dcrat | 5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
18/06/2024, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Size 3.3MB
Sample240618-vldr3ascqa
SHA256 5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db
MD5 20ba93789eb7001ba9e4842bcc69fe62
SHA1 4f2de529f2094f978d35cfb040cbd6e7c6274f98
SHA512 327f2a7900f9900a6fb6f86f46efb8936b0327142f8e7120cd9d3db7b87b762c2288971b48ffe8fd3ec2e751f492652fb87da8197becf9b30e59b3d9247934b1
SSDEEP 49152:5PVa2oTM2mNcc1txMW/ixmw5d2eca2FBXElIu1KGwuEZ1Lz+6:5P932cd1txhi55Ie72kIu1xw5z+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer persistence rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\Idle.exe\", \"C:\\Program Files (x86)\\MSBuild\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\""	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\Idle.exe\", \"C:\\Program Files (x86)\\MSBuild\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\Program Files\\Uninstall Information\\RuntimeBroker.exe\""	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\Idle.exe\", \"C:\\Program Files (x86)\\MSBuild\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\Program Files\\Uninstall Information\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Cosa\\MO\\OfficeClickToRun.exe\""	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\Idle.exe\""	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\assembly\\Idle.exe\", \"C:\\Program Files (x86)\\MSBuild\\SppExtComObj.exe\""	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	908	3336	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	3336	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	3336	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	3336	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	440	3336	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	3336	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	3336	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3264	3336	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	3336	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	3336	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	3336	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	3336	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	3336	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	3336	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	3336	schtasks.exe	85

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/812-1-0x0000000000920000-0x0000000000C7A000-memory.dmp	dcrat
behavioral2/files/0x0007000000023559-47.dat	dcrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe

Executes dropped EXE 1 IoCs

pid	Process
968	OfficeClickToRun.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\MSBuild\\SppExtComObj.exe\""	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\MSBuild\\SppExtComObj.exe\""	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\WindowsRE\\lsass.exe\""	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\WindowsRE\\lsass.exe\""	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Uninstall Information\\RuntimeBroker.exe\""	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\Provisioning\\Cosa\\MO\\OfficeClickToRun.exe\""	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\Provisioning\\Cosa\\MO\\OfficeClickToRun.exe\""	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\assembly\\Idle.exe\""	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Uninstall Information\\RuntimeBroker.exe\""	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\assembly\\Idle.exe\""	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\e1ef82546f0b02	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
File created	C:\Program Files\Uninstall Information\RuntimeBroker.exe	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
File created	C:\Program Files\Uninstall Information\9e8d7a4ca61bd9	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
File created	C:\Program Files (x86)\MSBuild\SppExtComObj.exe	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Idle.exe	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
File opened for modification	C:\Windows\assembly\Idle.exe	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
File created	C:\Windows\assembly\6ccacd8608530f	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
File created	C:\Windows\Provisioning\Cosa\MO\OfficeClickToRun.exe	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
File created	C:\Windows\Provisioning\Cosa\MO\e6c9b481da804f	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1408	schtasks.exe
908	schtasks.exe
4732	schtasks.exe
1968	schtasks.exe
4936	schtasks.exe
3264	schtasks.exe
4248	schtasks.exe
4604	schtasks.exe
2948	schtasks.exe
4876	schtasks.exe
4964	schtasks.exe
4916	schtasks.exe
4980	schtasks.exe
2876	schtasks.exe
440	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
812	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
812	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
812	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
812	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
812	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
812	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
812	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
812	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
812	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe
968	OfficeClickToRun.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
968	OfficeClickToRun.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	812	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Token: SeDebugPrivilege	968	OfficeClickToRun.exe
Token: SeBackupPrivilege	2340	vssvc.exe
Token: SeRestorePrivilege	2340	vssvc.exe
Token: SeAuditPrivilege	2340	vssvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 968	812	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe	101
PID 812 wrote to memory of 968	812	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe	101
PID 968 wrote to memory of 460	968	OfficeClickToRun.exe	102
PID 968 wrote to memory of 460	968	OfficeClickToRun.exe	102
PID 968 wrote to memory of 3940	968	OfficeClickToRun.exe	103
PID 968 wrote to memory of 3940	968	OfficeClickToRun.exe	103

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe
"C:\Users\Admin\AppData\Local\Temp\5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:812
- C:\Windows\Provisioning\Cosa\MO\OfficeClickToRun.exe
  "C:\Windows\Provisioning\Cosa\MO\OfficeClickToRun.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:968
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a35c696-8351-417d-9a00-78c3d5284f73.vbs"
    3⤵
    PID:460
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee75aa4b-6447-4173-8eeb-a388bd6f3843.vbs"
    3⤵
    PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Windows\assembly\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\assembly\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Windows\assembly\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Windows\Provisioning\Cosa\MO\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\Provisioning\Cosa\MO\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Windows\Provisioning\Cosa\MO\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2a35c696-8351-417d-9a00-78c3d5284f73.vbs

Path C:\Users\Admin\AppData\Local\Temp\2a35c696-8351-417d-9a00-78c3d5284f73.vbs
Size 727B
SHA256 9a2c7106b5b44b44f36ef832974255c0184c6728a546e260ab33ded99a24d0bb
MD5 fdca45fb5e0b7c40c0f3b9826dfdcda4
SHA1 fabcaf4d10a3bd8cbe1de928a55d89e109d0a333
SHA512 1877ae46a99afac3e924b272ddd53bdd3aab072766f711c3ba619406ecaa0aef0d3b6459db5d0fe5cf331d71ade4daecb321b2d47bf8d1e87cd194631100d5a0
MD5 SHA1 SHA512

Submit Download

ee75aa4b-6447-4173-8eeb-a388bd6f3843.vbs

Path C:\Users\Admin\AppData\Local\Temp\ee75aa4b-6447-4173-8eeb-a388bd6f3843.vbs
Size 504B
SHA256 b824944612e7c9258da2fde907d3dc8ba5124245bdf97ad3d4cdfd4e1662c9d5
MD5 3fdd587776d3b6e40390633c79a86008
SHA1 843c1d97e8f619e0c6a03daffcd6c1ae589fd8e9
SHA512 ed4da84715737df5776d245e991a50ba318792b1489662d488179f9c1e7c980bc3cf280095eb66c0c061df188650659e50059a0b35f525741cfa5e029137ff33
MD5 SHA1 SHA512

Submit Download

OfficeClickToRun.exe

Path C:\Windows\Provisioning\Cosa\MO\OfficeClickToRun.exe
Size 3.3MB
SHA256 5d78dc803d29fba00eb080a58f1d85c33dbf50834886337083269ca1b5f1c1db
MD5 20ba93789eb7001ba9e4842bcc69fe62
SHA1 4f2de529f2094f978d35cfb040cbd6e7c6274f98
SHA512 327f2a7900f9900a6fb6f86f46efb8936b0327142f8e7120cd9d3db7b87b762c2288971b48ffe8fd3ec2e751f492652fb87da8197becf9b30e59b3d9247934b1
SSDEEP 49152:5PVa2oTM2mNcc1txMW/ixmw5d2eca2FBXElIu1KGwuEZ1Lz+6:5P932cd1txhi55Ie72kIu1xw5z+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/812-22-0x000000001C6B0000-0x000000001CBD8000-memory.dmp

Download

memory/812-24-0x000000001C190000-0x000000001C19C000-memory.dmp

Download

memory/812-5-0x0000000002EE0000-0x0000000002EFC000-memory.dmp

Download

memory/812-6-0x000000001BF60000-0x000000001BFB0000-memory.dmp

Download

memory/812-8-0x0000000002F00000-0x0000000002F10000-memory.dmp

Download

memory/812-7-0x0000000002EC0000-0x0000000002EC8000-memory.dmp

Download

memory/812-9-0x0000000002F10000-0x0000000002F26000-memory.dmp

Download

memory/812-10-0x000000001BF10000-0x000000001BF18000-memory.dmp

Download

memory/812-11-0x000000001BF20000-0x000000001BF32000-memory.dmp

Download

memory/812-12-0x000000001BF30000-0x000000001BF3C000-memory.dmp

Download

memory/812-13-0x000000001BF40000-0x000000001BF48000-memory.dmp

Download

memory/812-14-0x000000001BF50000-0x000000001BF60000-memory.dmp

Download

memory/812-15-0x000000001C0B0000-0x000000001C0BA000-memory.dmp

Download

memory/812-16-0x000000001C0C0000-0x000000001C116000-memory.dmp

Download

memory/812-17-0x000000001C110000-0x000000001C11C000-memory.dmp

Download

memory/812-18-0x000000001C120000-0x000000001C128000-memory.dmp

Download

memory/812-19-0x000000001C130000-0x000000001C13C000-memory.dmp

Download

memory/812-20-0x000000001C140000-0x000000001C148000-memory.dmp

Download

memory/812-21-0x000000001C150000-0x000000001C162000-memory.dmp

Download

memory/812-0-0x00007FFC9C9C3000-0x00007FFC9C9C5000-memory.dmp

Download

memory/812-4-0x00000000015B0000-0x00000000015B8000-memory.dmp

Download

memory/812-26-0x000000001C1B0000-0x000000001C1BC000-memory.dmp

Download

memory/812-23-0x000000001C180000-0x000000001C18C000-memory.dmp

Download

memory/812-25-0x000000001C1A0000-0x000000001C1A8000-memory.dmp

Download

memory/812-27-0x000000001C1C0000-0x000000001C1CC000-memory.dmp

Download

memory/812-29-0x000000001C2E0000-0x000000001C2EC000-memory.dmp

Download

memory/812-28-0x000000001C2D0000-0x000000001C2D8000-memory.dmp

Download

memory/812-30-0x000000001C2F0000-0x000000001C2FA000-memory.dmp

Download

memory/812-33-0x000000001C420000-0x000000001C42E000-memory.dmp

Download

memory/812-32-0x000000001C410000-0x000000001C418000-memory.dmp

Download

memory/812-31-0x000000001C400000-0x000000001C40E000-memory.dmp

Download

memory/812-35-0x000000001C440000-0x000000001C44C000-memory.dmp

Download

memory/812-34-0x000000001C430000-0x000000001C438000-memory.dmp

Download

memory/812-37-0x000000001C460000-0x000000001C46A000-memory.dmp

Download

memory/812-36-0x000000001C450000-0x000000001C458000-memory.dmp

Download

memory/812-38-0x000000001C470000-0x000000001C47C000-memory.dmp

Download

memory/812-3-0x00000000015A0000-0x00000000015AE000-memory.dmp

Download

memory/812-60-0x00007FFC9C9C0000-0x00007FFC9D481000-memory.dmp

Download

memory/812-2-0x00007FFC9C9C0000-0x00007FFC9D481000-memory.dmp

Download

memory/812-1-0x0000000000920000-0x0000000000C7A000-memory.dmp

Download

memory/968-70-0x000000001E1C0000-0x000000001E382000-memory.dmp

Download