dcrat | 7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Size 1.2MB
Sample240616-blhw8sshqh
SHA256 7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d
MD5 418f825c59e0d356af1f50468043ff76
SHA1 4cb9afa9418ec197194afb1c3b47a5d41fb5345f
SHA512 4c7cc87817b226f91e206e2eaa88c91830f51595594e4bb1eb7eaf259f7352486345f69c31924b752249299fb767cc44b795d90de7364d238ed3021bdf43281d
SSDEEP 24576:FlQJKeQ3fDuaq7RrNTeCXtjGxV3Mc3ml3:wGneNTfXtCxV3Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		764	schtasks.exe
		4424	schtasks.exe
		4244	schtasks.exe
		560	schtasks.exe
		1868	schtasks.exe
		3636	schtasks.exe
		1908	schtasks.exe
		4616	schtasks.exe
		2360	schtasks.exe
		3116	schtasks.exe
		4496	schtasks.exe
		4956	schtasks.exe
		4488	schtasks.exe
		2924	schtasks.exe
		4436	schtasks.exe
		404	schtasks.exe
		760	schtasks.exe
		2276	schtasks.exe
		596	schtasks.exe
		2852	schtasks.exe
		4616	schtasks.exe
		3696	schtasks.exe
		1912	schtasks.exe
		4352	schtasks.exe
		3704	schtasks.exe
		1544	schtasks.exe
		3060	schtasks.exe
		4948	schtasks.exe
		1276	schtasks.exe
		4824	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Program Files\Google\Chrome\Application\SetupMetrics\e6c9b481da804f		7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
		2476	schtasks.exe
		1260	schtasks.exe
		4132	schtasks.exe
File created	C:\Windows\SKB\LanguageModels\0a1fd5f707cd16		7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
		1224	schtasks.exe
		4072	schtasks.exe
		3556	schtasks.exe
		4864	schtasks.exe
		3944	schtasks.exe
		3724	schtasks.exe
		4380	schtasks.exe
		884	schtasks.exe
File created	C:\Program Files (x86)\Windows Media Player\de-DE\5b884080fd4f94		7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
		4480	schtasks.exe
		2696	schtasks.exe
		4936	schtasks.exe
		2356	schtasks.exe
		2248	schtasks.exe
		3580	schtasks.exe
		596	schtasks.exe
		2784	schtasks.exe
		3996	schtasks.exe
		348	schtasks.exe
		1920	schtasks.exe
		3088	schtasks.exe
		4412	schtasks.exe
		4924	schtasks.exe
		4628	schtasks.exe
		396	schtasks.exe
		1204	schtasks.exe
		4896	schtasks.exe
		2712	schtasks.exe

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3696	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	596	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4244	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3556	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3996	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4352	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3720	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	596	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	348	3960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	3960	schtasks.exe	91

UAC bypass 3 TTPs 27 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3060-1-0x0000000000670000-0x00000000007B6000-memory.dmp	dcrat
behavioral2/files/0x0007000000023530-22.dat	dcrat

Detects executables packed with SmartAssembly 2 IoCs

resource	yara_rule
behavioral2/memory/3060-6-0x0000000002910000-0x000000000291A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3060-12-0x000000001B370000-0x000000001B37A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	msedge.exe

Executes dropped EXE 7 IoCs

pid	Process
2464	msedge.exe
812	msedge.exe
5092	msedge.exe
4436	msedge.exe
4824	msedge.exe
4396	msedge.exe
1640	msedge.exe

Checks whether UAC is enabled 1 TTPs 18 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msedge.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msedge.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msedge.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msedge.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
6	pastebin.com
13	pastebin.com
14	pastebin.com
15	pastebin.com
17	pastebin.com
27	pastebin.com

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\sysmon.exe	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Schema\spoolsv.exe	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\5940a34987c991	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Program Files\WindowsApps\explorer.exe	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\dllhost.exe	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Program Files (x86)\Windows Media Player\de-DE\fontdrvhost.exe	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Program Files (x86)\Windows Media Player\de-DE\5b884080fd4f94	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\121e5b5079f7c0	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Schema\f3b6ecef712a24	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Migration\WTR\csrss.exe	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Windows\SKB\LanguageModels\0a1fd5f707cd16	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Windows\Tasks\e1ef82546f0b02	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Windows\PLA\Reports\de-DE\9e8d7a4ca61bd9	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Windows\SKB\LanguageModels\sppsvc.exe	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Windows\Performance\WinSAT\dllhost.exe	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Windows\Performance\WinSAT\5940a34987c991	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Windows\Setup\fontdrvhost.exe	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Windows\Setup\5b884080fd4f94	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Windows\PLA\Reports\de-DE\RuntimeBroker.exe	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Windows\Tasks\SppExtComObj.exe	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Windows\InputMethod\SHARED\6cb0b6c459d5d3	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Windows\Migration\WTR\886983d96e3d3e	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
File created	C:\Windows\InputMethod\SHARED\dwm.exe	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4488	schtasks.exe
1224	schtasks.exe
3088	schtasks.exe
596	schtasks.exe
4864	schtasks.exe
760	schtasks.exe
560	schtasks.exe
4132	schtasks.exe
1544	schtasks.exe
4072	schtasks.exe
2712	schtasks.exe
4496	schtasks.exe
1260	schtasks.exe
4896	schtasks.exe
4832	schtasks.exe
3116	schtasks.exe
1428	schtasks.exe
2784	schtasks.exe
4424	schtasks.exe
4480	schtasks.exe
4948	schtasks.exe
3452	schtasks.exe
4824	schtasks.exe
4436	schtasks.exe
1276	schtasks.exe
4412	schtasks.exe
3704	schtasks.exe
396	schtasks.exe
2924	schtasks.exe
764	schtasks.exe
3556	schtasks.exe
5020	schtasks.exe
3060	schtasks.exe
1908	schtasks.exe
4324	schtasks.exe
1920	schtasks.exe
1868	schtasks.exe
4616	schtasks.exe
3580	schtasks.exe
4896	schtasks.exe
2360	schtasks.exe
2356	schtasks.exe
404	schtasks.exe
3636	schtasks.exe
4616	schtasks.exe
596	schtasks.exe
4352	schtasks.exe
3720	schtasks.exe
348	schtasks.exe
884	schtasks.exe
3724	schtasks.exe
3696	schtasks.exe
4380	schtasks.exe
4336	schtasks.exe
2696	schtasks.exe
2276	schtasks.exe
4936	schtasks.exe
4244	schtasks.exe
3680	schtasks.exe
3944	schtasks.exe
1912	schtasks.exe
4628	schtasks.exe
4956	schtasks.exe
2852	schtasks.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
3060	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
3060	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
3060	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
3060	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
3060	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
3060	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
3060	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
3060	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
3060	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
3060	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
3060	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
3060	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
3060	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
380	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
380	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
380	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
380	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
380	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
380	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
380	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
380	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
380	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
2464	msedge.exe
812	msedge.exe
812	msedge.exe
5092	msedge.exe
5092	msedge.exe
4436	msedge.exe
4824	msedge.exe
4396	msedge.exe
1640	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3060	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Token: SeDebugPrivilege	380	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Token: SeDebugPrivilege	2464	msedge.exe
Token: SeDebugPrivilege	812	msedge.exe
Token: SeDebugPrivilege	5092	msedge.exe
Token: SeDebugPrivilege	4436	msedge.exe
Token: SeDebugPrivilege	4824	msedge.exe
Token: SeDebugPrivilege	4396	msedge.exe
Token: SeDebugPrivilege	1640	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 4760	3060	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe	108
PID 3060 wrote to memory of 4760	3060	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe	108
PID 4760 wrote to memory of 2316	4760	cmd.exe	110
PID 4760 wrote to memory of 2316	4760	cmd.exe	110
PID 4760 wrote to memory of 380	4760	cmd.exe	111
PID 4760 wrote to memory of 380	4760	cmd.exe	111
PID 380 wrote to memory of 1536	380	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe	166
PID 380 wrote to memory of 1536	380	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe	166
PID 1536 wrote to memory of 4232	1536	cmd.exe	168
PID 1536 wrote to memory of 4232	1536	cmd.exe	168
PID 1536 wrote to memory of 2464	1536	cmd.exe	172
PID 1536 wrote to memory of 2464	1536	cmd.exe	172
PID 2464 wrote to memory of 2064	2464	msedge.exe	173
PID 2464 wrote to memory of 2064	2464	msedge.exe	173
PID 2064 wrote to memory of 4500	2064	cmd.exe	175
PID 2064 wrote to memory of 4500	2064	cmd.exe	175
PID 2064 wrote to memory of 812	2064	cmd.exe	180
PID 2064 wrote to memory of 812	2064	cmd.exe	180
PID 812 wrote to memory of 2784	812	msedge.exe	182
PID 812 wrote to memory of 2784	812	msedge.exe	182
PID 2784 wrote to memory of 4380	2784	cmd.exe	184
PID 2784 wrote to memory of 4380	2784	cmd.exe	184
PID 2784 wrote to memory of 5092	2784	cmd.exe	187
PID 2784 wrote to memory of 5092	2784	cmd.exe	187
PID 5092 wrote to memory of 2516	5092	msedge.exe	188
PID 5092 wrote to memory of 2516	5092	msedge.exe	188
PID 2516 wrote to memory of 3552	2516	cmd.exe	190
PID 2516 wrote to memory of 3552	2516	cmd.exe	190
PID 2516 wrote to memory of 4436	2516	cmd.exe	191
PID 2516 wrote to memory of 4436	2516	cmd.exe	191
PID 4436 wrote to memory of 1912	4436	msedge.exe	192
PID 4436 wrote to memory of 1912	4436	msedge.exe	192
PID 1912 wrote to memory of 2936	1912	cmd.exe	194
PID 1912 wrote to memory of 2936	1912	cmd.exe	194
PID 1912 wrote to memory of 4824	1912	cmd.exe	195
PID 1912 wrote to memory of 4824	1912	cmd.exe	195
PID 4824 wrote to memory of 3376	4824	msedge.exe	196
PID 4824 wrote to memory of 3376	4824	msedge.exe	196
PID 3376 wrote to memory of 4424	3376	cmd.exe	198
PID 3376 wrote to memory of 4424	3376	cmd.exe	198
PID 3376 wrote to memory of 4396	3376	cmd.exe	199
PID 3376 wrote to memory of 4396	3376	cmd.exe	199
PID 4396 wrote to memory of 4300	4396	msedge.exe	200
PID 4396 wrote to memory of 4300	4396	msedge.exe	200
PID 4300 wrote to memory of 3532	4300	cmd.exe	202
PID 4300 wrote to memory of 3532	4300	cmd.exe	202
PID 4300 wrote to memory of 1640	4300	cmd.exe	203
PID 4300 wrote to memory of 1640	4300	cmd.exe	203
PID 1640 wrote to memory of 4632	1640	msedge.exe	204
PID 1640 wrote to memory of 4632	1640	msedge.exe	204
PID 4632 wrote to memory of 3628	4632	cmd.exe	206
PID 4632 wrote to memory of 3628	4632	cmd.exe	206

System policy modification 1 TTPs 27 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
"C:\Users\Admin\AppData\Local\Temp\7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe"
1⤵
- DcRat
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tth6tw81Gg.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2316
- - C:\Users\Admin\AppData\Local\Temp\7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
    "C:\Users\Admin\AppData\Local\Temp\7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:380
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OgLzuqKo72.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1536
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:4232
    - - C:\Recovery\WindowsRE\msedge.exe
        
        "C:\Recovery\WindowsRE\msedge.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2464
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s2EHkno7yQ.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4500
        
        C:\Recovery\WindowsRE\msedge.exe
        
        "C:\Recovery\WindowsRE\msedge.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:812
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZH81p4FGmr.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2784
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:4380
        
        C:\Recovery\WindowsRE\msedge.exe
        
        "C:\Recovery\WindowsRE\msedge.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:5092
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZH81p4FGmr.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3552
        
        C:\Recovery\WindowsRE\msedge.exe
        
        "C:\Recovery\WindowsRE\msedge.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mJIFszAWFu.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2936
        
        C:\Recovery\WindowsRE\msedge.exe
        
        "C:\Recovery\WindowsRE\msedge.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AvSbArq942.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:4424
        
        C:\Recovery\WindowsRE\msedge.exe
        
        "C:\Recovery\WindowsRE\msedge.exe"
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4stVUxPy0P.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4300
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3532
        
        C:\Recovery\WindowsRE\msedge.exe
        
        "C:\Recovery\WindowsRE\msedge.exe"
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s2EHkno7yQ.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\SKB\LanguageModels\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Windows\SKB\LanguageModels\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d7" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d7" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Windows\Tasks\SppExtComObj.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\Tasks\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Windows\Tasks\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Desktop\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Desktop\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Desktop\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\Performance\WinSAT\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\WinSAT\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Windows\Setup\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Setup\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Windows\Setup\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\SoftwareDistribution\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\SoftwareDistribution\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Users\Public\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Public\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\Public\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Pictures\upfc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Public\Pictures\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\InputMethod\SHARED\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\InputMethod\SHARED\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Windows\InputMethod\SHARED\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\Migration\WTR\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\Migration\WTR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Public\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\PLA\Reports\de-DE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\PLA\Reports\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\PLA\Reports\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\dllhost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2860,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
1⤵
PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe

Path C:\Recovery\WindowsRE\7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe
Size 1.2MB
SHA256 7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d
MD5 418f825c59e0d356af1f50468043ff76
SHA1 4cb9afa9418ec197194afb1c3b47a5d41fb5345f
SHA512 4c7cc87817b226f91e206e2eaa88c91830f51595594e4bb1eb7eaf259f7352486345f69c31924b752249299fb767cc44b795d90de7364d238ed3021bdf43281d
SSDEEP 24576:FlQJKeQ3fDuaq7RrNTeCXtjGxV3Mc3ml3:wGneNTfXtCxV3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\7193ff366e3ef4c3c91c66be1f3c1d03701cf8c6a3034817749ba69650df187d.exe.log
Size 1KB
SHA256 43f6fa295df0ae3976c919bdd314b17768768b6eb14514b2b3a3fe8e7e477c5b
MD5 3dabc3a15559ada6586962e5d966af35
SHA1 b9e7ebe34532596154354f7130acafe8654016ef
SHA512 e828eb2af6cb4551e3174cfe8fbcd3c7923ad71c8d6dbf33432223bb230561f8145fc894f457f6660266c2658166fca486c557337f1bafc1b9973d19959fa348
MD5 SHA1 SHA512

Submit Download

msedge.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\msedge.exe.log
Size 1KB
SHA256 5779e6406a1a1a3938bcc0dcc2eecbdea9a23ae203d9d9dc678b056315139b69
MD5 45b7b984ff65c4ed6e0e1eec9a7e1dbb
SHA1 319c613685ba61edb0956fcb3301e659572e6255
SHA512 c8733ff26e452805c7791b1cd9a17913dafaf55567a6d8dea4bdd675aae5077d857b546878ab605101a2320e53621b9e07d2b0a51942ef14839891f2be581049
MD5 SHA1 SHA512

Submit Download

4stVUxPy0P.bat

Path C:\Users\Admin\AppData\Local\Temp\4stVUxPy0P.bat
Size 197B
SHA256 6e6fee339fd94d419024161cd47a823838f185c85dc9e0c0dab729b8eedc8ca8
MD5 3694e6b5cbea384236ba522b7c5ff580
SHA1 5f7ddffdc90127adbb72876fe5f2383d9bb12ce9
SHA512 8f343d6f18d70664456ee64b948a145db3967948b3e35de8e023c3ef9e577f7a783b34c897b24031ce22011eb06d96118195145be43548ff8ef215aed788bcf2
MD5 SHA1 SHA512

Submit Download

AvSbArq942.bat

Path C:\Users\Admin\AppData\Local\Temp\AvSbArq942.bat
Size 197B
SHA256 082effcc389fbf2f6655ce6d806ac3f8e597ee504d681b93cd539db39272b88b
MD5 59ffa279e2935fa7f770978777d81160
SHA1 81cacd3454d66ae05f9d7a8665a2e50cb6a3d0a7
SHA512 4c7e54588a7b4a5b69d557c342cb12d2b0b58575034f88d1101c2ebd8204e02eac40847ac15e548d3795e4f95212d6c9a72db615cd3db7babd75ace544782030
MD5 SHA1 SHA512

Submit Download

OgLzuqKo72.bat

Path C:\Users\Admin\AppData\Local\Temp\OgLzuqKo72.bat
Size 197B
SHA256 00d673f5234def7a08587793ee163f9c7beb075fba6f7239eb2673dac7839cb8
MD5 6d3a70b52106ed4f229c3adab372d7c5
SHA1 251aab0e86b05737e38f3df721a5e99782779a8a
SHA512 74f061dc24bf0167decd169bd1104c7bcf5f159e71e95266bb59ae857a436841336a3263508ac46147bd9fec2cabd6c75384b18c418e178142aa90aec95d1043
MD5 SHA1 SHA512

Submit Download

ZH81p4FGmr.bat

Path C:\Users\Admin\AppData\Local\Temp\ZH81p4FGmr.bat
Size 197B
SHA256 86cb5cc89254318ff08c3558a807005801f5261fdcf136c4b23df591928c29c1
MD5 0510a934625cfb1d376dbeb70d43780b
SHA1 e8ec427f0c44e5c3ff599d8fd2e2a4a8b90745e3
SHA512 159eda3e7c1d75ba4d4647b1efb69a74e625bc959fbbc07bab4ac3974096bc3703a1d1f510e99857f14d99fc9080cbe0e56d239ac2546eb23588cd302be42a11
MD5 SHA1 SHA512

Submit Download

mJIFszAWFu.bat

Path C:\Users\Admin\AppData\Local\Temp\mJIFszAWFu.bat
Size 197B
SHA256 985c05717f32457c2ec8e66648654f3a8c2cc4fcbc70fcde3d36f1234c4a2e51
MD5 cae31db1660e74984fa74522af58443a
SHA1 9f2dc5cb27e7f0df5f56a1cb7546835f31494017
SHA512 55eddbe62b2fcea36a5e41d9733a8ea0e5d8056fd6fef96e475f8492e18c7e86dffe826bfc84b27b9a7e8b90e0720459956e63f2d8a649076025ae8a883071ee
MD5 SHA1 SHA512

Submit Download

s2EHkno7yQ.bat

Path C:\Users\Admin\AppData\Local\Temp\s2EHkno7yQ.bat
Size 197B
SHA256 c6ffb47c4d5bea8ca621a66d024c04d66b708a7adf05a0b1873adbd9040fc225
MD5 9eb9b5d91ff4f55421e9e10d48ec76ab
SHA1 baaa087a738f6395c7dcc78a04eccabcef843dfc
SHA512 0bc5bf03610c1c95d98c60c549785bb8485eb6910e9786a64710c98c7da4087e6faab46e9ead126fcd5f7061a00349db30d193de5a0a9d6537d45d082d8169e8
MD5 SHA1 SHA512

Submit Download

tth6tw81Gg.bat

Path C:\Users\Admin\AppData\Local\Temp\tth6tw81Gg.bat
Size 267B
SHA256 db961a4be6b010a3fb81533cbc430905eb14d157eab046d818d836f02ddc9e3f
MD5 9206a564e9fb46786dbaf6c869fd0b55
SHA1 95a03bb5ad52b588a5692cb404ec34e9e25c16b5
SHA512 5c1b018091a15641bde71339bac25fd642175b49599486409d7bc7e1836e8d9aeca148080605c85f8616497c52c2a554ea8de9c695a5940e5c1813683cf0d0df
MD5 SHA1 SHA512

Submit Download

memory/3060-3-0x0000000000F90000-0x0000000000F98000-memory.dmp

Download

memory/3060-8-0x000000001B320000-0x000000001B328000-memory.dmp

Download

memory/3060-10-0x000000001C090000-0x000000001C5B8000-memory.dmp

Download

memory/3060-13-0x000000001B380000-0x000000001B38C000-memory.dmp

Download

memory/3060-11-0x000000001B360000-0x000000001B368000-memory.dmp

Download

memory/3060-29-0x00007FFF00A50000-0x00007FFF01511000-memory.dmp

Download

memory/3060-9-0x000000001B330000-0x000000001B342000-memory.dmp

Download

memory/3060-12-0x000000001B370000-0x000000001B37A000-memory.dmp

Download

memory/3060-7-0x000000001B310000-0x000000001B31C000-memory.dmp

Download

memory/3060-0-0x00007FFF00A53000-0x00007FFF00A55000-memory.dmp

Download

memory/3060-4-0x0000000000FA0000-0x0000000000FB6000-memory.dmp

Download

memory/3060-6-0x0000000002910000-0x000000000291A000-memory.dmp

Download

memory/3060-5-0x0000000002900000-0x0000000002908000-memory.dmp

Download

memory/3060-2-0x00007FFF00A50000-0x00007FFF01511000-memory.dmp

Download

memory/3060-1-0x0000000000670000-0x00000000007B6000-memory.dmp

Download