dcrat | 2f77a20ba2eacdaf74acc2be52db30061d378a817ea3ac1812ef1c95f23f735e

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f77a20ba2eacdaf74acc2be52db30061d378a817ea3ac1812ef1c95f23f735e.exe
Size 3.0MB
Sample240624-bfnwassblc
SHA256 2f77a20ba2eacdaf74acc2be52db30061d378a817ea3ac1812ef1c95f23f735e
MD5 025e30c61b7b2498e8f2dd87b3b088b7
SHA1 1411ef009403157d133143286ab26f7b50b728e3
SHA512 f058bfb9e8dbb624e8f9f146fb8845a390ce823d170b102e02d83ae5cb66499656b65b6361bf4202a2ff4c2bc12e8b59af9a68626b67c6ba15ce6a1a500c4b45
SSDEEP 49152:PbA3SIbQ5o1OkYYkX00FvTYeCZIqJcbTDtJmbrIdJzj:PbiQ5OkbY/ATDtJdJH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	2252	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	2252	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	2252	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	2252	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	2252	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	2252	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	2252	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2252	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2252	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	2252	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	2252	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	2252	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	2252	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3684	2252	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2252	schtasks.exe	90

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hypercommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hypercommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hypercommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000700000002345c-10.dat	dcrat
behavioral2/memory/660-13-0x0000000000550000-0x00000000007FC000-memory.dmp	dcrat
behavioral2/files/0x0007000000023478-74.dat	dcrat
behavioral2/files/0x0009000000023477-84.dat	dcrat
behavioral2/files/0x000900000002346d-100.dat	dcrat
behavioral2/files/0x0008000000023466-102.dat	dcrat
behavioral2/memory/2272-215-0x0000000000250000-0x00000000004FC000-memory.dmp	dcrat

Detects executables packed with SmartAssembly 3 IoCs

resource	yara_rule
behavioral2/memory/660-17-0x0000000002A40000-0x0000000002A50000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/660-20-0x000000001B360000-0x000000001B36A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/660-25-0x000000001B560000-0x000000001B56C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1232	powershell.exe
4588	powershell.exe
4116	powershell.exe
3484	powershell.exe
1244	powershell.exe
1552	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	2f77a20ba2eacdaf74acc2be52db30061d378a817ea3ac1812ef1c95f23f735e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	hypercommon.exe

Executes dropped EXE 2 IoCs

pid	Process
660	hypercommon.exe
2272	TextInputHost.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hypercommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hypercommon.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\swidtag\TextInputHost.exe	hypercommon.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX740E.tmp	hypercommon.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe	hypercommon.exe
File opened for modification	C:\Program Files\dotnet\swidtag\RCX710D.tmp	hypercommon.exe
File opened for modification	C:\Program Files\dotnet\swidtag\RCX718B.tmp	hypercommon.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX740D.tmp	hypercommon.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe	hypercommon.exe
File created	C:\Program Files\dotnet\swidtag\TextInputHost.exe	hypercommon.exe
File created	C:\Program Files\dotnet\swidtag\22eafd247d37c3	hypercommon.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\5940a34987c991	hypercommon.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tasks\sppsvc.exe	hypercommon.exe
File created	C:\Windows\Tasks\0a1fd5f707cd16	hypercommon.exe
File opened for modification	C:\Windows\Tasks\RCX6EBA.tmp	hypercommon.exe
File opened for modification	C:\Windows\Tasks\RCX6EBB.tmp	hypercommon.exe
File created	C:\Windows\Tasks\sppsvc.exe	hypercommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	2f77a20ba2eacdaf74acc2be52db30061d378a817ea3ac1812ef1c95f23f735e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hypercommon.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1516	schtasks.exe
2104	schtasks.exe
4184	schtasks.exe
4504	schtasks.exe
3368	schtasks.exe
4820	schtasks.exe
3684	schtasks.exe
2728	schtasks.exe
3496	schtasks.exe
3292	schtasks.exe
4644	schtasks.exe
2632	schtasks.exe
532	schtasks.exe
4724	schtasks.exe
2536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
660	hypercommon.exe
4116	powershell.exe
4116	powershell.exe
660	hypercommon.exe
3484	powershell.exe
3484	powershell.exe
1244	powershell.exe
1244	powershell.exe
4588	powershell.exe
4588	powershell.exe
1552	powershell.exe
1552	powershell.exe
1232	powershell.exe
1232	powershell.exe
4116	powershell.exe
3484	powershell.exe
1244	powershell.exe
4588	powershell.exe
1232	powershell.exe
1552	powershell.exe
660	hypercommon.exe
660	hypercommon.exe
2272	TextInputHost.exe
2272	TextInputHost.exe
2272	TextInputHost.exe
2272	TextInputHost.exe
2272	TextInputHost.exe
2272	TextInputHost.exe
2272	TextInputHost.exe
2272	TextInputHost.exe
2272	TextInputHost.exe
2272	TextInputHost.exe
2272	TextInputHost.exe
2272	TextInputHost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	660	hypercommon.exe
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeDebugPrivilege	3484	powershell.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeDebugPrivilege	4588	powershell.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeDebugPrivilege	2272	TextInputHost.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 5060	1408	2f77a20ba2eacdaf74acc2be52db30061d378a817ea3ac1812ef1c95f23f735e.exe	84
PID 1408 wrote to memory of 5060	1408	2f77a20ba2eacdaf74acc2be52db30061d378a817ea3ac1812ef1c95f23f735e.exe	84
PID 1408 wrote to memory of 5060	1408	2f77a20ba2eacdaf74acc2be52db30061d378a817ea3ac1812ef1c95f23f735e.exe	84
PID 5060 wrote to memory of 1032	5060	WScript.exe	91
PID 5060 wrote to memory of 1032	5060	WScript.exe	91
PID 5060 wrote to memory of 1032	5060	WScript.exe	91
PID 1032 wrote to memory of 660	1032	cmd.exe	93
PID 1032 wrote to memory of 660	1032	cmd.exe	93
PID 660 wrote to memory of 1232	660	hypercommon.exe	111
PID 660 wrote to memory of 1232	660	hypercommon.exe	111
PID 660 wrote to memory of 1552	660	hypercommon.exe	112
PID 660 wrote to memory of 1552	660	hypercommon.exe	112
PID 660 wrote to memory of 1244	660	hypercommon.exe	113
PID 660 wrote to memory of 1244	660	hypercommon.exe	113
PID 660 wrote to memory of 3484	660	hypercommon.exe	114
PID 660 wrote to memory of 3484	660	hypercommon.exe	114
PID 660 wrote to memory of 4116	660	hypercommon.exe	115
PID 660 wrote to memory of 4116	660	hypercommon.exe	115
PID 660 wrote to memory of 4588	660	hypercommon.exe	116
PID 660 wrote to memory of 4588	660	hypercommon.exe	116
PID 660 wrote to memory of 2272	660	hypercommon.exe	123
PID 660 wrote to memory of 2272	660	hypercommon.exe	123

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hypercommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hypercommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hypercommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2f77a20ba2eacdaf74acc2be52db30061d378a817ea3ac1812ef1c95f23f735e.exe
"C:\Users\Admin\AppData\Local\Temp\2f77a20ba2eacdaf74acc2be52db30061d378a817ea3ac1812ef1c95f23f735e.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\blockbrowsermonitordhcp\uQQph67rTANLpyChAg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\blockbrowsermonitordhcp\3lPtXgH9N1E9jEm.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1032
  - - C:\blockbrowsermonitordhcp\hypercommon.exe
      "C:\blockbrowsermonitordhcp\hypercommon.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:660
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\blockbrowsermonitordhcp\hypercommon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1232
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\swidtag\TextInputHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\sysmon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4588
    - - C:\Program Files\dotnet\swidtag\TextInputHost.exe
        
        "C:\Program Files\dotnet\swidtag\TextInputHost.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\Tasks\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Tasks\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\Tasks\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Program Files\dotnet\swidtag\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Program Files\dotnet\swidtag\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Admin\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX740E.tmp

Path C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX740E.tmp
Size 2.6MB
SHA256 58c7bad1e273d3fd150aaa0a353caa1cd10d2587fdbc57c22a7db9fb4f618463
MD5 a7dbe50a8629f0c63919d4dc40f76de7
SHA1 63a6c02f0a23f820da93fa8633a2da6c12aca09d
SHA512 4635bd5f85ef898fd38abd6d086821797235c2e57438f94c4b7af95dc945e877ab6346703fbda22af597179c642d484681c84b43592b25c1e7c69ea81c864198
SSDEEP 49152:gbQ5o1OkYYkX00FvTYeCZIqJcbTDtJmbrIdJz:oQ5OkbY/ATDtJdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TextInputHost.exe

Path C:\Program Files\dotnet\swidtag\TextInputHost.exe
Size 2.6MB
SHA256 6793ecc536270bc53f7d81e01d084b543d6d2dc5817c574ca8b258a93187beaf
MD5 4703d742bef79538d1dd42ebc991bacb
SHA1 afc1c89feb2e2b60f44bf7a66c92a5c7e216fde3
SHA512 0bc572e1b4dc93a7245324f633ff410944fc00a1bbdc4a7205079bbc54ffc9408467fdf30d054c893069ba44dd744dab88fc6ce0dfa19914688925384b1ad355
SSDEEP 49152:EbQ5o1OkYYkX00FvTYeCZIqJcbTDtJmbrIdJz:kQ5OkbY/ATDtJdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Recovery\WindowsRE\csrss.exe
Size 2.6MB
SHA256 cb831131c26796fe81b503e8623d23deee606950159393cf1beb2055c09e87f5
MD5 0100ac412fafabe38f8301396adb0cc0
SHA1 e834361e150a3f20194d6b36b663a7ae1765c509
SHA512 dfc41bd50b6fd24398e1a716315dc2a4a4a3690e9e01b0a5499d2a52ff99bd7f47c476fa08b5334295adabc8c9ce823707e70dad3826547976400f1661dcb14d
SSDEEP 49152:kbQ5o1OkYYkX00FvTYeCZIqJcbTDtJmbrIdJz:EQ5OkbY/ATDtJdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
MD5 2e907f77659a6601fcc408274894da2e
SHA1 9f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA512 34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
MD5 6d42b6da621e8df5674e26b799c8e2aa
SHA1 ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA512 53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_rcv1veqk.ulk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rcv1veqk.ulk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

sysmon.exe

Path C:\Users\Admin\sysmon.exe
Size 2.6MB
SHA256 471d4f1cbd8f3cbb42d3e5994309958861886f271f086f1190641087b3aa6b32
MD5 ec7c67d66ba9a536dbcedac151ab933e
SHA1 86cdb6788d2e9e1124e65b50a065a9ca24e33023
SHA512 bdd125006b9dbb8f1c3749c3a460b26ede094213bd7d07dc992ab61147582fa3ba2d2d591b9abf9e423a8dd7cd3099427d520f229c8e328c3d434eecb4c8fdc5
SSDEEP 49152:kbQ5o1OkYYkX00FvTYeCZIqJcbTDtJmbrIdJz:EQ5OkbY/ATDtJdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

3lPtXgH9N1E9jEm.bat

Path C:\blockbrowsermonitordhcp\3lPtXgH9N1E9jEm.bat
Size 44B
SHA256 ff732f4a3d7515b057cd1191df9964213cd23a5b0bc3c0b8530ce7dbbf2a8b30
MD5 dfeb95fa157da1ded3cbdba584de63a2
SHA1 9e75386d84fb0ededc6dfdfd53f91527a55f0932
SHA512 6c7d773ab54c544433ea57c7175a9366b658270e3d9a17f321947f71b01a563338aaeedfb4510a513dcef299749fae5d1eb7a5515339b3a926270e3633d6442a
MD5 SHA1 SHA512

Submit Download

hypercommon.exe

Path C:\blockbrowsermonitordhcp\hypercommon.exe
Size 2.6MB
SHA256 b89f847baffc578ee4a3ec45dcd8eaeea855c62461bd028c624640f276c5836b
MD5 81e375163a023a8cec995ddb29b2ac12
SHA1 c8c34c3adf868b8bd1f77810dcb7d7fcd54745b1
SHA512 2049870c1c1f1211f82980685f1148107ffb9a50515be62e7fb674ee9ad34c3f568eb1e156439031d64fe724bb4343f8e51f75f6c9ad013d077c842e25350181
SSDEEP 49152:gbQ5o1OkYYkX00FvTYeCZIqJcbTDtJmbrIdJz:oQ5OkbY/ATDtJdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

uQQph67rTANLpyChAg.vbe

Path C:\blockbrowsermonitordhcp\uQQph67rTANLpyChAg.vbe
Size 215B
SHA256 e7d558882675f3e81287374e61c8a45e287443c24ef523265a9e97cb1959eb61
MD5 a0284ee082313d67af8605120bb6afca
SHA1 d4f78af2a24b58ef5c4b0b996251323f767f4aa1
SHA512 db1d9a8bce149f30d2d04485402bf792888b6c308e3c175b5a69aa0ec322e1c86a8e797e2d4af729b63c4149d28ff43010b4d5831b58622f3dea614c86a26799
MD5 SHA1 SHA512

Submit Download

memory/660-16-0x000000001B380000-0x000000001B3D0000-memory.dmp

Download

memory/660-20-0x000000001B360000-0x000000001B36A000-memory.dmp

Download

memory/660-23-0x000000001B3D0000-0x000000001B3E2000-memory.dmp

Download

memory/660-24-0x000000001C4C0000-0x000000001C9E8000-memory.dmp

Download

memory/660-26-0x000000001BCF0000-0x000000001BCFE000-memory.dmp

Download

memory/660-27-0x000000001BD00000-0x000000001BD08000-memory.dmp

Download

memory/660-28-0x000000001BB80000-0x000000001BB8C000-memory.dmp

Download

memory/660-25-0x000000001B560000-0x000000001B56C000-memory.dmp

Download

memory/660-21-0x000000001B510000-0x000000001B566000-memory.dmp

Download

memory/660-22-0x000000001B370000-0x000000001B37C000-memory.dmp

Download

memory/660-19-0x000000001B350000-0x000000001B360000-memory.dmp

Download

memory/660-18-0x000000001B330000-0x000000001B346000-memory.dmp

Download

memory/660-12-0x00007FF9A10E3000-0x00007FF9A10E5000-memory.dmp

Download

memory/660-17-0x0000000002A40000-0x0000000002A50000-memory.dmp

Download

memory/660-13-0x0000000000550000-0x00000000007FC000-memory.dmp

Download

memory/660-15-0x0000000002910000-0x000000000292C000-memory.dmp

Download

memory/660-14-0x0000000002900000-0x0000000002908000-memory.dmp

Download

memory/2272-215-0x0000000000250000-0x00000000004FC000-memory.dmp

Download

memory/4116-149-0x000001746EDC0000-0x000001746EDE2000-memory.dmp

Download