879cc3465675a15a16d4250c381a7fa7556f5108a4561f416156c7f03d01955dc6232b57c1cc0c3c291009f864de6b85d78e7cca3ec6
MD5 SHA1 SHA512

Submit Download

9ncYvmuuF5.bat

Path C:\Users\Admin\AppData\Local\Temp\9ncYvmuuF5.bat
Size 197B
SHA256 97e0f36067e3bdd34b2823a93486da21a1b5feab14341433f9b9a6be8dd33c22
MD5 077097c3afd442a76e34f7ab334ac04c
SHA1 de03bbf93c068a77771bb706bb35dcf64d00b0ea
SHA512 36a1ec5370cd010e297f90b5de003366f08114b5e6415d28486968b599ead560eed1fff0e21a5d795015e807eacb50dc48e1dc2cbe097f469b21dde58dc7f2a0
MD5 SHA1 SHA512

Submit Download

eQ9EwglUAP.bat

Path C:\Users\Admin\AppData\Local\Temp\eQ9EwglUAP.bat
Size 197B
SHA256 dee07dfbee77b4f3ac90ca700261ed990f42db67a87c0439711a7b3c46dc2977
MD5 803c4d2d2755f5077234debcbd023889
SHA1 f9fed2d2e52079e2793b9050b737fa443b6726ef
SHA512 27a4524fdcdfaab394223d71a696e16e2646c3e838db70d1dd67ad8d0ccbbe36940342cce26c208ae4372bbdd71ac55ad4c142812a2dfbae66ee17feeeb408b3
MD5 SHA1 SHA512

Submit Download

gSW9k5bhgR.bat

Path C:\Users\Admin\AppData\Local\Temp\gSW9k5bhgR.bat
Size 197B
SHA256 21a7d27ba7e2c72efe6893572cfe7ca6aa52503733a9a3b9410e83a30e06e2bd
MD5 35462cb1e242e4a27a87d272fc3cb7f1
SHA1 dee403721c245dade5c1fe513e48f53b2e969cac
SHA512 5238b5f19323ba5450e5286b2fd8e7163a9886ab481a5a34042f79ef1027d2ede553448bef08e63fdd7d08c9c7eb5b77f93d703c81ecc76108c60125ec13f294
MD5 SHA1 SHA512

Submit Download

nGcIoKmMem.bat

Path C:\Users\Admin\AppData\Local\Temp\nGcIoKmMem.bat
Size 197B
SHA256 10407f1e8cd2a0d2f465f0caae833aef2fc4442793302e8361f2c7082652adc7
MD5 ef1e31f1eaa422e5765e500de2124025
SHA1 51221431ede283f24e4629c1880946aaf2d33c18
SHA512 59f355053fa2334dff919c0792ec5dd96c7f233d6fff8c9f29bb6b510dbace2d7df8b7f7c8099669dd420a1683244c642f3579fd54b38c26433e5c4b4efc79f1
MD5 SHA1 SHA512

Submit Download

syYKg8QxNI.bat

Path C:\Users\Admin\AppData\Local\Temp\syYKg8QxNI.bat
Size 197B
SHA256 df4c319f46ff1a741d6cd9dafd48ee6dcb3874a0b2157086d8cd954dd936a164
MD5 6c52f537a62e0e7bf0babe5ab0b710aa
SHA1 2a4229ed1bf369565eb3efb1b8802308bf60fe19
SHA512 9bcf1805d30cb9b06849e24a823ba615f93b857653b81d1cebed2fb6b5c7c77f3248412998cc594e0aedb159950891af82c54e0f8650b522cbac59d4ec9d6107
MD5 SHA1 SHA512

Submit Download

upfc.exe

Path C:\Users\Admin\OneDrive\upfc.exe
Size 1.2MB
SHA256 7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d
MD5 418f825c59e0d356af1f50468043ff76
SHA1 4cb9afa9418ec197194afb1c3b47a5d41fb5345f
SHA512 4c7cc87817b226f91e206e2eaa88c91830f51595594e4bb1eb7eaf259f7352486345f69c31924b752249299fb767cc44b795d90de7364d238ed3021bdf43281d
SSDEEP 24576:FlQJKeQ3fDuaq7RrNTeCXtjGxV3Mc3ml3:wGneNTfXtCxV3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2212-70-0x000000001C1C0000-0x000000001C32A000-memory.dmp

Download

memory/2848-3-0x000000001B4F0000-0x000000001B4F8000-memory.dmp

Download

memory/2848-8-0x000000001B660000-0x000000001B668000-memory.dmp

Download

memory/2848-11-0x000000001B6A0000-0x000000001B6A8000-memory.dmp

Download

memory/2848-13-0x000000001B6C0000-0x000000001B6CC000-memory.dmp

Download

memory/2848-10-0x000000001C1A0000-0x000000001C6C8000-memory.dmp

Download

memory/2848-53-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp

Download

memory/2848-9-0x000000001B670000-0x000000001B682000-memory.dmp

Download

memory/2848-12-0x000000001B6B0000-0x000000001B6BA000-memory.dmp

Download

memory/2848-7-0x000000001B650000-0x000000001B65C000-memory.dmp

Download

memory/2848-0-0x00007FFCCB8F3000-0x00007FFCCB8F5000-memory.dmp

Download

memory/2848-4-0x000000001B500000-0x000000001B516000-memory.dmp

Download

memory/2848-5-0x000000001B520000-0x000000001B528000-memory.dmp

Download

memory/2848-6-0x000000001B640000-0x000000001B64A000-memory.dmp

Download

memory/2848-2-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp

Download

memory/2848-1-0x00000000007B0000-0x00000000008F6000-memory.dmp

Download