dcrat | 025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e

Analysis

max time kernel
141s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Size 2.3MB
Sample240625-bc5dwaverj
SHA256 025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e
MD5 44d47833241e535bda3bd5a0294ecc16
SHA1 b7da3cc520a98e406873c095860a8ed5119986ac
SHA512 fd7cce88df2a563c90028751fc6a5c516029c26621ca2664d70a86f5f69ac02c5632d5a0973e06805f1ab1a0e25a4b6a26c91a6edfc99a9bb085d7a30e82653d
SSDEEP 49152:RB5FYV/4aGQLbQ0uiU+Ztv56GkbY7OmT:RBEVgNQLbL7UO1kbYSmT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 13 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Windows\\uk-UA\\System.exe\", \"C:\\Program Files\\Mozilla Firefox\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\spoolsv.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Registry.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\sysmon.exe\", \"C:\\Program Files\\Windows Media Player\\es-ES\\fontdrvhost.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Windows\\uk-UA\\System.exe\", \"C:\\Program Files\\Mozilla Firefox\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\spoolsv.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Registry.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\sysmon.exe\", \"C:\\Program Files\\Windows Media Player\\es-ES\\fontdrvhost.exe\", \"C:\\Users\\Admin\\Start Menu\\TextInputHost.exe\", \"C:\\Users\\Admin\\Start Menu\\smss.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Windows\\uk-UA\\System.exe\", \"C:\\Program Files\\Mozilla Firefox\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\spoolsv.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Windows\\uk-UA\\System.exe\", \"C:\\Program Files\\Mozilla Firefox\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\spoolsv.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Registry.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\sysmon.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Windows\\uk-UA\\System.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Windows\\uk-UA\\System.exe\", \"C:\\Program Files\\Mozilla Firefox\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\spoolsv.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Registry.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\sysmon.exe\", \"C:\\Program Files\\Windows Media Player\\es-ES\\fontdrvhost.exe\", \"C:\\Users\\Admin\\Start Menu\\TextInputHost.exe\", \"C:\\Users\\Admin\\Start Menu\\smss.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Windows\\uk-UA\\System.exe\", \"C:\\Program Files\\Mozilla Firefox\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\spoolsv.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Registry.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\sysmon.exe\", \"C:\\Program Files\\Windows Media Player\\es-ES\\fontdrvhost.exe\", \"C:\\Users\\Admin\\Start Menu\\TextInputHost.exe\", \"C:\\Users\\Admin\\Start Menu\\smss.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\RuntimeBroker.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Windows\\uk-UA\\System.exe\", \"C:\\Program Files\\Mozilla Firefox\\sppsvc.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Windows\\uk-UA\\System.exe\", \"C:\\Program Files\\Mozilla Firefox\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\spoolsv.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Registry.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Windows\\uk-UA\\System.exe\", \"C:\\Program Files\\Mozilla Firefox\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\spoolsv.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Registry.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\sysmon.exe\", \"C:\\Program Files\\Windows Media Player\\es-ES\\fontdrvhost.exe\", \"C:\\Users\\Admin\\Start Menu\\TextInputHost.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\unsecapp.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4060	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1212	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3780	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	804	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	804	schtasks.exe	85

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1008-1-0x0000000000900000-0x0000000000B52000-memory.dmp	dcrat
behavioral2/files/0x0007000000023507-20.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe

Executes dropped EXE 1 IoCs

pid	Process
644	System.exe

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Windows Media Player\\es-ES\\fontdrvhost.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Admin\\Start Menu\\smss.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\sysmon.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Windows Media Player\\es-ES\\fontdrvhost.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\WindowsRE\\lsass.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Mozilla Firefox\\sppsvc.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\sysmon.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\RemotePackages\\RemoteDesktops\\RuntimeBroker.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\uk-UA\\System.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Admin\\Start Menu\\smss.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Users\\Default User\\unsecapp.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Windows Media Player\\spoolsv.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Windows Media Player\\spoolsv.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\Admin\\Start Menu\\TextInputHost.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\Admin\\Start Menu\\TextInputHost.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\RemotePackages\\RemoteDesktops\\RuntimeBroker.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\Reference Assemblies\\Registry.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\WindowsRE\\lsass.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Users\\Default User\\unsecapp.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\uk-UA\\System.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Mozilla Firefox\\sppsvc.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\Reference Assemblies\\Registry.exe\""	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\sppsvc.exe	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
File created	C:\Program Files\Mozilla Firefox\0a1fd5f707cd16	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
File created	C:\Program Files (x86)\Windows Media Player\spoolsv.exe	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\121e5b5079f7c0	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
File created	C:\Program Files\ModifiableWindowsApps\wininit.exe	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
File created	C:\Program Files (x86)\Windows Media Player\f3b6ecef712a24	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
File created	C:\Program Files (x86)\Reference Assemblies\Registry.exe	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
File created	C:\Program Files (x86)\Reference Assemblies\ee2ad38f3d4382	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\sysmon.exe	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
File created	C:\Program Files\Windows Media Player\es-ES\fontdrvhost.exe	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
File created	C:\Program Files\Windows Media Player\es-ES\5b884080fd4f94	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\uk-UA\27d1bcfc3c54e0	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
File created	C:\Windows\ServiceState\fontdrvhost.exe	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
File created	C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
File created	C:\Windows\RemotePackages\RemoteDesktops\9e8d7a4ca61bd9	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
File created	C:\Windows\uk-UA\System.exe	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1908	schtasks.exe
1944	schtasks.exe
3884	schtasks.exe
372	schtasks.exe
3452	schtasks.exe
972	schtasks.exe
3048	schtasks.exe
3992	schtasks.exe
4672	schtasks.exe
4648	schtasks.exe
4616	schtasks.exe
5072	schtasks.exe
2812	schtasks.exe
2400	schtasks.exe
5052	schtasks.exe
2140	schtasks.exe
2964	schtasks.exe
3064	schtasks.exe
3524	schtasks.exe
4060	schtasks.exe
2620	schtasks.exe
2940	schtasks.exe
1760	schtasks.exe
3632	schtasks.exe
1360	schtasks.exe
4516	schtasks.exe
4564	schtasks.exe
984	schtasks.exe
1380	schtasks.exe
2284	schtasks.exe
3440	schtasks.exe
3780	schtasks.exe
3616	schtasks.exe
4120	schtasks.exe
4652	schtasks.exe
1212	schtasks.exe
456	schtasks.exe
3648	schtasks.exe
4720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
644	System.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
Token: SeDebugPrivilege	644	System.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 5044	1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe	125
PID 1008 wrote to memory of 5044	1008	025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe	125
PID 5044 wrote to memory of 2088	5044	cmd.exe	127
PID 5044 wrote to memory of 2088	5044	cmd.exe	127
PID 5044 wrote to memory of 644	5044	cmd.exe	131
PID 5044 wrote to memory of 644	5044	cmd.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe
"C:\Users\Admin\AppData\Local\Temp\025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QiV0Z2llid.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2088
- - C:\Windows\uk-UA\System.exe
    "C:\Windows\uk-UA\System.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Default User\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\uk-UA\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\uk-UA\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Windows\uk-UA\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\es-ES\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\es-ES\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\es-ES\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Start Menu\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Start Menu\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Start Menu\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Start Menu\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sppsvc.exe

Path C:\Program Files\Mozilla Firefox\sppsvc.exe
Size 2.3MB
SHA256 025ecb4bd7e95666a15b84ef10a548106f3495914a626da84fa491779fb9056e
MD5 44d47833241e535bda3bd5a0294ecc16
SHA1 b7da3cc520a98e406873c095860a8ed5119986ac
SHA512 fd7cce88df2a563c90028751fc6a5c516029c26621ca2664d70a86f5f69ac02c5632d5a0973e06805f1ab1a0e25a4b6a26c91a6edfc99a9bb085d7a30e82653d
SSDEEP 49152:RB5FYV/4aGQLbQ0uiU+Ztv56GkbY7OmT:RBEVgNQLbL7UO1kbYSmT
MD5 SHA1 SHA512 SSDEEP

Submit Download

QiV0Z2llid.bat

Path C:\Users\Admin\AppData\Local\Temp\QiV0Z2llid.bat
Size 192B
SHA256 49415a753df5b5375d5262685b0b87fec3d434bf7c4e1835465cf9b34940909c
MD5 4ea67e36e8b04f574be837ae6145a5e4
SHA1 b9e52fa41044ab1ad0d49628c2d543311baa817a
SHA512 22e7a5519e1dab4e54526f11bda5405acd3feec2661df9e0d007823287a1d5a6469e930706c39208f01d252d3533879a7757235852623f22007e4cb5b2ab6201
MD5 SHA1 SHA512

Submit Download

memory/644-49-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Download

memory/1008-4-0x000000001B6C0000-0x000000001B710000-memory.dmp

Download

memory/1008-0-0x00007FFE70A13000-0x00007FFE70A15000-memory.dmp

Download

memory/1008-5-0x000000001B670000-0x000000001B686000-memory.dmp

Download

memory/1008-6-0x000000001B860000-0x000000001B8B6000-memory.dmp

Download

memory/1008-7-0x000000001B690000-0x000000001B6A2000-memory.dmp

Download

memory/1008-8-0x000000001C740000-0x000000001CC68000-memory.dmp

Download

memory/1008-9-0x000000001B710000-0x000000001B71E000-memory.dmp

Download

memory/1008-11-0x000000001B730000-0x000000001B738000-memory.dmp

Download

memory/1008-10-0x000000001B720000-0x000000001B728000-memory.dmp

Download

memory/1008-3-0x0000000002CD0000-0x0000000002CEC000-memory.dmp

Download

memory/1008-44-0x00007FFE70A10000-0x00007FFE714D1000-memory.dmp

Download

memory/1008-2-0x00007FFE70A10000-0x00007FFE714D1000-memory.dmp

Download

memory/1008-1-0x0000000000900000-0x0000000000B52000-memory.dmp

Download