dcrat | 8ce6b9b905b77768b4806c491d303784d9ba8513c4616e07b8f7a75553a0d40f

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
50041c9d3b476dda21ed199fdf346aaf.exe
Size 3.1MB
Sample240617-pp2ems1arg
SHA256 8ce6b9b905b77768b4806c491d303784d9ba8513c4616e07b8f7a75553a0d40f
MD5 50041c9d3b476dda21ed199fdf346aaf
SHA1 5a73df246d5b9970f9c445127651b62ed502a375
SHA512 16440fb313281c9da99370cf05a433a28af41ac6a34692b7b31254e61b7af53c6b903fa9a885a33263d931b8246de307b14ffe0a24a6f30f8c16612b9b48c730
SSDEEP 49152:cqmwdl594cJ2gdv4B2lvBX/5LcB14vpKuoeZyZSP1RcvsjBux22wGVLf4O:cqHdnBJDkYBX/5LUivpKuoAqcQx2KL9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3896	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3504	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3304	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	3160	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	3160	schtasks.exe	85

UAC bypass 3 TTPs 9 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	50041c9d3b476dda21ed199fdf346aaf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	50041c9d3b476dda21ed199fdf346aaf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	50041c9d3b476dda21ed199fdf346aaf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2396-1-0x0000000000C20000-0x0000000000F34000-memory.dmp	dcrat
behavioral2/files/0x0007000000023400-43.dat	dcrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	50041c9d3b476dda21ed199fdf346aaf.exe

Executes dropped EXE 2 IoCs

pid	Process
2260	explorer.exe
3108	explorer.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	50041c9d3b476dda21ed199fdf346aaf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	50041c9d3b476dda21ed199fdf346aaf.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\7a0fd90576e088	50041c9d3b476dda21ed199fdf346aaf.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe	50041c9d3b476dda21ed199fdf346aaf.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\6203df4a6bafc7	50041c9d3b476dda21ed199fdf346aaf.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\wininit.exe	50041c9d3b476dda21ed199fdf346aaf.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\886983d96e3d3e	50041c9d3b476dda21ed199fdf346aaf.exe
File created	C:\Program Files\Common Files\System\it-IT\50041c9d3b476dda21ed199fdf346aaf.exe	50041c9d3b476dda21ed199fdf346aaf.exe
File created	C:\Program Files\Common Files\System\it-IT\f7dafa8b7e62e6	50041c9d3b476dda21ed199fdf346aaf.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe	50041c9d3b476dda21ed199fdf346aaf.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\7a0fd90576e088	50041c9d3b476dda21ed199fdf346aaf.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\csrss.exe	50041c9d3b476dda21ed199fdf346aaf.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\56085415360792	50041c9d3b476dda21ed199fdf346aaf.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\explorer.exe	50041c9d3b476dda21ed199fdf346aaf.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\twain_32\9e8d7a4ca61bd9	50041c9d3b476dda21ed199fdf346aaf.exe
File created	C:\Windows\ja-JP\dllhost.exe	50041c9d3b476dda21ed199fdf346aaf.exe
File created	C:\Windows\ja-JP\5940a34987c991	50041c9d3b476dda21ed199fdf346aaf.exe
File created	C:\Windows\twain_32\RuntimeBroker.exe	50041c9d3b476dda21ed199fdf346aaf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2900	schtasks.exe
5044	schtasks.exe
1684	schtasks.exe
3304	schtasks.exe
3884	schtasks.exe
1716	schtasks.exe
1208	schtasks.exe
3640	schtasks.exe
4232	schtasks.exe
388	schtasks.exe
2228	schtasks.exe
3896	schtasks.exe
3292	schtasks.exe
4556	schtasks.exe
1572	schtasks.exe
760	schtasks.exe
4120	schtasks.exe
2244	schtasks.exe
4764	schtasks.exe
4616	schtasks.exe
2164	schtasks.exe
4600	schtasks.exe
1688	schtasks.exe
4884	schtasks.exe
3084	schtasks.exe
2968	schtasks.exe
4984	schtasks.exe
1200	schtasks.exe
4752	schtasks.exe
2252	schtasks.exe
1140	schtasks.exe
1912	schtasks.exe
3504	schtasks.exe
2312	schtasks.exe
4492	schtasks.exe
4620	schtasks.exe
5060	schtasks.exe
3396	schtasks.exe
876	schtasks.exe
4048	schtasks.exe
2456	schtasks.exe
1928	schtasks.exe
5092	schtasks.exe
1784	schtasks.exe
2648	schtasks.exe
3608	schtasks.exe
4316	schtasks.exe
1144	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	50041c9d3b476dda21ed199fdf346aaf.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2396	50041c9d3b476dda21ed199fdf346aaf.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe
2260	explorer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	50041c9d3b476dda21ed199fdf346aaf.exe
Token: SeDebugPrivilege	2260	explorer.exe
Token: SeDebugPrivilege	3108	explorer.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2652	2396	50041c9d3b476dda21ed199fdf346aaf.exe	135
PID 2396 wrote to memory of 2652	2396	50041c9d3b476dda21ed199fdf346aaf.exe	135
PID 2652 wrote to memory of 1376	2652	cmd.exe	137
PID 2652 wrote to memory of 1376	2652	cmd.exe	137
PID 2652 wrote to memory of 2260	2652	cmd.exe	138
PID 2652 wrote to memory of 2260	2652	cmd.exe	138
PID 2260 wrote to memory of 3452	2260	explorer.exe	139
PID 2260 wrote to memory of 3452	2260	explorer.exe	139
PID 2260 wrote to memory of 1996	2260	explorer.exe	140
PID 2260 wrote to memory of 1996	2260	explorer.exe	140
PID 3452 wrote to memory of 3108	3452	WScript.exe	142
PID 3452 wrote to memory of 3108	3452	WScript.exe	142

System policy modification 1 TTPs 9 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	50041c9d3b476dda21ed199fdf346aaf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	50041c9d3b476dda21ed199fdf346aaf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	50041c9d3b476dda21ed199fdf346aaf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\50041c9d3b476dda21ed199fdf346aaf.exe
"C:\Users\Admin\AppData\Local\Temp\50041c9d3b476dda21ed199fdf346aaf.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QZF3yaD2g2.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1376
- - C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe
    "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2260
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\caa88042-85b4-45b4-8367-c862a7104bf6.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3452
    - - C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3108
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\904d62c7-ab21-4e48-88e4-738c07a96400.vbs"
      4⤵
      PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Windows\ja-JP\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "50041c9d3b476dda21ed199fdf346aaf5" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\System\it-IT\50041c9d3b476dda21ed199fdf346aaf.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "50041c9d3b476dda21ed199fdf346aaf" /sc ONLOGON /tr "'C:\Program Files\Common Files\System\it-IT\50041c9d3b476dda21ed199fdf346aaf.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "50041c9d3b476dda21ed199fdf346aaf5" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\System\it-IT\50041c9d3b476dda21ed199fdf346aaf.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Pictures\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Pictures\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\twain_32\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\twain_32\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\twain_32\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Users\Public\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Public\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Users\Public\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

50041c9d3b476dda21ed199fdf346aaf.exe

Path C:\Program Files\Common Files\System\it-IT\50041c9d3b476dda21ed199fdf346aaf.exe
Size 3.1MB
SHA256 8ce6b9b905b77768b4806c491d303784d9ba8513c4616e07b8f7a75553a0d40f
MD5 50041c9d3b476dda21ed199fdf346aaf
SHA1 5a73df246d5b9970f9c445127651b62ed502a375
SHA512 16440fb313281c9da99370cf05a433a28af41ac6a34692b7b31254e61b7af53c6b903fa9a885a33263d931b8246de307b14ffe0a24a6f30f8c16612b9b48c730
SSDEEP 49152:cqmwdl594cJ2gdv4B2lvBX/5LcB14vpKuoeZyZSP1RcvsjBux22wGVLf4O:cqHdnBJDkYBX/5LUivpKuoAqcQx2KL9
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log
Size 1KB
SHA256 414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
MD5 4a667f150a4d1d02f53a9f24d89d53d1
SHA1 306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA512 4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
MD5 SHA1 SHA512

Submit Download

904d62c7-ab21-4e48-88e4-738c07a96400.vbs

Path C:\Users\Admin\AppData\Local\Temp\904d62c7-ab21-4e48-88e4-738c07a96400.vbs
Size 514B
SHA256 df28c56dd9e59c9986b9766312530758f0845aee105b67cd4cb6eb6c025cc67c
MD5 2df7c31d51dc36adf366bd07c4ac0a4c
SHA1 1c8a1ea754976ebbd390f8be3d9549c322c537c5
SHA512 4ac9b411df0e0155a7b36d3bd44dda1ff91eee59b4cdac689187d65932391ce5cce67a57ab6bf5848882da2c385cb5e5b1a91065b3e80ebd8ad3aa65d0e765c7
MD5 SHA1 SHA512

Submit Download

QZF3yaD2g2.bat

Path C:\Users\Admin\AppData\Local\Temp\QZF3yaD2g2.bat
Size 227B
SHA256 d5128b03582ae4dbfe9be54d5441d99f4b89005c45b51dc041cd4683db597f33
MD5 25b0cf8f5721d1f18532aba25a095883
SHA1 03a77c14404e204fa0e1c7ef6aa9d23b105d0caa
SHA512 1bcb2e4924c342c0bb297f0eacb094400d9336863be91daf8b993a05c54262b7869e848c4e38434ee5a200ac693e29cd1ed9639a4e82e4385aced37e9779fbdd
MD5 SHA1 SHA512

Submit Download

caa88042-85b4-45b4-8367-c862a7104bf6.vbs

Path C:\Users\Admin\AppData\Local\Temp\caa88042-85b4-45b4-8367-c862a7104bf6.vbs
Size 738B
SHA256 992e08eab3ad398c77be95f18c5c737cd5e4d66a578f159c53455fdca18cf3a5
MD5 2b5277fd5d3fde3dc9272cf75719ca10
SHA1 f64e1af164b2de0287e4646bb15626c1c7e71427
SHA512 d2f49e772af1c27cf203afafd2964828dcd95222eedc559f637c2fd1f974d71609a64e8e32d96f5989dc024d0577cf0eccc26ff1289906ffefd46ce365e07a2b
MD5 SHA1 SHA512

Submit Download

memory/2260-77-0x00000000024D0000-0x00000000024E2000-memory.dmp

Download

memory/2396-20-0x000000001C400000-0x000000001C40C000-memory.dmp

Download

memory/2396-21-0x000000001C410000-0x000000001C418000-memory.dmp

Download

memory/2396-8-0x000000001BA80000-0x000000001BA96000-memory.dmp

Download

memory/2396-9-0x000000001BAA0000-0x000000001BAA8000-memory.dmp

Download

memory/2396-10-0x000000001BBD0000-0x000000001BBE2000-memory.dmp

Download

memory/2396-12-0x000000001BAB0000-0x000000001BABA000-memory.dmp

Download

memory/2396-11-0x000000001C350000-0x000000001C358000-memory.dmp

Download

memory/2396-13-0x000000001C360000-0x000000001C3B6000-memory.dmp

Download

memory/2396-14-0x000000001C340000-0x000000001C34C000-memory.dmp

Download

memory/2396-15-0x000000001C3B0000-0x000000001C3B8000-memory.dmp

Download

memory/2396-16-0x000000001C4C0000-0x000000001C4CC000-memory.dmp

Download

memory/2396-17-0x000000001C3C0000-0x000000001C3D2000-memory.dmp

Download

memory/2396-18-0x000000001CA00000-0x000000001CF28000-memory.dmp

Download

memory/2396-19-0x000000001C3F0000-0x000000001C3FC000-memory.dmp

Download

memory/2396-0-0x00007FFA75253000-0x00007FFA75255000-memory.dmp

Download

memory/2396-23-0x000000001C430000-0x000000001C43C000-memory.dmp

Download

memory/2396-22-0x000000001C420000-0x000000001C42C000-memory.dmp

Download

memory/2396-6-0x000000001BA60000-0x000000001BA68000-memory.dmp

Download

memory/2396-24-0x000000001C440000-0x000000001C448000-memory.dmp

Download

memory/2396-29-0x000000001C6E0000-0x000000001C6EC000-memory.dmp

Download

memory/2396-30-0x000000001C6F0000-0x000000001C6F8000-memory.dmp

Download

memory/2396-32-0x000000001C710000-0x000000001C71C000-memory.dmp

Download

memory/2396-33-0x00007FFA75250000-0x00007FFA75D11000-memory.dmp

Download

memory/2396-31-0x000000001C700000-0x000000001C70A000-memory.dmp

Download

memory/2396-36-0x00007FFA75250000-0x00007FFA75D11000-memory.dmp

Download

memory/2396-28-0x000000001C6D0000-0x000000001C6D8000-memory.dmp

Download

memory/2396-27-0x000000001C470000-0x000000001C47E000-memory.dmp

Download

memory/2396-26-0x000000001C460000-0x000000001C46A000-memory.dmp

Download

memory/2396-25-0x000000001C450000-0x000000001C45C000-memory.dmp

Download

memory/2396-7-0x000000001BA70000-0x000000001BA80000-memory.dmp

Download

memory/2396-5-0x000000001C1F0000-0x000000001C240000-memory.dmp

Download

memory/2396-73-0x00007FFA75250000-0x00007FFA75D11000-memory.dmp

Download

memory/2396-4-0x000000001BA40000-0x000000001BA5C000-memory.dmp

Download

memory/2396-3-0x0000000003010000-0x0000000003018000-memory.dmp

Download

memory/2396-2-0x00007FFA75250000-0x00007FFA75D11000-memory.dmp

Download

memory/2396-1-0x0000000000C20000-0x0000000000F34000-memory.dmp

Download